iThome 2024.07.02 - OpenSSH含有可遠端攻陷伺服器的回歸漏洞
其中文章最後有提到:
OpenSSH團隊亦於本周一釋出了OpenSSH 9.8/9.8p1, 以修補CVE-2024-6387及另一個邏輯漏洞。該團隊亦說明,在實驗室環境下,要攻陷CVE-2024-6387需要不斷建立連結並持續6~8小時,直至達到伺服器極限,目前已於具備ASLR的32位元Linux系統上成功展現。
因此,除了修正外,也可以安裝一些阻擋 retry ssh 登入的行為,以前學生時代裝 denyhosts ,現在問 ChatGPT 得到 fail2ban 套件,在 Ubuntu 22.04 快速上手:
$ sudo apt-get update
$ sudo apt-get install fail2ban
$ sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
$ sudo systemctl restart fail2ban
建議還是要去看一下 /etc/fail2ban/jail.local 設定,像是 sshd retry 幾次會阻擋,以此評估是不是適合自己(常打錯密碼擋到自己也很無奈的)。裝完就可以用以下指令得知資訊:
$ sudo fail2ban-client status sshd
Distributor ID: Ubuntu
Description: Ubuntu 22.04.4 LTS
Release: 22.04
Codename: jammy
Status for the jail: sshd
|- Filter
| |- Currently failed: 4
| |- Total failed: 13
| `- File list: /var/log/auth.log
`- Actions
|- Currently banned: 0
|- Total banned: 0
`- Banned IP list:
不過,回到 CVE-2024-6387 資安事件,其實只要單純把 Ubuntu 系統更新,Ubuntu TLS 都給你傳便便:
Ubuntu 24.04openssh-client - 1:9.6p1-3ubuntu13.3openssh-server - 1:9.6p1-3ubuntu13.3Ubuntu 23.10openssh-client - 1:9.3p1-1ubuntu3.6openssh-server - 1:9.3p1-1ubuntu3.6Ubuntu 22.04openssh-client - 1:8.9p1-3ubuntu0.10openssh-server - 1:8.9p1-3ubuntu0.10
例如 Ubuntu 22.04 openssh 1:8.9p1-3ubuntu0.10 內容:
openssh 1:8.9p1-3ubuntu0.10 source package in UbuntuChangelogopenssh (1:8.9p1-3ubuntu0.10) jammy-security; urgency=medium* SECURITY UPDATE: remote code execution via signal handler racecondition (LP: #2070497)- debian/patches/CVE-2024-6387.patch: don't log in sshsigdie() in log.c.- CVE-2024-6387-- Marc Deslauriers <email address hidden> Wed, 26 Jun 2024 09:11:55 -0400
而自己的系統就只要查一下是否有更新至此版即可:
$ sudo apt upgrade && sudo apt upgrade && lsb_release -a && sudo apt policy openssh-server && ssh -V...Distributor ID: UbuntuDescription: Ubuntu 22.04.4 LTSRelease: 22.04Codename: jammyopenssh-server:Installed: 1:8.9p1-3ubuntu0.10Candidate: 1:8.9p1-3ubuntu0.10Version table:*** 1:8.9p1-3ubuntu0.10 500500 http://archive.ubuntu.com/ubuntu jammy-updates/main amd64 Packages500 http://security.ubuntu.com/ubuntu jammy-security/main amd64 Packages100 /var/lib/dpkg/status1:8.9p1-3 500500 http://archive.ubuntu.com/ubuntu jammy/main amd64 PackagesOpenSSH_8.9p1 Ubuntu-3ubuntu0.10, OpenSSL 3.0.2 15 Mar 2022
沒有留言:
張貼留言