How to mitigate CVE-2024-6387 in Kaspersky Anti Targeted Attack Platform

Issue

When deploying Kaspersky Anti Targeted Attack Platform on the Ubuntu Server 22.04.2 or 22.04.4 operating system, there is a risk that attackers will exploit the CVE-2024-6387 vulnerability (OpenSSH Remote Unauthenticated Code Execution Vulnerability (regreSSHion)) and gain remote access to the Central Node server over SSH as the superuser (root).

Solution

Change the value of the LoginGraceTime parameter in the application configuration file:

1. Sign in to the management console of the server whose settings you want to change via the SSH protocol or through the terminal.
2. Enter the administrator username and the password you have specified during the installation of the application.
3. Select Technical Support Mode and press Enter on the keyboard.
4. Select Yes and press Enter again.
5. Open the file /etc/ssh/sshd_config.
6. Search this file for the line containing the LoginGraceTime parameter and change the parameter value to 0.
   LoginGraceTime 0
   If the line is commented out, uncomment it. If the line is absent, add it.
7. Save and close the file.
8. Run the command:
   systemctl restart sshd.service