{"id":83061,"date":"2020-05-28T01:42:22","date_gmt":"2020-05-27T23:42:22","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/reliz-openssh-8-3-s-ustraneniem-uyazvimosti-v-scp"},"modified":"2020-05-28T01:42:22","modified_gmt":"2020-05-27T23:42:22","slug":"reliz-openssh-8-3-s-ustraneniem-uyazvimosti-v-scp","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/reliz-openssh-8-3-s-ustraneniem-uyazvimosti-v-scp","title":{"rendered":"Utgivning av OpenSSH 8.3 med en s\u00e5rbarhet i scp \u00e5tg\u00e4rdad","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Efter tre m\u00e5naders utveckling <noindex><a rel=\"nofollow\" href=\"https:\/\/lists.mindrot.org\/pipermail\/openssh-unix-dev\/2020-May\/038528.html\">presenteras<\/a><\/noindex> utgivning <noindex><a rel=\"nofollow\" href=\"https:\/\/www.openssh.com\/\">OpenSSH 8.3<\/a><\/noindex>, en \u00f6ppen implementation av klient och server f\u00f6r arbete med protokollen SSH 2.0 och SFTP. <\/p>\n<p>I den nya versionen har skydd mot attacker p\u00e5 scp lagts till, vilket g\u00f6r att servern kan \u00f6verf\u00f6ra andra filnamn \u00e4n de som beg\u00e4rts (till skillnad fr\u00e5n <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=49953\">den tidigare s\u00e5rbarheten<\/a><\/noindex>, attacker ger inte m\u00f6jlighet att byta katalog eller glob-m\u00f6nster som anv\u00e4ndaren valt). Vi p\u00e5minner om att i SCP fattar servern beslut om vilka filer och kataloger som ska skickas till klienten, medan klienten bara verifierar korrektheten av de returnerade objektnamnen. K\u00e4rnan i det identifierade problemet \u00e4r att om systemanropet utimes misslyckas, tolkas inneh\u00e5llet i filen som metadata f\u00f6r filen. <\/p>\n<p>Den h\u00e4r funktionen vid anslutning till en server som kontrolleras av en angripare kan anv\u00e4ndas f\u00f6r att spara filer med andra namn och annat inneh\u00e5ll i anv\u00e4ndarens filsystem vid kopiering med hj\u00e4lp av scp i konfigurationer som g\u00f6r att utimes misslyckas (till exempel n\u00e4r utimes blockeras av SELinux-policy eller filtret f\u00f6r systemanrop). Sannolikheten f\u00f6r att verkliga attacker genomf\u00f6rs bed\u00f6ms som minimal, eftersom utimes-anrop i typiska konfigurationer inte misslyckas. Dessutom g\u00e5r attacken inte obem\u00e4rkt f\u00f6rbi \u2014 vid anrop av scp visas ett felmeddelande om data\u00f6verf\u00f6ring.<\/p>\n<p>Allm\u00e4nna \u00e4ndringar:<\/p>\n<ul>\n<li class=\"l\"> I sftp har bearbetningen av argumentet \u00ab-1\u00bb upph\u00f6rt, j\u00e4mf\u00f6rt med ssh och scp, d\u00e4r det tidigare togs emot men ignorerades;\n<li class=\"l\"> I sshd, med anv\u00e4ndning av IgnoreRhosts, erbjuds nu tre alternativ: \u00abja\u00bb \u2014 ignorera rhosts\/shosts, \u00abnej\u00bb \u2014 ta h\u00e4nsyn till rhosts\/shosts och \u00abshosts-only\u00bb \u2014 till\u00e5ta \u00ab.shosts\u00bb, men f\u00f6rbjuda \u00ab.rhosts\u00bb;\n<li class=\"l\"> I ssh s\u00e4kerst\u00e4lls behandling av substitution %TOKEN i inst\u00e4llningarna f\u00f6r LocalFoward och RemoteForward, som anv\u00e4nds f\u00f6r att vidarebefordra Unix-socketar;\n<li class=\"l\"> M\u00f6jlighet att ladda \u00f6ppna nycklar fr\u00e5n en okrypterad fil med privat nyckel har till\u00e5tits, om ingen separat fil med \u00f6ppen nyckel finns;\n<li class=\"l\"> Med libcrypto i systemet, anv\u00e4nder ssh och sshd nu implementeringen av algoritmen chacha20 fr\u00e5n detta bibliotek, ist\u00e4llet f\u00f6r den inbyggda portabla implementationen som ligger efter i prestanda;\n<li class=\"l\"> Funktionen f\u00f6r dumpning av inneh\u00e5llet i den bin\u00e4ra listan \u00f6ver \u00e5terkallade certifikat har implementerats vid k\u00f6rning av kommandot \u00abssh-keygen -lQf \/path\u00bb;\n<li class=\"l\"> I den b\u00e4rbara versionen implementerades identifiering av system d\u00e4r signaler med SA_RESTART-alternativet avbryter arbetet med select;\n<li class=\"l\"> Problem med kompilering p\u00e5 HP\/UX och AIX-system har \u00e5tg\u00e4rdats;\n<li class=\"l\"> Problem med sammans\u00e4ttning av seccomp-sandbox i vissa Linux-konfigurationer har \u00e5tg\u00e4rdats;\n<li class=\"l\"> Identifieringen av biblioteket libfido2 har f\u00f6rb\u00e4ttrats och problem med byggande med alternativet \u00ab--with-security-key-builtin\u00bb har l\u00f6sts.\n<\/ul>\n<p>Utvecklarna av OpenSSH har \u00e5terigen varnat f\u00f6r den kommande \u00f6verg\u00e5ngen till f\u00f6r\u00e5ldrade algoritmer som anv\u00e4nder SHA-1-hashning p\u00e5 grund av <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=52149\">\u00f6kande<\/a><\/noindex> effektiviteten hos kollisionattacker med en given prefix (kostnaden f\u00f6r att hitta en kollision ber\u00e4knas till cirka 45 000 dollar). I en av de kommande versionerna planerar man att som standard st\u00e4nga av m\u00f6jligheten att anv\u00e4nda algoritmen f\u00f6r digitala signaturer med \u00f6ppen nyckel \u00abssh-rsa\u00bb, som n\u00e4mns i den ursprungliga RFC f\u00f6r SSH-protokollet och forts\u00e4tter vara allm\u00e4nt spridd i praktiken (f\u00f6r att kontrollera anv\u00e4ndningen av ssh-rsa i sina system kan man f\u00f6rs\u00f6ka ansluta via ssh med alternativet \u00ab-oHostKeyAlgorithms=-ssh-rsa\u00bb).<\/p>\n<p>F\u00f6r att underl\u00e4tta \u00f6verg\u00e5ngen till nya algoritmer kommer OpenSSH i en av de f\u00f6ljande utg\u00e5vorna som standard att aktivera inst\u00e4llningen UpdateHostKeys, vilket automatiskt kommer att \u00f6verf\u00f6ra kunder till mer p\u00e5litliga algoritmer. Bland de rekommenderade algoritmerna f\u00f6r migrering n\u00e4mns rsa-sha2-256\/512 baserat p\u00e5 RFC8332 RSA SHA-2 (st\u00f6ds fr\u00e5n OpenSSH 7.2 och anv\u00e4nds som standard), ssh-ed25519 (st\u00f6ds fr\u00e5n OpenSSH 6.5) och ecdsa-sha2-nistp256\/384\/521 baserat p\u00e5 RFC5656 ECDSA (st\u00f6ds fr\u00e5n OpenSSH 5.7). <\/p>\n<p>Fr\u00e5n och med den senaste versionen har \u00abssh-rsa\u00bb och \u00abdiffie-hellman-group14-sha1\u00bb tagits bort fr\u00e5n listan CASignatureAlgorithms, som definierar algoritmer som \u00e4r till\u00e5tna f\u00f6r digital signatur av nya certifikat, eftersom anv\u00e4ndningen av SHA-1 i certifikat medf\u00f6r ytterligare risk p\u00e5 grund av att en angripare har obegr\u00e4nsad tid f\u00f6r att hitta en kollision f\u00f6r ett befintligt certifikat, medan tiden f\u00f6r angrepp p\u00e5 v\u00e4rdnycklar \u00e4r begr\u00e4nsad av tidsgr\u00e4nsen f\u00f6r anslutning (LoginGraceTime). <\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>K\u00e4lla: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=53039\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u043e\u0441\u043b\u0435 \u0442\u0440\u0451\u0445 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437 OpenSSH 8.3, \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430\u043c SSH 2.0 \u0438 SFTP. \u0412 \u043d\u043e\u0432\u043e\u043c \u0432\u044b\u043f\u0443\u0441\u043a\u0435 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0430 \u0437\u0430\u0449\u0438\u0442\u0430 \u043e\u0442 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 scp, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0441\u0435\u0440\u0432\u0435\u0440\u0443 \u043f\u0435\u0440\u0435\u0434\u0430\u0442\u044c \u0434\u0440\u0443\u0433\u0438\u0435 \u0438\u043c\u0435\u043d\u0430 \u0444\u0430\u0439\u043b\u043e\u0432, \u043e\u0442\u043b\u0438\u0447\u0430\u044e\u0449\u0438\u0435\u0441\u044f \u043e\u0442 \u0437\u0430\u043f\u0440\u043e\u0448\u0435\u043d\u043d\u044b\u0445 (\u0432 \u043e\u0442\u043b\u0438\u0447\u0438\u0435 \u043e\u0442 \u043f\u0440\u043e\u0448\u043b\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0430\u0442\u0430\u043a\u0430 \u043d\u0435 \u0434\u0430\u0451\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0441\u043c\u0435\u043d\u0438\u0442\u044c \u0432\u044b\u0431\u0440\u0430\u043d\u043d\u044b\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u043a\u0430\u0442\u0430\u043b\u043e\u0433 \u0438\u043b\u0438 glob-\u043c\u0430\u0441\u043a\u0443). \u041d\u0430\u043f\u043e\u043c\u043d\u0438\u043c, [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-83061","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u043e\u0441\u043b\u0435 \u0442\u0440\u0451\u0445 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sv\/blog\/news\/reliz-openssh-8-3-s-ustraneniem-uyazvimosti-v-scp\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sv_SE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 OpenSSH 8.3 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 scp | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u043e\u0441\u043b\u0435 \u0442\u0440\u0451\u0445 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sv\/blog\/news\/reliz-openssh-8-3-s-ustraneniem-uyazvimosti-v-scp\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-05-27T23:42:22+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-05-27T23:42:22+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Utg\u00e5van av OpenSSH 8.3 med fix f\u00f6r s\u00e5rbarhet i scp | ProHoster","description":"Efter tre m\u00e5naders utveckling presenteras en utg\u00e5va","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/reliz-openssh-8-3-s-ustraneniem-uyazvimosti-v-scp","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 OpenSSH 8.3 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 scp | ProHoster","og:description":"\u041f\u043e\u0441\u043b\u0435 \u0442\u0440\u0451\u0445 \u043c\u0435\u0441\u044f\u0446\u0435\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d \u0440\u0435\u043b\u0438\u0437","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/reliz-openssh-8-3-s-ustraneniem-uyazvimosti-v-scp","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-27T23:42:22+00:00","article:modified_time":"2020-05-27T23:42:22+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"83061","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 15:25:24","updated":"2022-10-02 17:17:29","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/83061","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=83061"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/83061\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=83061"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=83061"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=83061"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}