51工具盒子

依楼听风雨
笑看云卷云舒,淡观潮起潮落

Diffie-Hellman Key Agreement Protocol 资源管理错误漏洞(CVE-2002-20001)

Diffie-Hellman Key Agreement Protocol 资源管理错误漏洞(CVE-2002-20001)

漏洞描述:

Diffie-Hellman Key Agreement Protocol是一种密钥协商协议。它最初在 Diffie 和 Hellman 关于公钥密码学的开创性论文中有所描述。该密钥协商协议允许 Alice 和 Bob 交换公钥值,并根据这些值和他们自己对应的私钥的知识,安全地计算共享密钥K,从而实现进一步的安全通信。仅知道交换的公钥值,窃听者无法计算共享密钥。Diffie-Hellman Key Agreement Protocol 存在安全漏洞,远程攻击者可以发送实际上不是公钥的任意数字,并触发服务器端DHE模幂计算。

解决方法:

echo "KexAlgorithms -diffie-hellman-group1-sha1,diffie-hellman-group1-sha256,diffie-hellman-group14-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha256,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha512" >> /etc/ssh/sshd_config

修改sshd_config文件配置

修复建议:
OpenSSH修复 https://github.com/Balasys/dheater

重启sshd服务

systectl restart sshd

再次使用漏扫设备进行扫描,查看确认是否还存在此漏洞,没有即漏洞解决成功

# 修改sshd_config文件配置
KexAlgorithms -diffie-hellman-group1-sha1,diffie-hellman-group1-sha256,diffie-hellman-group14-sha1,diffie-hellman-group14-sha256,diffie-hellman-group15-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha256,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha512 
MaxStartups 10:30:100
PerSourceMaxStartups 1
PerSourceNetBlockSize 32:128
# 重启sshd
赞(3)
未经允许不得转载:工具盒子 » Diffie-Hellman Key Agreement Protocol 资源管理错误漏洞(CVE-2002-20001)