{"id":87197,"date":"2020-07-05T07:42:02","date_gmt":"2020-07-05T05:42:02","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-ssh-klientah-openssh-i-putty"},"modified":"2020-07-05T07:42:02","modified_gmt":"2020-07-05T05:42:02","slug":"uyazvimost-v-ssh-klientah-openssh-i-putty","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/uyazvimost-v-ssh-klientah-openssh-i-putty","title":{"rendered":"S\u00e5rbarhet i SSH-klienterna OpenSSH och PuTTY","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

I SSH-klienter som OpenSSH och PuTTY uppt\u00e4cktes<\/a><\/noindex> s\u00e5rbarhet<\/a><\/noindex> (CVE-2020-14002<\/a><\/noindex> i PuTTY och CVE-2020-14145<\/a><\/noindex> i OpenSSH), vilket leder till l\u00e4ckage av information i algoritmen f\u00f6r anslutnings\u00f6verenskommelse. S\u00e5rbarheten g\u00f6r det m\u00f6jligt f\u00f6r en angripare, som kan avlyssna kundens trafik (till exempel vid inloggning av en anv\u00e4ndare via en kontrollpunkt f\u00f6r tr\u00e5dl\u00f6s \u00e5tkomst som kontrolleras av angriparen), att identifiera den initiala anslutningsf\u00f6rs\u00f6ket fr\u00e5n klienten till v\u00e4rden, n\u00e4r klienten \u00e4nnu inte har cachat v\u00e4rdnyckeln. <\/p>\n

Genom att veta att klienten f\u00f6rs\u00f6ker ansluta f\u00f6rsta g\u00e5ngen och \u00e4nnu inte har v\u00e4rdnyckeln p\u00e5 sin sida, kan angriparen dirigera anslutningen genom sig sj\u00e4lv (MITM) och ge klienten sin v\u00e4rdnyckel, som SSH-klienten kommer att tro \u00e4r nyckeln till den avsedda v\u00e4rden, om den inte verifierar nyckelns fingerprint. P\u00e5 s\u00e5 s\u00e4tt kan angriparen genomf\u00f6ra MITM utan att v\u00e4cka misstankar hos anv\u00e4ndaren och ignorera sessioner d\u00e4r klienten redan har cachade v\u00e4rdnycklar, vars f\u00f6rfalskning skulle leda till en varning om att v\u00e4rdnyckeln har \u00e4ndrats. Attacken bygger p\u00e5 anv\u00e4ndares of\u00f6rsiktighet och bristen p\u00e5 manuell verifiering av v\u00e4rdnyckelns fingerprint vid f\u00f6rsta anslutningen. De som kontrollerar nycklarnas fingerprints \u00e4r skyddade mot s\u00e5dana attacker.<\/p>\n

Som ett tecken f\u00f6r att identifiera den f\u00f6rsta anslutningsf\u00f6rs\u00f6ket anv\u00e4nds en f\u00f6r\u00e4ndring av ordningen f\u00f6r de st\u00f6dja algoritmerna f\u00f6r v\u00e4rdnycklar. Om det \u00e4r f\u00f6rsta anslutningen skickar klienten en lista med algoritmer som standard, och om v\u00e4rdnyckeln redan finns i cachen, st\u00e4lls den relaterade algoritmen f\u00f6rst (algoritmer sorteras i ordning av preferens). <\/p>\n

Problemet visar sig i versioner av OpenSSH fr\u00e5n 5.7 till 8.3 och i PuTTY fr\u00e5n 0.68 till 0.73. Problemet har \u00e5tg\u00e4rdats<\/a><\/noindex> i utg\u00e5van PuTTY 0.74<\/a><\/noindex> genom att l\u00e4gga till ett alternativ f\u00f6r att inaktivera dynamisk konstruktion av listan med algoritmer f\u00f6r behandling av v\u00e4rdnycklar till f\u00f6rm\u00e5n f\u00f6r en konstant ordning av algoritmer.<\/p>\n

Projektet OpenSSH planerar inte att \u00e4ndra SSH-klientens beteende, eftersom om algoritmen f\u00f6r den befintliga nyckeln inte anges f\u00f6rst, kommer ett f\u00f6rs\u00f6k att g\u00f6ras att till\u00e4mpa en algoritm som inte st\u00e4mmer \u00f6verens med den cachade nyckeln, vilket ger en varning om en ok\u00e4nd nyckel. Det vill s\u00e4ga, det uppst\u00e5r ett val \u2014 antingen informationsl\u00e4cka (OpenSSH och PuTTY) eller varningar om nyckelbyte (Dropbear SSH) om den sparade nyckeln inte \u00f6verensst\u00e4mmer med den f\u00f6rsta algoritmen i standardlistan.<\/p>\n

F\u00f6r att s\u00e4kerst\u00e4lla skydd i OpenSSH rekommenderas det att anv\u00e4nda alternativa metoder f\u00f6r att verifiera v\u00e4rdnyckeln med hj\u00e4lp av SSHFP-poster i DNSSEC och v\u00e4rdcertifikat (PKI). Det g\u00e5r ocks\u00e5 att st\u00e4nga av adaptiv val av algoritmer f\u00f6r v\u00e4rdnycklar via alternativet HostKeyAlgorithms och anv\u00e4nda alternativet UpdateHostKeys f\u00f6r att f\u00e5 ytterligare v\u00e4rdnycklar efter autentisering av klienten.<\/p>\n

<\/a><\/noindex><\/p>\n

K\u00e4lla: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 SSH-\u043a\u043b\u0438\u0435\u043d\u0442\u0430\u0445 OpenSSH \u0438 PuTTY \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-14002 \u0432 PuTTY \u0438 CVE-2020-14145 \u0432 OpenSSH), \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0443\u0442\u0435\u0447\u043a\u0435 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u0439 \u0432 \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c\u0435 \u0441\u043e\u0433\u043b\u0430\u0441\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443, \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u043e\u043c\u0443 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0438\u0442\u044c \u0442\u0440\u0430\u0444\u0438\u043a \u043a\u043b\u0438\u0435\u043d\u0442\u0430 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043f\u0440\u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0447\u0435\u0440\u0435\u0437 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u0443\u044e \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u043c \u0442\u043e\u0447\u043a\u0443 \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430), \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u043f\u043e\u043f\u044b\u0442\u043a\u0443 \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u043a \u0445\u043e\u0441\u0442\u0443, \u043a\u043e\u0433\u0434\u0430 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u043c \u0435\u0449\u0451 \u043d\u0435 \u043f\u0440\u043e\u043a\u044d\u0448\u0438\u0440\u043e\u0432\u0430\u043d \u043a\u043b\u044e\u0447 \u0445\u043e\u0441\u0442\u0430. \u0417\u043d\u0430\u044f, \u0447\u0442\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-87197","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47S\u00e5rbarhet i SSH-klienter OpenSSH och PuTTY | ProHoster","description":"I SSH-klienter som OpenSSH och PuTTY","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/uyazvimost-v-ssh-klientah-openssh-i-putty","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 SSH-\u043a\u043b\u0438\u0435\u043d\u0442\u0430\u0445 OpenSSH \u0438 PuTTY | ProHoster","og:description":"\u0412 SSH-\u043a\u043b\u0438\u0435\u043d\u0442\u0430\u0445 OpenSSH \u0438 PuTTY","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/uyazvimost-v-ssh-klientah-openssh-i-putty","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-07-05T05:42:02+00:00","article:modified_time":"2020-07-05T05:42:02+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"87197","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 13:56:23","updated":"2022-10-07 22:11:57","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/87197","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=87197"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/87197\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=87197"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=87197"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=87197"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}