{"id":37095,"date":"2019-10-31T22:15:43","date_gmt":"2019-10-31T19:15:43","guid":{"rendered":"https:\/\/prohoster.info\/blog\/v-razlichnyh-realizatsiyah-protokola-http-2-vyyavleno-8-dos-uyazvimostej\/"},"modified":"2019-10-31T22:15:43","modified_gmt":"2019-10-31T19:15:43","slug":"v-razlichnyh-realizatsiyah-protokola-http-2-vyyavleno-8-dos-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/v-razlichnyh-realizatsiyah-protokola-http-2-vyyavleno-8-dos-uyazvimostej","title":{"rendered":"N\u00eb realizime t\u00eb ndryshme t\u00eb protokollit HTTP\/2 jan\u00eb identifikuar 8 dob\u00ebsi DoS.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

K\u00ebrkuesit nga kompanit\u00eb Netflix dhe Google identifikuan<\/a><\/noindex> gjet\u00ebn tet\u00eb vulnerabilitete n\u00eb implementimet e ndryshme t\u00eb protokollit HTTP\/2, t\u00eb cilat lejojn\u00eb shkaktimin e nj\u00eb ndalimi t\u00eb sh\u00ebrbimit p\u00ebrmes d\u00ebrgimit t\u00eb nj\u00eb rrjedhe t\u00eb dh\u00ebnash q\u00eb jan\u00eb formatuar n\u00eb nj\u00eb m\u00ebnyr\u00eb t\u00eb caktuar. Problemet prekin n\u00eb nj\u00eb far\u00eb mase shumic\u00ebn e server\u00ebve HTTP q\u00eb mb\u00ebshtesin HTTP\/2 dhe \u00e7ojn\u00eb n\u00eb shterimin e memories s\u00eb disponueshme p\u00ebr procesin e pun\u00ebs ose krijimin e nj\u00eb ngarkese shum\u00eb t\u00eb lart\u00eb n\u00eb CPU. Azhurnimet q\u00eb adresojn\u00eb k\u00ebto vulnerabilitete jan\u00eb tashm\u00eb t\u00eb disponueshme n\u00eb nginx 1.16.1\/1.17.3<\/a><\/noindex> dhe H2O 2.2.6<\/a><\/noindex>, por akoma t\u00eb papast\u00ebr<\/a><\/noindex> p\u00ebr Apache httpd dhe produkte t\u00eb tjera<\/a><\/noindex>.<\/p>\n

Problemet ishin pasoj\u00eb e nd\u00ebrlikimeve t\u00eb sjella n\u00eb protokollin HTTP\/2, t\u00eb lidhura me p\u00ebrdorimin e strukturave binar\u00eb, sistemit t\u00eb kufizimit t\u00eb rrjedhave t\u00eb dh\u00ebnash brenda lidhjeve, mekanizmit t\u00eb prioritizimit t\u00eb rrjedhave dhe pranis\u00eb s\u00eb mesazheve t\u00eb kontrollit t\u00eb ngjashme me ICMP q\u00eb funksionojn\u00eb n\u00eb nivelin e lidhjes HTTP\/2 (p.sh. operacionet ping, rifillimi dhe konfigurimi i rrjedh\u00ebs). Shumica e implementimeve nuk i kufizuan si\u00e7 duhet rrjedhat e mesazheve t\u00eb kontrollit, organizonin n\u00eb m\u00ebnyr\u00eb joefikase radh\u00ebn e prioriteteve gjat\u00eb p\u00ebrpunimit t\u00eb k\u00ebrkesave, ose p\u00ebrdornin implementime jo optimale t\u00eb algoritmeve t\u00eb kontrollit t\u00eb rrjedh\u00ebs.<\/p>\n

Shumica e metodave t\u00eb identifikuara t\u00eb sulmit p\u00ebrfshijn\u00eb d\u00ebrgimin e k\u00ebrkesave t\u00eb caktuara n\u00eb server q\u00eb shkaktojn\u00eb gjenerimin e nj\u00eb numri t\u00eb madh p\u00ebrgjigjesh. N\u00ebse klienti nuk lexon t\u00eb dh\u00ebnat nga soketi dhe nuk nd\u00ebrpret lidhjen, radh\u00eb e tamponit t\u00eb p\u00ebrgjigjeve n\u00eb an\u00ebn e serverit vazhdimisht mbush\u00ebt. Nj\u00eb sjellje e till\u00eb krijon ngarkes\u00eb n\u00eb sistemin e menaxhimit t\u00eb radh\u00ebve p\u00ebr p\u00ebrpunimin e lidhjeve rrjet dhe n\u00eb var\u00ebsi t\u00eb ve\u00e7orive t\u00eb implementimit, \u00e7on n\u00eb shterimin e memories ose burimeve t\u00eb CPU-s\u00eb.<\/p>\n

Vulnerabilitetet e identifikuara:<\/p>\n