Nj\u00eb rishikim korrektiv i OpenSSH 9.9p2 \u00ebsht\u00eb n\u00eb dispozicion, i cili adreson dy vulnerabilitete t\u00eb identifikuara nga kompania Qualys. Nj\u00eb shembull i p\u00ebrdorimit t\u00eb k\u00ebtyre vulnerabiliteteve p\u00ebr t\u00eb kryer nj\u00eb sulm MITM \u00ebsht\u00eb demonstruar, i cili lejon q\u00eb, kur nj\u00eb klient p\u00ebrpiqet t\u00eb lidhet me nj\u00eb server SSH, trafiku t\u00eb redirektohet n\u00eb nj\u00eb server fals, duke anashkaluar verifikimin e \u00e7el\u00ebsave t\u00eb hostit dhe duke krijuar p\u00ebr klientin iluzionin e lidhjes me serverin e d\u00ebshiruar (klienti SSH do t\u00eb pranoj\u00eb \u00e7el\u00ebsin e hostit t\u00eb serverit fals n\u00eb vend t\u00eb \u00e7el\u00ebsit t\u00eb serverit legjitim). <\/p>\n
Vulnerabiliteti i par\u00eb (CVE-2025-26465) shkaktohet nga nj\u00eb gabim logjik n\u00eb utilitarin ssh, i cili lejon anashkalimin e verifikimit t\u00eb identifikimit t\u00eb serverit dhe kryerjen e nj\u00eb sulmi MITM. Problemi duket q\u00eb nga versioni OpenSSH 6.8p1 (dhjetor 2014) n\u00eb konfigurimet me cil\u00ebsimin VerifyHostKeyDNS t\u00eb aktivizuar. N\u00eb paketimin baz\u00eb t\u00eb OpenSSH, kjo opsion \u00ebsht\u00eb \u00e7 aktivizuar si parazgjedhje, por ishte aktivizuar n\u00eb cil\u00ebsimet e ssh n\u00eb FreeBSD deri n\u00eb mars 2023. <\/p>\n
The essence of the problem is that in the function verify_host_key_callback(), when calling the function verify_host_key(), it only checks for the error code «-1», while other codes, such as «-2», are ignored. As a result, the function verify_host_key_callback() can return a successful code «0», despite the error «-2» returned by the function verify_host_key(). The error code «-2» is returned by the function verify_host_key() when there is insufficient memory. If conditions are created that make it impossible to allocate memory in the function verify_host_key(), SSH will consider that the host key was successfully verified. To create such conditions, a spoofed SSH server of the attacker, to which the client is redirected, returns the host key of the maximum possible size (256KB) while simultaneously exploiting a memory leak on the ssh-client side. <\/p>\n
Kushtet p\u00ebr krijimin e daljes s\u00eb memories arrihen nga vulnerabiliteti i dyt\u00eb (CVE-2025-26466), i cili prek si klientin ssh ashtu edhe server<\/a> sshd, dhe shfryt\u00ebzohet pa autentifikim. Vulnerabiliteti lejon shterjen e memories s\u00eb procesit dhe krijimin e nj\u00eb ngarkese t\u00eb lart\u00eb n\u00eb CPU p\u00ebrmes d\u00ebrgimit t\u00eb numrit t\u00eb madh t\u00eb paketimeve SSH2_MSG_PING. N\u00eb menaxherin e paketimeve SSH2_MSG_PING ka nj\u00eb rrjedhje memorje q\u00eb shfaqet q\u00eb nga l\u00ebshimi i OpenSSH 9.5p1 (gusht 2023). Rrjedhja ndodh p\u00ebr shkak se p\u00ebr \u00e7do paket\u00eb PING 16-bytes q\u00eb pranohet, alokohet nj\u00eb buffer 256-bytes p\u00ebr formimin e p\u00ebrgjigjes, por ky buffer \u00e7lirohet vet\u00ebm pas p\u00ebrfundimit t\u00eb negociat\u00ebs p\u00ebr \u00e7el\u00ebsin. Si nj\u00eb m\u00ebnyr\u00eb mbrojt\u00ebse, rekomandohet t\u00eb konfigurohen kufizime duke p\u00ebrdorur direktivat LoginGraceTime, MaxStartups dhe PerSourcePenalties. \u0414\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0439 \u0432\u044b\u043f\u0443\u0441\u043a OpenSSH 9.9p2, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Qualys. \u041f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d \u043f\u0440\u0438\u043c\u0435\u0440 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0434\u0430\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0434\u043b\u044f \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f MITM-\u0430\u0442\u0430\u043a\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043f\u0440\u0438 \u043f\u043e\u043f\u044b\u0442\u043a\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u043a SSH-\u0441\u0435\u0440\u0432\u0435\u0440\u0443, \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0442\u0440\u0430\u0444\u0438\u043a \u043d\u0430 \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0439 \u0444\u0438\u043a\u0442\u0438\u0432\u043d\u044b\u0439 \u0441\u0435\u0440\u0432\u0435\u0440, \u043e\u0431\u043e\u0439\u0442\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u0445\u043e\u0441\u0442\u043e\u0432\u044b\u0445 \u043a\u043b\u044e\u0447\u0435\u0439 \u0438 \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u0443 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0432\u0438\u0434\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a \u0436\u0435\u043b\u0430\u0435\u043c\u043e\u043c\u0443 \u0441\u0435\u0440\u0432\u0435\u0440\u0443 (ssh-\u043a\u043b\u0438\u0435\u043d\u0442 \u043f\u0440\u0438\u043c\u0435\u0442 \u0445\u043e\u0441\u0442\u043e\u0432\u044b\u0439 \u043a\u043b\u044e\u0447 \u0444\u0438\u043a\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0432\u043c\u0435\u0441\u0442\u043e \u043a\u043b\u044e\u0447\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-121998","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47P\u00ebrdit\u00ebsimi OpenSSH 9.9p2 me eliminimin e mund\u00ebsis\u00eb p\u00ebr t\u00eb kryer nj\u00eb sulm MITM | ProHoster","description":"Dhe dispozita e nj\u00eb versioni korrektiv OpenSSH 9.9p2, n\u00eb t\u00eb cilin jan\u00eb eliminuar dy vulnerabilitete t\u00eb identifikuara nga kompania Qualys.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/obnovlenie-openssh-9-9p2-s-ustraneniem-vozmozhnosti-soversheniya-mitm-ataki","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 OpenSSH 9.9p2 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f MITM-\u0430\u0442\u0430\u043a\u0438 | ProHoster","og:description":"\u0414\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0439 \u0432\u044b\u043f\u0443\u0441\u043a OpenSSH 9.9p2, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Qualys.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/obnovlenie-openssh-9-9p2-s-ustraneniem-vozmozhnosti-soversheniya-mitm-ataki","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-02-18T18:22:04+00:00","article:modified_time":"2025-02-18T18:22:04+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"121998","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 10:42:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 10:42:19","updated":"2026-01-23 10:42:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/121998","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=121998"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/121998\/revisions"}],"predecessor-version":[{"id":173038,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/121998\/revisions\/173038"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=121998"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=121998"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=121998"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"