{"id":100021,"date":"2021-04-25T10:22:49","date_gmt":"2021-04-25T08:22:49","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-git-dlya-cygwin-pozvolyayushhaya-organizovat-vypolnenie-koda"},"modified":"2021-04-25T10:22:49","modified_gmt":"2021-04-25T08:22:49","slug":"uyazvimost-v-git-dlya-cygwin-pozvolyayushhaya-organizovat-vypolnenie-koda","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimost-v-git-dlya-cygwin-pozvolyayushhaya-organizovat-vypolnenie-koda","title":{"rendered":"S\u00e5rbarhed i Git for Cygwin, der muligg\u00f8r kodeeksekvering","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Der er opdaget en kritisk s\u00e5rbarhed i Git (CVE-2021-29468), som kun viser sig, n\u00e5r der bygges til Cygwin-milj\u00f8et (en bibliotek til simulering af det grundl\u00e6ggende Linux API i Windows og et s\u00e6t typiske Linux-programmer til Windows). S\u00e5rbarheden giver mulighed for at udf\u00f8re ondsindet kode, n\u00e5r data hentes («git checkout») fra et repository, der kontrolleres af angriberen. Problemet er blevet l\u00f8st i git-pakken 2.31.1-2 til Cygwin. I det prim\u00e6re Git-projekt er problemet endnu ikke rettet (det er usandsynligt, at nogen selv kompilere git til Cygwin, fremfor at bruge en f\u00e6rdigpakke). <\/p>\n

S\u00e5rbarheden skyldes, at Cygwin behandles som et Unix-lignende system frem for Windows, hvilket medf\u00f8rer, at der ikke er nogen begr\u00e6nsninger for brugen af tegnet ‘\’ i stien, mens dette tegn i Cygwin, ligesom i Windows, kan bruges til at adskille mapper. Som et resultat kan en angriber skabe et s\u00e6rligt modificeret repository, der indeholder symboliske links og filer med en backslash, hvilket kan f\u00f8re til overskrivning af vilk\u00e5rlige filer, n\u00e5r dette repository indl\u00e6ses i Cygwin (en lignende s\u00e5rbarhed i Git til Windows blev rettet i 2019). Med muligheden for at overskrive filer kan angriberen omprogrammere hook-kald i git og dermed f\u00e5 udf\u00f8rt vilk\u00e5rlig kode i systemet.
\n
Kilde: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 Git \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-29468), \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u044e\u0449\u0430\u044f\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u0440\u0438 \u0441\u0431\u043e\u0440\u043a\u0435 \u0434\u043b\u044f \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f Cygwin (\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430 \u0434\u043b\u044f \u044d\u043c\u0443\u043b\u044f\u0446\u0438\u0438 \u0431\u0430\u0437\u043e\u0432\u043e\u0433\u043e Linux API \u0432 Windows \u0438 \u043d\u0430\u0431\u043e\u0440 \u0442\u0438\u043f\u043e\u0432\u044b\u0445 linux-\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u0434\u043b\u044f Windows). \u0423\u044f\u0432\u0437\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430 \u043f\u0440\u0438 \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 («git checkout») \u0438\u0437 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f, \u043f\u043e\u0434\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u043f\u0430\u043a\u0435\u0442\u0435 git 2.31.1-2 \u0434\u043b\u044f Cygwin. \u0412 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u043c \u043f\u0440\u043e\u0435\u043a\u0442\u0435 Git \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u043e\u043a\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-100021","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47S\u00e5rbarhed i Git for Cygwin, der muligg\u00f8r udf\u00f8relse af kode | ProHoster","description":"I Git er der opdaget en kritisk s\u00e5rbarhed (CVE-2021-29468), som kun manifesterer sig ved opbygning til Cygwin-milj\u00f8et (et bibliotek til emulering af det grundl\u00e6ggende Linux API i Windows og et s\u00e6t typiske linux-programmer til Windows).","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimost-v-git-dlya-cygwin-pozvolyayushhaya-organizovat-vypolnenie-koda","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Git \u0434\u043b\u044f Cygwin, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 | ProHoster","og:description":"\u0412 Git \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-29468), \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u044e\u0449\u0430\u044f\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u0440\u0438 \u0441\u0431\u043e\u0440\u043a\u0435 \u0434\u043b\u044f \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f Cygwin (\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430 \u0434\u043b\u044f \u044d\u043c\u0443\u043b\u044f\u0446\u0438\u0438 \u0431\u0430\u0437\u043e\u0432\u043e\u0433\u043e Linux API \u0432 Windows \u0438 \u043d\u0430\u0431\u043e\u0440 \u0442\u0438\u043f\u043e\u0432\u044b\u0445 linux-\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u0434\u043b\u044f Windows).","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimost-v-git-dlya-cygwin-pozvolyayushhaya-organizovat-vypolnenie-koda","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-04-25T08:22:49+00:00","article:modified_time":"2021-04-25T08:22:49+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"100021","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-04-25 08:48:47","updated":"2022-10-05 17:52:47","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/100021","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=100021"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/100021\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=100021"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=100021"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=100021"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}