{"id":117137,"date":"2024-07-09T15:43:01","date_gmt":"2024-07-09T13:43:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-paketah-s-openssh-iz-sostava-rhel-9-dopuskayushhaya-udalyonnoe-vypolnenie-koda"},"modified":"2024-07-09T15:43:01","modified_gmt":"2024-07-09T13:43:01","slug":"uyazvimost-v-paketah-s-openssh-iz-sostava-rhel-9-dopuskayushhaya-udalyonnoe-vypolnenie-koda","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-paketah-s-openssh-iz-sostava-rhel-9-dopuskayushhaya-udalyonnoe-vypolnenie-koda","title":{"rendered":"Nj\u00eb vulnerabilitet n\u00eb paketat me OpenSSH n\u00eb RHEL 9 q\u00eb lejon ekzekutimin e kodit nga distanca.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Gjat\u00eb analiz\u00ebs s\u00eb cenueshm\u00ebris\u00eb kritike t\u00eb zbuluar jav\u00ebn e kaluar n\u00eb OpenSSH, u identifikua edhe nj\u00eb cenueshm\u00ebri tjet\u00ebr e ngjashme (CVE-2024-6409), q\u00eb mund\u00ebson ekzekutim t\u00eb kodit n\u00eb distanc\u00eb pa kaluar autentikimin. Cenueshm\u00ebria e re nuk \u00ebsht\u00eb aq e rrezikshme sa ajo e m\u00ebparshmja, sepse shfaqet pas uljes s\u00eb privilegjeve n\u00eb procesin bij\u00eb t\u00eb nisur nga serveri SSH. Cenueshm\u00ebria gjendet n\u00eb paketat openssh t\u00eb shp\u00ebrndarjes Red Hat Enterprise Linux 9, t\u00eb bazuara n\u00eb versionin OpenSSH 8.7 t\u00eb publikuar n\u00eb vitin 2021. Problemi prek gjithashtu paketat p\u00ebr Fedora Linux 36 dhe 37, t\u00eb bazuara n\u00eb versionet OpenSSH 8.7 dhe 8.8. <\/p>\n
N\u00eb thelb, cenueshm\u00ebria \u00ebsht\u00eb e ngjashme me problemin e m\u00ebparsh\u00ebm dhe shkaktohet po ashtu nga nj\u00eb race condition n\u00eb trajtuesin e nd\u00ebrprerjes SIGALRM, q\u00eb lind si pasoj\u00eb e ekzekutimit t\u00eb funksioneve q\u00eb nuk jan\u00eb projektuar p\u00ebr t'u thirrur n\u00eb m\u00ebnyr\u00eb asinkrone nga trajtuesit e sinjaleve. Trajtuesi aktivizohet kur skadon afati i p\u00ebrcaktuar nga parametri LoginGraceTime dhe nd\u00ebrpret ekzekutimin aktual t\u00eb kodit. P\u00ebrdorimi n\u00eb trajtuesin e nd\u00ebrprerjeve i funksioneve q\u00eb nuk jan\u00eb menduar p\u00ebr ekzekutim asinkron, e q\u00eb p\u00ebrdorin alokim dinamik t\u00eb memories, si p.sh. syslog(), mund t\u00eb \u00e7oj\u00eb n\u00eb d\u00ebmtimin e strukturave t\u00eb brendshme t\u00eb malloc kur SIGALRM aktivizohet gjat\u00eb ekzekutimit t\u00eb nj\u00eb pjese t\u00eb caktuar t\u00eb kodit. <\/p>\n
Cenueshm\u00ebria e re dallon nga ajo e m\u00ebparshmja n\u00eb faktin se race condition lind p\u00ebr shkak t\u00eb thirrjes s\u00eb funksionit cleanup_exit() brenda trajtuesit t\u00eb sinjalit grace_alarm_handler(). N\u00eb baz\u00ebn kryesore t\u00eb kodit t\u00eb OpenSSH, ky funksion mund t\u00eb p\u00ebrdoret n\u00eb kod q\u00eb ekzekutohet n\u00eb m\u00ebnyr\u00eb asinkrone, por n\u00eb paketat p\u00ebr RHEL 9 dhe Fedora \u00ebsht\u00eb aplikuar nj\u00eb patch shtes\u00eb q\u00eb i shton cleanup_exit() nj\u00eb thirrje t\u00eb funksionit p\u00ebr gjenerimin e ngjarjeve t\u00eb auditimit, i cili nuk \u00ebsht\u00eb projektuar p\u00ebr p\u00ebrdorim n\u00eb trajtuesit e sinjaleve. <\/p>\n
Ky ky\u00e7i \u00ebsht\u00eb p\u00ebrdorur n\u00eb RHEL 9 dhe shp\u00ebrndarje t\u00eb tjera t\u00eb bazuara n\u00eb pacet, q\u00eb kan\u00eb si baz\u00eb OpenSSH 8.7p1. N\u00eb versionet e fundit t\u00eb Fedora, problemi nuk \u00ebsht\u00eb i pranish\u00ebm, pasi q\u00eb nga Fedora 38, shp\u00ebrndarja kaloi n\u00eb nj\u00eb version m\u00eb t\u00eb ri t\u00eb OpenSSH pa ndryshuar cleanup_exit(). Ndryshe nga dob\u00ebsia e kaluar, nj\u00eb m\u00ebnyr\u00eb an\u00ebsore p\u00ebr t\u00eb bllokuar problemin e ri nuk \u00ebsht\u00eb e p\u00ebrshtatshme, duke u bazuar n\u00eb p\u00ebrdorimin e opsionit «-e» n\u00eb sshd, i cili \u00e7aktivizon logimin p\u00ebrmes syslog. Megjithat\u00eb, p\u00ebr t\u00eb bllokuar dob\u00ebsin\u00eb n\u00eb sshd_config, mund t\u00eb vendoset parametri «LoginGraceTime=0». \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"