{"id":53577,"date":"2019-12-05T00:00:00","date_gmt":"2019-12-04T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/mnozhestvennye-uyazvimosti-v-openbsd"},"modified":"2020-02-18T14:01:30","modified_gmt":"2020-02-18T11:01:30","slug":"mnozhestvennye-uyazvimosti-v-openbsd","status":"publish","type":"post","link":"https:\/\/prohoster.info\/az\/blog\/novosti-interneta\/mnozhestvennye-uyazvimosti-v-openbsd","title":{"rendered":"OpenBSD-d\u0259 \u00e7oxsayl\u0131 z\u0259iflikl\u0259r","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Qualys Labs m\u00fct\u0259x\u0259ssisleri BSD parol yoxlama mexanizml\u0259rini (PAM-a b\u0259nz\u0259r) t\u0259tbiq ed\u0259n proqramlarla ba\u011fl\u0131 bir ne\u00e7\u0259 t\u0259hl\u00fck\u0259sizlik problemi a\u015fkarlay\u0131blar. Aldatma, \"-schallenge\" v\u0259 ya \"-schallenge:passwd\" istifad\u0259\u00e7i ad\u0131n\u0131n \u00f6t\u00fcr\u00fclm\u0259si il\u0259 edilir ki, bu da istifad\u0259\u00e7i ad\u0131 kimi deyil, se\u00e7im kimi \u015f\u0259rh edilir. Daha sonra sistem h\u0259r hans\u0131 bir parolu q\u0259bul edir. smtpd, ldapd, radiusd xidm\u0259tl\u0259ri s\u0259lahiyy\u0259tsiz daxil olma\u011fa icaz\u0259 ver\u0259r\u0259k z\u0259ifdir. sshd xidm\u0259tini exploite etm\u0259k m\u00fcmk\u00fcn deyil, \u00e7\u00fcnki sshd daha sonra \"-schallenge\" istifad\u0259\u00e7isinin \u0259slind\u0259 m\u00f6vcud olmad\u0131\u011f\u0131n\u0131 a\u015fkar edir. su proqram\u0131 \u00f6n plana \u00e7\u0131xan exploit c\u0259hdind\u0259 d\u00fc\u015f\u00fcr, \u00e7\u00fcnki o da qeyri-m\u00f6vcud istifad\u0259\u00e7inin uid-ni m\u00fc\u0259yy\u0259n etm\u0259y\u0259 \u00e7al\u0131\u015f\u0131r.<\/p>\n

H\u0259m\u00e7inin xlock, S\/Key v\u0259 Yubikey vasit\u0259sil\u0259 autentifikasiya, h\u0259m\u00e7inin \"-schallenge\" istifad\u0259\u00e7isinin g\u00f6st\u0259rilm\u0259si il\u0259 ba\u011fl\u0131 olmayan su proqram\u0131nda m\u00fcxt\u0259lif z\u0259iflikl\u0259r if\u015fa edilib. xlock-d\u0259ki z\u0259iflik adi istifad\u0259\u00e7iy\u0259 auth qrupuna icaz\u0259l\u0259rin art\u0131r\u0131lmas\u0131na imkan verir. S\/Key v\u0259 Yubikey vasit\u0259sil\u0259 autentifikasiya mexanizml\u0259rinin d\u00fczg\u00fcn i\u015fl\u0259m\u0259m\u0259si il\u0259 auth qrupundan root istifad\u0259\u00e7isin\u0259 s\u0259lahiyy\u0259tl\u0259rin art\u0131r\u0131lmas\u0131 m\u00fcmk\u00fcnd\u00fcr, lakin OpenBSD konfiqurasiyas\u0131nda bu, standart olaraq i\u015fl\u0259m\u0259diyi \u00fc\u00e7\u00fcn S\/Key v\u0259 Yubikey vasit\u0259sil\u0259 autentifikasiya deaktivdir. N\u0259hay\u0259t, su-d\u0259ki z\u0259iflik istifad\u0259\u00e7iy\u0259 a\u00e7\u0131q fayl tan\u0131y\u0131c\u0131lar\u0131n\u0131n say\u0131 kimi sistem resurslar\u0131n\u0131n limitl\u0259rini art\u0131rma\u011fa imkan verir.<\/p>\n

Hal-haz\u0131rda z\u0259iflikl\u0259r aradan qald\u0131r\u0131l\u0131b, t\u0259hl\u00fck\u0259sizlik yenil\u0259m\u0259l\u0259ri syspatch(8) vasit\u0259sil\u0259 m\u00f6vcuddur.<\/p>\n

M\u0259nb\u0259: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0421\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u0438\u0437 Qualys Labs \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c\u044e \u043e\u0431\u043c\u0430\u043d\u0443\u0442\u044c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b, \u043e\u0442\u0432\u0435\u0447\u0430\u044e\u0449\u0438\u0435 \u0437\u0430 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0435 \u0432 BSD \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u044b \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u0430\u0440\u043e\u043b\u0435\u0439 (\u0430\u043d\u0430\u043b\u043e\u0433 PAM). \u041e\u0431\u043c\u0430\u043d \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u0432 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0435 \u0438\u043c\u0435\u043d\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f «-schallenge» \u0438\u043b\u0438 «-schallenge:passwd», \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0437\u0430\u0442\u0435\u043c \u0438\u043d\u0442\u0435\u0440\u043f\u0440\u0435\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043d\u0435 \u043a\u0430\u043a \u0438\u043c\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0430 \u043a\u0430\u043a \u043e\u043f\u0446\u0438\u044f. \u041f\u043e\u0441\u043b\u0435 \u044d\u0442\u043e\u0433\u043e \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u043b\u044e\u0431\u043e\u0439 \u043f\u0430\u0440\u043e\u043b\u044c. \u0423\u044f\u0437\u0432\u0438\u043c\u044b, \u0442.\u0435. \u0440\u0430\u0437\u0440\u0435\u0448\u0430\u044e\u0442 \u0432 \u0438\u0442\u043e\u0433\u0435 \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-53577","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47OpenBSD-d\u0259 \u00e7oxsayl\u0131 z\u0259iflikl\u0259r | ProHoster","description":"Qualys Labs m\u00fct\u0259x\u0259ssisl\u0259ri BSD parol yoxlama mexanizml\u0259rini idar\u0259 ed\u0259n proqramlar\u0131 aldatmaqla ba\u011fl\u0131 bir ne\u00e7\u0259 t\u0259hl\u00fck\u0259sizlik problemi a\u015fkarlay\u0131b.","canonical_url":"https:\/\/prohoster.info\/az\/blog\/novosti-interneta\/mnozhestvennye-uyazvimosti-v-openbsd","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"az_AZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 OpenBSD | ProHoster","og:description":"\u0421\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u0438\u0437 Qualys Labs \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c\u044e \u043e\u0431\u043c\u0430\u043d\u0443\u0442\u044c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b, \u043e\u0442\u0432\u0435\u0447\u0430\u044e\u0449\u0438\u0435 \u0437\u0430 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0435 \u0432 BSD \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u044b \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u0430\u0440\u043e\u043b\u0435\u0439 (\u0430\u043d\u0430\u043b\u043e\u0433 PAM).","og:url":"https:\/\/prohoster.info\/az\/blog\/novosti-interneta\/mnozhestvennye-uyazvimosti-v-openbsd","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-04T21:00:00+00:00","article:modified_time":"2020-02-18T11:01:30+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"53577","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 07:55:22","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:22:50","updated":"2026-01-24 07:55:22","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/posts\/53577","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/comments?post=53577"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/posts\/53577\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/media?parent=53577"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/categories?post=53577"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/tags?post=53577"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}