{"id":102257,"date":"2021-11-09T21:36:46","date_gmt":"2021-11-09T19:36:46","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/analiz-bezopasnosti-paketa-busybox-vyyavil-14-nesushhestvennyh-uyazvimostej"},"modified":"2021-11-09T21:36:46","modified_gmt":"2021-11-09T19:36:46","slug":"analiz-bezopasnosti-paketa-busybox-vyyavil-14-nesushhestvennyh-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/analiz-bezopasnosti-paketa-busybox-vyyavil-14-nesushhestvennyh-uyazvimostej","title":{"rendered":"Anal\u00fdza bezpe\u010dnosti bal\u00ed\u010dku BusyBox odhalila 14 drobn\u00fdch zranitelnost\u00ed","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V\u00fdzkumn\u00edci ze spole\u010dnost\u00ed Claroty a JFrog zve\u0159ejnili v\u00fdsledky auditu bezpe\u010dnosti bal\u00ed\u010dku BusyBox, \u0161iroce pou\u017e\u00edvan\u00e9ho na vestav\u011bn\u00fdch za\u0159\u00edzen\u00edch, kter\u00fd nab\u00edz\u00ed sadu standardn\u00edch UNIXov\u00fdch utilit, zformovan\u00fdch jako jedin\u00fd spustiteln\u00fd soubor. B\u011bhem kontroly bylo odhaleno 14 zranitelnost\u00ed, kter\u00e9 byly ji\u017e odstran\u011bny v srpnov\u00e9m vyd\u00e1n\u00ed BusyBox 1.34. T\u00e9m\u011b\u0159 v\u0161echny probl\u00e9my jsou ne\u0161kodn\u00e9 a ot\u00e1zky jejich vyu\u017eit\u00ed v re\u00e1ln\u00fdch \u00fatoc\u00edch jsou sporn\u00e9, proto\u017ee vy\u017eaduj\u00ed spu\u0161t\u011bn\u00ed utilit s extern\u011b z\u00edskan\u00fdmi argumenty. <\/p>\n

Zvl\u00e1\u0161\u0165 je vyzdvihnuta zranitelnost CVE-2021-42374, kter\u00e1 umo\u017e\u0148uje zp\u016fsobit odm\u00edtnut\u00ed slu\u017eby p\u0159i zpracov\u00e1n\u00ed speci\u00e1ln\u011b form\u00e1tovan\u00e9ho komprimovan\u00e9ho souboru utilitou unlzma, a v p\u0159\u00edpad\u011b sestaven\u00ed s volbami CONFIG_FEATURE_SEAMLESS_LZMA tak\u00e9 jak\u00fdmikoli jin\u00fdmi komponenty BusyBox, v\u010detn\u011b tar, unzip, rpm, dpkg, lzma a man. <\/p>\n

Zranitelnosti CVE-2021-42373, CVE-2021-42375, CVE-2021-42376 a CVE-2021-42377 umo\u017e\u0148uj\u00ed zp\u016fsobit odm\u00edtnut\u00ed slu\u017eby, ale vy\u017eaduj\u00ed spu\u0161t\u011bn\u00ed utilit man, ash a hush s parametry, kter\u00e9 zad\u00e1v\u00e1 \u00fato\u010dn\u00edk. Zranitelnosti od CVE-2021-42378 po CVE-2021-42386 se t\u00fdkaj\u00ed utility awk a potenci\u00e1ln\u011b mohou v\u00e9st k spu\u0161t\u011bn\u00ed k\u00f3du, ale pro to mus\u00ed \u00fato\u010dn\u00edk dos\u00e1hnout vykon\u00e1n\u00ed v awk ur\u010dit\u00e9ho vzoru (je nutn\u00e9 spustit awk s p\u0159ed\u00e1n\u00edm dat z\u00edskan\u00fdch od \u00fato\u010dn\u00edka jako prvn\u00edho argumentu p\u0159\u00edkazov\u00e9ho \u0159\u00e1dku). <\/p>\n

D\u00e1le tak\u00e9 m\u016f\u017eeme zm\u00ednit zranitelnost (CVE-2021-43523) v knihovn\u00e1ch uclibc a uclibc-ng, kter\u00e1 je spojena s t\u00edm, \u017ee p\u0159i vol\u00e1n\u00ed funkc\u00ed gethostbyname(), getaddrinfo(), gethostbyaddr() a getnameinfo() se neprov\u00e1d\u00ed kontrola a \u00faprava dom\u00e9nov\u00e9ho jm\u00e9na vr\u00e1cen\u00e9ho DNS serverem. Nap\u0159\u00edklad, v reakci na ur\u010ditou \u017e\u00e1dost o rozli\u0161en\u00ed m\u016f\u017ee pod kontrolou \u00fato\u010dn\u00edka DNS server vr\u00e1tit hostitele ve tvaru «<script>alert(‘xss’)<\\\/script>.attacker.com», a tyto budou nepozm\u011bn\u011bn\u00e9 vr\u00e1ceny n\u011bjak\u00e9mu programu, kter\u00fd bez \u00faprav je m\u016f\u017ee zobrazit ve webov\u00e9m rozhran\u00ed. Probl\u00e9m byl vy\u0159e\u0161en ve verzi uclibc-ng 1.0.39 p\u0159id\u00e1n\u00edm k\u00f3du pro kontrolu spr\u00e1vnosti vracen\u00fdch dom\u00e9nov\u00fdch jmen<\/a>, realizovan\u00e9m podle vzoru Glibc.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 Claroty \u0438 JFrog \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u0443\u0434\u0438\u0442\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043f\u0430\u043a\u0435\u0442\u0430 BusyBox, \u0448\u0438\u0440\u043e\u043a\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0433\u043e \u0432\u043e \u0432\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 \u0438 \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u044e\u0449\u0435\u0433\u043e \u043d\u0430\u0431\u043e\u0440 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0445 \u0443\u0442\u0438\u043b\u0438\u0442 UNIX, \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u0432 \u0432\u0438\u0434\u0435 \u0435\u0434\u0438\u043d\u043e\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430. \u0412 \u0445\u043e\u0434\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 14 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0443\u0436\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0432 \u0430\u0432\u0433\u0443\u0441\u0442\u043e\u0432\u0441\u043a\u043e\u043c \u0432\u044b\u043f\u0443\u0441\u043a\u0435 BusyBox 1.34. \u041f\u043e\u0447\u0442\u0438 \u0432\u0441\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043d\u0435\u043e\u043f\u0430\u0441\u043d\u044b \u0438 \u0441\u043e\u043c\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b \u0441 \u0442\u043e\u0447\u043a\u0438 \u0437\u0440\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102257","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Anal\u00fdza bezpe\u010dnosti bal\u00ed\u010dku BusyBox odhalila 14 nev\u00fdznamn\u00fdch zranitelnost\u00ed | ProHoster","description":"V\u00fdzkumn\u00edci ze spole\u010dnost\u00ed Claroty a JFrog zve\u0159ejnili v\u00fdsledky auditu bezpe\u010dnosti bal\u00ed\u010dku BusyBox, \u0161iroce pou\u017e\u00edvan\u00e9ho na vestav\u011bn\u00fdch za\u0159\u00edzen\u00edch, kter\u00fd nab\u00edz\u00ed sadu standardn\u00edch UNIXov\u00fdch utilit, zformovan\u00fdch jako.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/analiz-bezopasnosti-paketa-busybox-vyyavil-14-nesushhestvennyh-uyazvimostej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u043d\u0430\u043b\u0438\u0437 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043f\u0430\u043a\u0435\u0442\u0430 BusyBox \u0432\u044b\u044f\u0432\u0438\u043b 14 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 Claroty \u0438 JFrog \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u0443\u0434\u0438\u0442\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043f\u0430\u043a\u0435\u0442\u0430 BusyBox, \u0448\u0438\u0440\u043e\u043a\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0433\u043e \u0432\u043e \u0432\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 \u0438 \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u044e\u0449\u0435\u0433\u043e \u043d\u0430\u0431\u043e\u0440 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0445 \u0443\u0442\u0438\u043b\u0438\u0442 UNIX, \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u0432 \u0432\u0438\u0434\u0435.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/analiz-bezopasnosti-paketa-busybox-vyyavil-14-nesushhestvennyh-uyazvimostej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-11-09T19:36:46+00:00","article:modified_time":"2021-11-09T19:36:46+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102257","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-11-09 19:37:47","updated":"2026-02-08 20:56:14","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/102257","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=102257"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/102257\/revisions"}],"predecessor-version":[{"id":158106,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/102257\/revisions\/158106"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=102257"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=102257"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=102257"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}