Versie 9.8 van OpenSSH uitgekomen. OpenSSH versleutelt het netwerkverkeer om afluisteren, het overnemen van de verbinding en andere netwerkaanvallen tegen te gaan. Daarnaast bevat het de mogelijkheid om zogenaamde veilige tunnels op te zetten en ondersteunt het verschillende authenticatiemethodes. OpenSSH is primair ontwikkeld voor OpenBSD; gebruikers van andere besturingssystemen kunnen hier terecht. In deze uitgave zijn twee beveiligingsproblemen verholpen. Meer hierover is op onze voorpagina te lezen.
SecurityThis release contains fixes for two security problems, one critical and one minor.
- Race condition in sshd
A critical vulnerability in sshd was present in Portable OpenSSH versions 8.5p1 and 9.7p1 (inclusive) that may allow arbitrary code execution with root privileges.
Successful exploitation has been demonstrated on 32-bit Linux/glibc systems with ASLR. Under lab conditions, the attack requires on average 6-8 hours of continuous connections up to the maximum the server will accept. Exploitation on 64-bit systems is believed to be possible but has not been demonstrated at this time. It's likely that these attacks will be improved upon.Exploitation on non-glibc systems is conceivable but has not been examined. Systems that lack ASLR or users of downstream Linux distributions that have modified OpenSSH to disable per-connection ASLR re-randomisation (yes - this is a thing, no - we don't understand why) may potentially have an easier path to exploitation. OpenBSD is not vulnerable.
We thank the Qualys Security Advisory Team for discovering, reporting and demonstrating exploitability of this problem, and for providing detailed feedback on additional mitigation measures.- Logic error in ssh ObscureKeystrokeTiming
In OpenSSH version 9.5 through 9.7 (inclusive), when connected to an OpenSSH server version 9.5 or later, a logic error in the ssh ObscureKeystrokeTiming feature (on by default) rendered this feature ineffective - a passive observer could still detect which network packets contained real keystrokes when the countermeasure was active because both fake and real keystroke packets were being sent unconditionally.
This bug was found by Philippos Giavridis and also independently by Jacky Wei En Kung, Daniel Hugenroth and Alastair Beresford of the University of Cambridge Computer Lab.
Worse, the unconditional sending of both fake and real keystroke packets broke another long-standing timing attack mitigation. Since OpenSSH 2.9.9 sshd(8) has sent fake keystoke echo packets for traffic received on TTYs in echo-off mode, such as when entering a password into su(8) or sudo(8). This bug rendered these fake keystroke echoes ineffective and could allow a passive observer of a SSH session to once again detect when echo was off and obtain fairly limited timing information about keystrokes in this situation (20ms granularity by default).
This additional implication of the bug was identified by Jacky Wei En Kung, Daniel Hugenroth and Alastair Beresford and we thank them for their detailed analysis. This bug does not affect connections when ObscureKeystrokeTiming was disabled or sessions where no TTY was requested.
:strip_exif()/i/2000589000.png?f=thumbmedium)
:strip_icc():strip_exif()/u/168551/crop5cc9f0696f0a5_cropped.jpeg?f=community){kind=small}
:strip_icc():strip_exif()/u/457808/crop5686a95ab9c87_cropped.jpeg?f=community){kind=small}
:strip_icc():strip_exif()/u/476420/crop5623d9ad036cf_cropped.jpeg?f=community){kind=small}
/u/217510/crop660db19c1cf7b_cropped.png?f=community){kind=small}
/u/216161/crop5daf72732a011.png?f=community){kind=small}
:strip_icc():strip_exif()/u/21673/crop65674aee06c6d_cropped.jpg?f=community){kind=small}
/u/107677/linuxmintlogo60.png?f=community){kind=small}
/u/99142/crop62758e978b3e3_cropped.png?f=community){kind=small}
/u/94596/crop643fb12fd4e6d.png?f=community){kind=small}
:strip_icc():strip_exif()/u/15793/zwelgje100.jpg?f=community){kind=small}
:strip_exif()/u/16838/usericon.gif?f=community){kind=small}