Zhvilluesit e OpenSSH publikuan nj\u00eb p\u00ebrdit\u00ebsim urgjent OpenSSH 10.6p2, n\u00eb t\u00eb cilin \u00ebsht\u00eb shtuar mbrojtja ndaj nj\u00eb dob\u00ebsie kritike (CVE nuk \u00ebsht\u00eb caktuar), e cila ka emrin kodor «SSHole» dhe lejon kalimin e autentifikimit. N\u00eb sisteme me bibliotek\u00ebn Musl, dob\u00ebsia lejon lidhjen me nj\u00eb p\u00ebrdorues p\u00ebr t\u00eb cilin nuk \u00ebsht\u00eb vendosur nj\u00eb fjal\u00ebkalim, duke futur nj\u00eb fjal\u00ebkalim t\u00eb cilin p\u00ebrmban m\u00eb shum\u00eb se 256 karaktere. Problemi prek distribucione Linux q\u00eb p\u00ebrdorin bibliotek\u00ebn standarde musl, por nuk p\u00ebrdorin PAM (Modulet e Autentifikimit t\u00eb Plugueshme), si OpenWRT, Alpine, Buildroot dhe Yocto. Rreziku \u00ebsht\u00eb ve\u00e7an\u00ebrisht i lart\u00eb sepse shpesh hyrja me fjal\u00ebkalim \u00ebsht\u00eb bllokuar p\u00ebr p\u00ebrdoruesin root, duke i dh\u00ebn\u00eb mund\u00ebsin\u00eb \u00e7do kushit t\u00eb lidhet me t\u00eb drejta administratori nga larg.<\/p>\n
Gabimi, q\u00eb shkakton dob\u00ebsin\u00eb, nuk \u00ebsht\u00eb n\u00eb kodin OpenSSH, por \u00ebsht\u00eb i shfryt\u00ebzuar p\u00ebrmes sshd. N\u00eb t\u00eb nj\u00ebjt\u00ebn koh\u00eb, p\u00ebr shkak t\u00eb seriozitetit t\u00eb problemit, n\u00eb versionin OpenSSH 10.6p2 \u00ebsht\u00eb ofruar nj\u00eb solucion p\u00ebr bllokimin e dob\u00ebsis\u00eb. Pronar\u00ebve t\u00eb sistemeve t\u00eb prekura nga problemi u rekomandohet t\u00eb mos presin p\u00ebrdit\u00ebsimet, por t\u00eb \u00e7aktivizojn\u00eb menj\u00ebher\u00eb autentifikimin me fjal\u00ebkalim p\u00ebrmes parametrave «PasswordAuthentication no» n\u00eb \/etc\/ssh\/sshd_config ose t\u00eb \u00e7aktivizojn\u00eb plot\u00ebsisht SSH. <\/p>\n
Problemi nuk shfaqet n\u00eb sistemet jasht\u00eb Linux-it dhe n\u00eb mjediset Linux q\u00eb bazohen n\u00eb glibc, si dhe n\u00eb sistemet q\u00eb p\u00ebrdorin PAM gjat\u00eb autentifikimit me fjal\u00ebkalim. Rregullimi \u00ebsht\u00eb tashm\u00eb iDisponuesh\u00ebm n\u00eb Alpine dhe OpenWRT.<\/p>\n
Dob\u00ebsia \u00ebsht\u00eb e lidhur me nd\u00ebrveprimin e pap\u00ebrshtatsh\u00ebm t\u00eb OpenSSH dhe funksionit crypt() nga musl. P\u00ebr t\u00eb mbrojtur nga p\u00ebrcaktimi i ekzistenc\u00ebs s\u00eb p\u00ebrdoruesve p\u00ebrmes analiz\u00ebs s\u00eb diferencave n\u00eb koh\u00ebn e trajtimit t\u00eb k\u00ebrkesave, q\u00eb nga viti 2016 OpenSSH, gjat\u00eb verifikimit t\u00eb llogarive pa fjal\u00ebkalim, p\u00ebrdor procedur\u00ebn standarde t\u00eb verifikimit t\u00eb fjal\u00ebkalimit: th\u00ebrret funksionin «crypt(fjal\u00ebkalimi i kaluar, kripe)» me krip\u00eb t\u00eb nj\u00eb p\u00ebrdoruesi tjet\u00ebr q\u00eb ka hash t\u00eb vlefsh\u00ebm t\u00eb fjal\u00ebkalimit, e m\u00eb pas krahason hash-in e kthyer nga funksioni crypt me vler\u00ebn nga fusha me hash-in e fjal\u00ebkalimit.<\/p>\n
Megjithat\u00eb, n\u00eb musl funksioni crypt() p\u00ebr hash SHA-512 kthen simbolin «*», n\u00ebse gjat\u00ebsia e fjal\u00ebkalimit t\u00eb kaluar tejkalon 256 byte (kjo kufizim \u00ebsht\u00eb vendosur n\u00eb vitin 2012 p\u00ebr t\u00eb mbrojtur nga sulmet DoS, pasi d\u00ebrgimi i vlerave t\u00eb m\u00ebdha krijon ngarkes\u00eb t\u00eb madhe n\u00eb CPU). I nj\u00ebjti simbol p\u00ebrdoret n\u00eb fush\u00ebn me hash-in e fjal\u00ebkalimit n\u00eb «\/etc\/shadow» p\u00ebr t\u00eb sh\u00ebnuar llogarit\u00eb p\u00ebr t\u00eb cilat autentifikimi me fjal\u00ebkalim \u00ebsht\u00eb bllokuar. <\/p>\n
Si nj\u00eb rezultat, sulmuesi q\u00eb ka mund\u00ebsin\u00eb t\u00eb lidhet me serverin SSH mund t\u00eb lidhet me \u00e7do llogari ku n\u00eb ' \/etc\/shadow' n\u00eb fush\u00ebn e fjal\u00ebkalimit \u00ebsht\u00eb vendosur simboldi '*', duke transferuar nj\u00eb varg me gjat\u00ebsi prej 257 deri n\u00eb 1024 byte. Problemi p\u00ebrfshin shum\u00eb imazhe ekzistuese Docker, t\u00eb nd\u00ebrtuara duke p\u00ebrdorur Alpine Linux, si dhe imazhet standarde Alpine p\u00ebr sistemet cloud AWS dhe Azure, n\u00eb t\u00eb cilat p\u00ebr p\u00ebrdoruesin root \u00ebsht\u00eb vendosur simboli '*' n\u00eb vend t\u00eb hash-it t\u00eb fjal\u00ebkalimit. <\/p>\n