{"id":37095,"date":"2019-10-31T22:15:43","date_gmt":"2019-10-31T19:15:43","guid":{"rendered":"https:\/\/prohoster.info\/blog\/v-razlichnyh-realizatsiyah-protokola-http-2-vyyavleno-8-dos-uyazvimostej\/"},"modified":"2019-10-31T22:15:43","modified_gmt":"2019-10-31T19:15:43","slug":"v-razlichnyh-realizatsiyah-protokola-http-2-vyyavleno-8-dos-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/v-razlichnyh-realizatsiyah-protokola-http-2-vyyavleno-8-dos-uyazvimostej","title":{"rendered":"N\u00eb implementime t\u00eb ndryshme t\u00eb protokollit HTTP\/2 jan\u00eb zbuluar 8 dob\u00ebsi DoS","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

K\u00ebrkuesit nga kompanit\u00eb Netflix dhe Google identifikuan<\/a><\/noindex> zbuluan tet\u00eb dob\u00ebsi n\u00eb realizime t\u00eb ndryshme t\u00eb protokollit HTTP\/2, t\u00eb cilat mund t\u00eb shkaktojn\u00eb nj\u00eb ndalim sh\u00ebrbimi duke d\u00ebrguar nj\u00eb rrjedh\u00eb t\u00eb formatuar n\u00eb nj\u00eb m\u00ebnyr\u00eb t\u00eb caktuar t\u00eb k\u00ebrkesave rrjet. Problemet ndodhin n\u00eb nj\u00eb ose tjet\u00ebr mas\u00eb n\u00eb shumic\u00ebn e server\u00ebve HTTP q\u00eb mb\u00ebshtesin HTTP\/2 dhe shkaktojn\u00eb shfryt\u00ebzimin e memories s\u00eb disponueshme p\u00ebr procesin ose krijimin e nj\u00eb ngarkese shum\u00eb t\u00eb lart\u00eb n\u00eb CPU. P\u00ebrdit\u00ebsimet p\u00ebr adresimin e dob\u00ebsive jan\u00eb tashm\u00eb t\u00eb disponueshme n\u00eb nginx 1.16.1\/1.17.3<\/a><\/noindex> dhe H2O 2.2.6<\/a><\/noindex>, por p\u00ebr momentin nuk jan\u00eb t\u00eb disponueshme<\/a><\/noindex> p\u00ebr Apache httpd dhe produkte t\u00eb tjera<\/a><\/noindex>.<\/p>\n

Problemet lindeshin nga ndryshimet e b\u00ebra n\u00eb protokollin HTTP\/2, t\u00eb lidhura me p\u00ebrdorimin e strukturave binar dhe sistemit t\u00eb kufizimit t\u00eb rrjedhave t\u00eb dh\u00ebnash brenda lidhjeve, mekanizmave t\u00eb prioritizimit t\u00eb rrjedhave dhe pranishm\u00ebris\u00eb s\u00eb mesazheve kontrolluese t\u00eb ngjashme me ICMP q\u00eb veprojn\u00eb n\u00eb nivelin e lidhjes HTTP\/2 (p.sh., operacionet ping, reset dhe konfigurimin e rrjedhave). Shum\u00eb implementime nuk kufizuan si\u00e7 duhet rrjedh\u00ebn e mesazheve kontrolluese, organizuar n\u00eb m\u00ebnyr\u00eb joefikase radh\u00ebn prioritet n\u00eb trajtimin e k\u00ebrkesave ose p\u00ebrdor\u00ebn implementime jo optimale t\u00eb algoritmeve t\u00eb menaxhimit t\u00eb rrjedh\u00ebs.<\/p>\n

Shumica e metodave t\u00eb identifikuara t\u00eb sulmit lidhen me d\u00ebrgimin e k\u00ebrkesave t\u00eb caktuara n\u00eb server, q\u00eb \u00e7ojn\u00eb n\u00eb gjenerimin e nj\u00eb numri t\u00eb madh p\u00ebrgjigjesh. N\u00ebse klienti nuk lexon t\u00eb dh\u00ebnat nga soketi dhe nuk ndahet nga lidhja, radh\u00ebt e buferit t\u00eb p\u00ebrgjigjeve n\u00eb an\u00ebn e serverit vazhdojn\u00eb t\u00eb mbushen. Ky lloj sjelljeje krijon ngarkes\u00eb n\u00eb sistemin e menaxhimit t\u00eb radh\u00ebve t\u00eb trajtimit t\u00eb lidhjeve rrjet dhe, n\u00eb var\u00ebsi t\u00eb ve\u00e7orive t\u00eb implementimit, \u00e7on n\u00eb shpenzimin e memories s\u00eb disponueshme ose burimeve t\u00eb CPU.<\/p>\n

Vulnerabilitetet e identifikuara:<\/p>\n