{"id":107307,"date":"2023-03-16T12:48:10","date_gmt":"2023-03-16T10:48:10","guid":{"rendered":"https:\/\/prohoster.info\/?p=107307"},"modified":"2023-03-17T13:35:25","modified_gmt":"2023-03-17T11:35:25","slug":"obnovlenie-openssh-9-3-s-ustraneniem-problem-s-bezopasnostyu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/obnovlenie-openssh-9-3-s-ustraneniem-problem-s-bezopasnostyu","title":{"rendered":"Azhorimi OpenSSH 9.3 me zgjidhjen e problemeve me sigurin\u00eb","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
\u00cbsht\u00eb publikuar rrelease OpenSSH 9.3, zbatimi i hapur i klientit dhe serverit p\u00ebr t\u00eb punuar me protokollet SSH 2.0 dhe SFTP. N\u00eb versionin e ri jan\u00eb zgjidhur probleme t\u00eb siguris\u00eb: <\/p>\n
\n
N\u00eb utilitarin ssh-add \u00ebsht\u00eb zbuluar nj\u00eb gabim logjik, i cili b\u00ebn q\u00eb kur shtohen \u00e7el\u00ebsa p\u00ebr kartat inteligjente n\u00eb ssh-agent, kufizimet e p\u00ebrcaktuara me opsionin «ssh-add -h» t\u00eb mos i kalojn\u00eb agentit. Si rezultat, n\u00eb agent shtohet nj\u00eb \u00e7el\u00ebs p\u00ebr t\u00eb cilin nuk aplikohen kufizimet q\u00eb lejojn\u00eb lidhjet vet\u00ebm nga disa hoste t\u00eb caktuar.\n
N\u00eb utilitarin ssh \u00ebsht\u00eb zbuluar nj\u00eb cenueshm\u00ebri, e cila mund t\u00eb \u00e7oj\u00eb n\u00eb leximin e t\u00eb dh\u00ebnave nga zona e stack-ut jasht\u00eb buffers t\u00eb ndar\u00eb, kur trajtohen p\u00ebrgjigje DNS t\u00eb formuluara n\u00eb m\u00ebnyr\u00eb specifike, n\u00eb rast se \u00ebsht\u00eb aktivizuar n\u00eb skedarin e konfigurimit cil\u00ebsimi VerifyHostKeyDNS. Problemi \u00ebsht\u00eb i pranish\u00ebm n\u00eb implementimin e integruar t\u00eb funksionit getrrsetbyname(), i cili p\u00ebrdoret n\u00eb versionet e portuara t\u00eb OpenSSH, t\u00eb cilat kompilohen pa p\u00ebrdorimin e bibliotek\u00ebs s\u00eb jashtme ldns (—with-ldns) dhe n\u00eb sisteme me bibliotekat standarde q\u00eb nuk mb\u00ebshtesin thirrjen getrrsetbyname(). Mund\u00ebsia e eksploitimit t\u00eb k\u00ebsaj cenueshm\u00ebrie, p\u00ebrve\u00e7se p\u00ebr t\u00eb iniciuar nj\u00eb refuzim sh\u00ebrbimi p\u00ebr klientin ssh, vler\u00ebsohet si e pak\u00ebt. <\/ul>\n
P\u00ebr m\u00eb tep\u00ebr, mund t\u00eb p\u00ebrmendet nj\u00eb cenueshm\u00ebri n\u00eb bibliotek\u00ebn libskey q\u00eb b\u00ebn pjes\u00eb n\u00eb OpenBSD, e cila p\u00ebrdoret n\u00eb OpenSSH. Problemi \u00ebsht\u00eb i pranish\u00ebm q\u00eb nga viti 1997 dhe mund t\u00eb \u00e7oj\u00eb n\u00eb mbushjen e buffer-it n\u00eb stack gjat\u00eb trajtimit t\u00eb emrave t\u00eb hosteve t\u00eb formuluar n\u00eb m\u00ebnyr\u00eb specifike. V\u00ebreni se, megjith\u00ebse manifestimi i cenueshm\u00ebris\u00eb mund t\u00eb inicohet n\u00eb distanc\u00eb p\u00ebrmes OpenSSH, n\u00eb praktik\u00eb, cenueshm\u00ebria \u00ebsht\u00eb e pap\u00ebrdorshme, pasi p\u00ebr ta manifestuar, emri i hostit t\u00eb sulmuar (\/etc\/hostname) duhet t\u00eb p\u00ebrmbaj\u00eb m\u00eb shum\u00eb se 126 karaktere, dhe buffer-i mund t\u00eb mbushet vet\u00ebm me karaktere me kod zero (‘\0’). <\/p>\n
Nd\u00ebr ndryshimet q\u00eb nuk lidhen me sigurin\u00eb: <\/p>\n
\n
N\u00eb ssh-keygen dhe ssh-keyscan \u00ebsht\u00eb shtuar mb\u00ebshtetje p\u00ebr parametrin «-Ohashalg=sha1|sha256» p\u00ebr t\u00eb zgjedhur algoritmin e shfaqjes s\u00eb shenjave SSHFP.\n
N\u00eb sshd \u00ebsht\u00eb shtuar opsioni «-G» p\u00ebr ta analizuar dhe shfaqur konfigurimin aktiv pa p\u00ebrpjekjet e ngarkimit t\u00eb \u00e7el\u00ebsave t\u00eb mbyllur dhe pa kryer verifikime shtes\u00eb, \u00e7ka lejon t\u00eb kontrollohet konfigurimi n\u00eb faz\u00ebn p\u00ebrpara gjenerimit t\u00eb \u00e7el\u00ebsave dhe t\u00eb kryhet verifikimi nga p\u00ebrdorues t\u00eb paprivilegjuar.\n
N\u00eb sshd \u00ebsht\u00eb p\u00ebrforcuar izolimi n\u00eb platform\u00ebn Linux, duke p\u00ebrdorur mekanizmat e filtrimit t\u00eb thirrjeve sistemike seccomp dhe seccomp-bpf. Flagat p\u00ebr mmap, madvise dhe futex jan\u00eb shtuar n\u00eb list\u00ebn e thirrjeve t\u00eb lejuara. <\/ul>\n