{"id":105528,"date":"2022-11-12T15:36:44","date_gmt":"2022-11-12T13:36:44","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-xterm-privodyashhaya-k-vypolneniyu-koda-pri-obrabotke-opredelyonnyh-strok"},"modified":"2022-11-12T15:36:44","modified_gmt":"2022-11-12T13:36:44","slug":"uyazvimost-v-xterm-privodyashhaya-k-vypolneniyu-koda-pri-obrabotke-opredelyonnyh-strok","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-xterm-privodyashhaya-k-vypolneniyu-koda-pri-obrabotke-opredelyonnyh-strok","title":{"rendered":"Zranitelnost v xterm, kter\u00e1 vede k vykon\u00e1n\u00ed k\u00f3du p\u0159i zpracov\u00e1n\u00ed ur\u010dit\u00e9ho textu","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Ve emul\u00e1toru termin\u00e1lu xterm byla zji\u0161t\u011bna zranitelnost (CVE-2022-45063), kter\u00e1 umo\u017e\u0148uje vykon\u00e1n\u00ed shellov\u00fdch p\u0159\u00edkaz\u016f p\u0159i zpracov\u00e1n\u00ed ur\u010dit\u00fdch escape sekvenc\u00ed v termin\u00e1lu. K proveden\u00ed \u00fatoku sta\u010d\u00ed v z\u00e1kladn\u00edm p\u0159\u00edpad\u011b zobrazit na obrazovce obsah speci\u00e1ln\u011b form\u00e1tovan\u00e9ho souboru, nap\u0159\u00edklad pomoc\u00ed utilitky cat, nebo vlo\u017eit \u0159\u00e1dek z clipboardu. printf «\e]50;i\$(touch \/tmp\/hack-like-its-1999)\a\e]50;?\a» > cve-2022-45063 cat cve-2022-45063 <\/p>\n
Probl\u00e9m je zp\u016fsoben chybou p\u0159i zpracov\u00e1n\u00ed escape sekvence s k\u00f3dem 50, kter\u00e1 se pou\u017e\u00edv\u00e1 k nastaven\u00ed nebo z\u00edsk\u00e1n\u00ed parametr\u016f p\u00edsma. Pokud po\u017eadovan\u00e9 p\u00edsmo neexistuje, operace vrac\u00ed zadan\u00e9 v po\u017eadavku jm\u00e9no p\u00edsma. P\u0159\u00edmo vlo\u017eit ovl\u00e1dac\u00ed znaky do jm\u00e9na nelze, ale vracen\u00fd \u0159et\u011bzec m\u016f\u017ee b\u00fdt ukon\u010den sekvenc\u00ed «^G», kter\u00e1 v zsh p\u0159i aktivn\u00edm re\u017eimu editace \u0159\u00e1dk\u016f ve stylu vi vede k proveden\u00ed operace rozbalen\u00ed seznamu, co\u017e m\u016f\u017ee b\u00fdt vyu\u017eito k spu\u0161t\u011bn\u00ed p\u0159\u00edkaz\u016f bez explicitn\u00edho stisknut\u00ed kl\u00e1vesy Enter. <\/p>\n
Pro \u00fasp\u011b\u0161n\u00e9 zneu\u017eit\u00ed zranitelnosti mus\u00ed u\u017eivatel pou\u017e\u00edvat p\u0159\u00edkazovou \u0159\u00e1dku Zsh, kter\u00e1 je p\u0159evedena do re\u017eimu «vi» (vi-cmd-mode), co\u017e obvykle nen\u00ed ve v\u00fdchoz\u00edm nastaven\u00ed pou\u017e\u00edv\u00e1no v distribuc\u00edch. Probl\u00e9m se tak\u00e9 neprojev\u00ed, pokud se v xterm nastav\u00ed allowWindowOps=false nebo allowFontOps=false. Nap\u0159\u00edklad nastaven\u00ed allowFontOps=false se uplat\u0148uje v OpenBSD, Debian a RHEL, ale ve v\u00fdchoz\u00edm nastaven\u00ed se nevztahuje na Arch Linux. <\/p>\n
Podle seznamu zm\u011bn a prohl\u00e1\u0161en\u00ed v\u00fdzkumn\u00edka, kter\u00fd probl\u00e9m zjistil, byla zranitelnost odstran\u011bna ve vyd\u00e1n\u00ed xterm 375, av\u0161ak podle jin\u00fdch informac\u00ed zranitelnost nad\u00e1le p\u0159etrv\u00e1v\u00e1 ve xterm 375 z Arch Linuxu. Opravy distrubuc\u00ed lze sledovat na t\u011bchto str\u00e1nk\u00e1ch: Debian, RHEL, Fedora, SUSE, Ubuntu, Arch Linux, OpenBSD, FreeBSD, NetBSD. \n Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"