En korrigerande version av OpenSSH 9.9p2 har sl\u00e4ppts, d\u00e4r tv\u00e5 s\u00e5rbarheter som identifierats av Qualys har \u00e5tg\u00e4rdats. Ett exempel har visats p\u00e5 hur dessa s\u00e5rbarheter kan anv\u00e4ndas f\u00f6r att utf\u00f6ra en MITM-attack, vilket m\u00f6jligg\u00f6r att trafik som f\u00f6rs\u00f6ker ansluta en klient till en SSH-server kan omdirigeras till en falsk server, kringg\u00e5 kontrollen av v\u00e4rdnycklar och ge klienten en falsk k\u00e4nsla av att den \u00e4r ansluten till den \u00f6nskade servern (SSH-klienten kommer att acceptera v\u00e4rdnyckeln fr\u00e5n den falska servern ist\u00e4llet f\u00f6r nyckeln fr\u00e5n den legitima servern). <\/p>\n
Den f\u00f6rsta s\u00e5rbarheten (CVE-2025-26465) orsakas av en logisk fel i ssh-verktyget, vilket g\u00f6r det m\u00f6jligt att kringg\u00e5 serveridentifieringskontrollen och genomf\u00f6ra en MITM-attack. Problemet har funnits sedan versionen OpenSSH 6.8p1 (december 2014) i konfigurationer med inst\u00e4llningen VerifyHostKeyDNS aktiverad. I den grundl\u00e4ggande installationen av OpenSSH \u00e4r denna alternativ som standard avst\u00e4ngd, men var aktiverad i ssh-inst\u00e4llningarna i FreeBSD fram till mars 2023. <\/p>\n
Problemet \u00e4r att i koden f\u00f6r funktionen verify_host_key_callback() kontrolleras endast felkoden «-1» vid anropet av funktionen verify_host_key(), medan andra koder, som «-2», ignoreras. Resultatet blir att funktionen verify_host_key_callback() kan returnera en framg\u00e5ngskod «0», trots att funktionen verify_host_key() returnerar felkod «-2». Felkod «-2» returneras av funktionen verify_host_key() vid minnesbrist. Om f\u00f6rh\u00e5llanden skapas som g\u00f6r det om\u00f6jligt att allokera minne i funktionen verify_host_key(), kommer SSH att anse att v\u00e4rdnyckeln har verifierats framg\u00e5ngsrikt. F\u00f6r att skapa s\u00e5dana f\u00f6rh\u00e5llanden returnerar en falsk SSH-server fr\u00e5n angriparen, som klienten dirigeras till, en v\u00e4rdnyckel med maximal m\u00f6jlig storlek (256KB), samtidigt som det utnyttjas en minnesl\u00e4cka p\u00e5 ssh-klientens sida. <\/p>\n
Villkoren f\u00f6r att skapa en minnesl\u00e4cka uppn\u00e5s genom den andra s\u00e5rbarheten (CVE-2025-26466), som p\u00e5verkar b\u00e5de ssh-klienten och server<\/a> sshd, och anv\u00e4nds utan autentisering. S\u00e5rbarheten till\u00e5ter att det tillg\u00e4ngliga minnet f\u00f6r processen t\u00f6ms och skapar h\u00f6g CPU-belastning genom att skicka ett stort antal SSH2_MSG_PING-paket. I hanteraren f\u00f6r SSH2_MSG_PING-paketen finns det ett minnesl\u00e4ckage som visar sig fr\u00e5n och med versionen OpenSSH 9.5p1 (augusti 2023). L\u00e4ckaget uppst\u00e5r eftersom en 256-byte buffert tilldelas f\u00f6r varje 16-byte PING-paket f\u00f6r att skapa ett svar, men denna buffert frig\u00f6rs f\u00f6rst efter att nyckel\u00f6verenskommelsen \u00e4r slutf\u00f6rd. Som en skydds\u00e5tg\u00e4rd f\u00f6resl\u00e5s att begr\u00e4nsningar st\u00e4lls in med direktiven LoginGraceTime, MaxStartups och PerSourcePenalties. \u0414\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0439 \u0432\u044b\u043f\u0443\u0441\u043a OpenSSH 9.9p2, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Qualys. \u041f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d \u043f\u0440\u0438\u043c\u0435\u0440 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0434\u0430\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0434\u043b\u044f \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f MITM-\u0430\u0442\u0430\u043a\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043f\u0440\u0438 \u043f\u043e\u043f\u044b\u0442\u043a\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u043a SSH-\u0441\u0435\u0440\u0432\u0435\u0440\u0443, \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0442\u0440\u0430\u0444\u0438\u043a \u043d\u0430 \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0439 \u0444\u0438\u043a\u0442\u0438\u0432\u043d\u044b\u0439 \u0441\u0435\u0440\u0432\u0435\u0440, \u043e\u0431\u043e\u0439\u0442\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u0445\u043e\u0441\u0442\u043e\u0432\u044b\u0445 \u043a\u043b\u044e\u0447\u0435\u0439 \u0438 \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u0443 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0432\u0438\u0434\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a \u0436\u0435\u043b\u0430\u0435\u043c\u043e\u043c\u0443 \u0441\u0435\u0440\u0432\u0435\u0440\u0443 (ssh-\u043a\u043b\u0438\u0435\u043d\u0442 \u043f\u0440\u0438\u043c\u0435\u0442 \u0445\u043e\u0441\u0442\u043e\u0432\u044b\u0439 \u043a\u043b\u044e\u0447 \u0444\u0438\u043a\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0432\u043c\u0435\u0441\u0442\u043e \u043a\u043b\u044e\u0447\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-121998","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Uppdatering av OpenSSH 9.9p2 som \u00e5tg\u00e4rdar m\u00f6jligheten f\u00f6r MITM-attacker | ProHoster","description":"En korrigeringsversion av OpenSSH 9.9p2 \u00e4r tillg\u00e4nglig, d\u00e4r tv\u00e5 s\u00e5rbarheter som uppt\u00e4ckts av Qualys har \u00e5tg\u00e4rdats.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/obnovlenie-openssh-9-9p2-s-ustraneniem-vozmozhnosti-soversheniya-mitm-ataki","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 OpenSSH 9.9p2 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f MITM-\u0430\u0442\u0430\u043a\u0438 | ProHoster","og:description":"\u0414\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0439 \u0432\u044b\u043f\u0443\u0441\u043a OpenSSH 9.9p2, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Qualys.","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/obnovlenie-openssh-9-9p2-s-ustraneniem-vozmozhnosti-soversheniya-mitm-ataki","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-02-18T18:22:04+00:00","article:modified_time":"2025-02-18T18:22:04+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"121998","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 10:42:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 10:42:19","updated":"2026-01-23 10:42:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/121998","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=121998"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/121998\/revisions"}],"predecessor-version":[{"id":173038,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/121998\/revisions\/173038"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=121998"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=121998"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=121998"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
K\u00e4lla: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"