15 个被黑客利用来数百万次入侵 Linux 系统的顶级漏洞
安全 漏洞
![](/data/attachment/album/202108/29/225711zvygqg7olognh8ga.jpg)


有将近 1400 万基于 Linux 的系统直接暴露在互联网上，这使得它们成为有利可图的现实世界攻击目标，这些攻击可能会导致它们被部署恶意的 Webshell、加密货币矿工、勒索软件和其他木马。


网络安全公司 [趋势科技](https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/linux-threat-report-2021-1h-linux-threats-in-the-cloud-and-security-recommendations) 发布了一份对 Linux 威胁形势的深入研究，其根据从蜜罐、传感器和匿名遥测中收集的数据，详细介绍了 2021 年上半年影响 Linux 操作系统的首要威胁和漏洞。


该公司检测到近 1500 万个针对基于 Linux 的云环境的恶意软件事件，发现加密货币矿工和勒索软件占所有恶意软件的 54%，Webshell 占 29%。


 


![](/data/attachment/album/202108/29/225723flbwv7t22rtc7e2r.jpg)


 


此外，通过剖析同一时期 10 万台 Linux 主机报告的 5000 多万例事件，研究人员发现了 15 个顶级安全缺陷，这些缺陷已经在野外被广泛利用或有了概念证明（PoC）：


* [CVE-2017-5638](https://nvd.nist.gov/vuln/detail/CVE-2017-5638)（CVSS 评分：10.0） - Apache Struts 2 远程代码执行（RCE）漏洞
* [CVE-2017-9805](https://nvd.nist.gov/vuln/detail/CVE-2017-9805)（CVSS 评分：8.1） - Apache Struts 2 REST 插件 XStream RCE 漏洞
* [CVE-2018-7600](https://nvd.nist.gov/vuln/detail/CVE-2018-7600)（CVSS 评分：9.8） - Drupal Core RCE 漏洞
* [CVE-2020-14750](https://nvd.nist.gov/vuln/detail/CVE-2020-14750)（CVSS 评分：9.8） - Oracle WebLogic Server RCE 漏洞
* [CVE-2020-25213](https://nvd.nist.gov/vuln/detail/CVE-2020-25213)（CVSS 评分：10.0） - WordPress 文件管理器（wp-file-manager）插件 RCE 漏洞
* [CVE-2020-17496](https://nvd.nist.gov/vuln/detail/CVE-2020-17496)（CVSS score: 9.8） - vBulletin subwidgetConfig 未认证 RCE 漏洞
* [CVE-2020-11651](https://nvd.nist.gov/vuln/detail/CVE-2020-11651)（CVSS 评分: 9.8） - SaltStack Salt 授权弱点漏洞
* [CVE-2017-12611](https://nvd.nist.gov/vuln/detail/CVE-2017-12611)（CVSS 评分: 9.8） - Apache Struts OGNL 表达式 RCE 漏洞
* [CVE-2017-7657](https://nvd.nist.gov/vuln/detail/CVE-2017-7657)（CVSS score: 9.8） - Eclipse Jetty 块长度解析的整数溢出漏洞
* [CVE-2021-29441](https://nvd.nist.gov/vuln/detail/CVE-2021-29441)（CVSS 评分：9.8） - 阿里巴巴 Nacos AuthFilter 认证绕过漏洞
* [CVE-2020-14179](https://nvd.nist.gov/vuln/detail/CVE-2020-14179)（CVSS 评分：5.3） - Atlassian Jira 信息泄露漏洞
* [CVE-2013-4547](https://nvd.nist.gov/vuln/detail/CVE-2013-4547)（CVSS 评分：8.0） - Nginx 制作的 URI 字符串处理访问限制绕过漏洞
* [CVE-2019-0230](https://nvd.nist.gov/vuln/detail/CVE-2019-0230)（CVSS 评分：9.8） - Apache Struts 2 RCE 漏洞
* [CVE-2018-11776](https://nvd.nist.gov/vuln/detail/CVE-2018-11776)（CVSS 评分：8.1） - Apache Struts OGNL 表达式RCE 漏洞
* [CVE-2020-7961](https://nvd.nist.gov/vuln/detail/CVE-2020-7961)（CVSS 评分：9.8） - Liferay Portal 不受信任的反序列化漏洞


 


![](/data/attachment/album/202108/29/225723mw7fdpssftszptsi.jpg)


 


更令人不安的是，官方 Docker Hub 资源库中最常用的 15 个 Docker 镜像被发现存在数百个漏洞，这涉及 python、node、wordpress、golang、nginx、postgres、influxdb、httpd、mysql、debian、memcached、redis、mongo、centos 和 rabbitmq。这表明需要在开发管道的每个阶段[保护容器](https://www.trendmicro.com/vinfo/us/security/news/security-technology/container-security-examining-potential-threats-to-the-container-environment)免受广泛的潜在威胁。


研究人员总结说：“用户和组织应始终应用安全最佳实践，其中包括利用安全设计方法，部署多层虚拟补丁或漏洞屏蔽，采用最小特权原则，并坚持共同责任模式。”




---


via: <https://thehackernews.com/2021/08/top-15-vulnerabilities-attackers.html> 


作者：[Ravie Lakshmanan](https://thehackernews.com/p/authors.html) 选题：[wxy](https://github.com/wxy) 译者：[wxy](https://github.com/wxy) 校对：[wxy](https://github.com/wxy)


本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](/article-13730-1.html) 荣誉推出


OK
Close to 14 million Linux-based systems are directly exposed to the Internet, making them a lucrative target for an array of real-world attacks that could result in the deployment of malicious web shells, coin miners, ransomware, and other trojans.

That's according to an in-depth look at the Linux threat landscape published by U.S.-Japanese cybersecurity firm [Trend Micro](https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/linux-threat-report-2021-1h-linux-threats-in-the-cloud-and-security-recommendations), detailing the top threats and vulnerabilities affecting the operating system in the first half of 2021, based on data amassed from honeypots, sensors, and anonymized telemetry.

The company, which detected nearly 15 million malware events aimed at Linux-based cloud environments, found coin miners and ransomware to make up 54% of all malware, with web shells accounting for a 29% share.

In addition, by dissecting over 50 million events reported from 100,000 unique Linux hosts during the same time period, the researchers found 15 different security weaknesses that are known to be actively exploited in the wild or have a proof of concept (PoC) —

(CVSS score: 10.0) - Apache Struts 2 remote code execution (RCE) vulnerability**CVE-2017-5638**(CVSS score: 8.1) - Apache Struts 2 REST plugin XStream RCE vulnerability**CVE-2017-9805**(CVSS score: 9.8) - Drupal Core RCE vulnerability**CVE-2018-7600**(CVSS score: 9.8) - Oracle WebLogic Server RCE vulnerability**CVE-2020-14750**(CVSS score: 10.0) - WordPress File Manager (wp-file-manager) plugin RCE vulnerability**CVE-2020-25213**(CVSS score: 9.8) - vBulletin 'subwidgetConfig' unauthenticated RCE vulnerability**CVE-2020-17496**(CVSS score: 9.8) - SaltStack Salt authorization weakness vulnerability**CVE-2020-11651**(CVSS score: 9.8) - Apache Struts OGNL expression RCE vulnerability**CVE-2017-12611**(CVSS score: 9.8) - Eclipse Jetty chunk length parsing integer overflow vulnerability**CVE-2017-7657**(CVSS score: 9.8) - Alibaba Nacos AuthFilter authentication bypass vulnerability**CVE-2021-29441**(CVSS score: 5.3) - Atlassian Jira information disclosure vulnerability**CVE-2020-14179**(CVSS score: 8.0) - Nginx crafted URI string handling access restriction bypass vulnerability**CVE-2013-4547**(CVSS score: 9.8) - Apache Struts 2 RCE vulnerability**CVE-2019-0230**(CVSS score: 8.1) - Apache Struts OGNL expression RCE vulnerability**CVE-2018-11776**(CVSS score: 9.8) - Liferay Portal untrusted deserialization vulnerability**CVE-2020-7961**

Even more troublingly, the 15 most commonly used Docker images on the official Docker Hub repository has been revealed to harbor hundreds of vulnerabilities spanning across python, node, wordpress, golang, nginx, postgres, influxdb, httpd, mysql, debian, memcached, redis, mongo, centos, and rabbitmq, underscoring the need to [secure containers](https://www.trendmicro.com/vinfo/us/security/news/security-technology/container-security-examining-potential-threats-to-the-container-environment) from a wide range of potential threats at each stage of the development pipeline.

"Users and organizations should always apply security best practices, which include utilizing the security by design approach, deploying multilayered virtual patching or vulnerability shielding, employing the principle of least privilege, and adhering to the shared responsibility model," the researchers concluded.