{"id":37292,"date":"2019-10-31T22:16:49","date_gmt":"2019-10-31T19:16:49","guid":{"rendered":"https:\/\/prohoster.info\/blog\/v-webmin-najden-bekdor-pozvolyayushhij-udalyonno-poluchit-dostup-s-pravami-root\/"},"modified":"2019-10-31T22:16:49","modified_gmt":"2019-10-31T19:16:49","slug":"v-webmin-najden-bekdor-pozvolyayushhij-udalyonno-poluchit-dostup-s-pravami-root","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/v-webmin-najden-bekdor-pozvolyayushhij-udalyonno-poluchit-dostup-s-pravami-root","title":{"rendered":"Der er fundet en bagd\u00f8r i Webmin, der muligg\u00f8r adgang til systemet med root-rettigheder","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

I pakken Webmin<\/a><\/noindex>, der tilbyder midler til fjernadministration af serveren, opdaget<\/a><\/noindex> backdoor (CVE-2019-15107<\/a><\/noindex>), der er opdaget i de officielle bygninger af projektet, distribueret<\/a><\/noindex> gennem Sourceforge og anbefalet<\/a><\/noindex> p\u00e5 hovedsiden. Backdoor'en var til stede i versioner fra 1.882 til 1.921 inklusiv (koden med backdoor'en manglede i git-repositoriet) og gjorde det muligt at udf\u00f8re vilk\u00e5rlige shell-kommandoer p\u00e5 systemet med root-rettigheder uden autentificering. <\/p>\n

For at udf\u00f8re angrebet kr\u00e6ves der kun, at der er en \u00e5ben netv\u00e6rksport med Webmin og aktivitet i webinterfacet for funktionen til at \u00e6ndre det for\u00e6ldede kodeord (som som standard er aktiveret i versionerne 1.890, men de \u00f8vrige versioner har det deaktiveret). Problemet er blevet l\u00f8st<\/a><\/noindex> i opdateringen<\/a><\/noindex> 1.930. Som en midlertidig foranstaltning til at blokere bagd\u00f8ren er det tilstr\u00e6kkeligt at fjerne indstillingen «passwd_mode=» fra konfigurationsfilen \/etc\/webmin\/miniserv.conf. Til testning er der forberedt prototype af exploit<\/a><\/noindex>.<\/p>\n

Problemet blev opdaget<\/a><\/noindex> i scriptet password_change.cgi, hvor funktionen kun 14,3% af webstederne i hele verden.<\/a><\/noindex> unix_crypt, som modtager det indtastede gamle kodeord fra webformularen, Baggrunden indeholder tekstur af siden og illustrationer, og dens opl\u00f8sning er lavere end maskens. Baggrunden gemmes tabsl\u00f8st for opfattelse med en opl\u00f8sning p\u00e5 100 dpi.<\/a><\/noindex> en wrapper over modulen Crypt::UnixCrypt og udg\u00f8r ingen fare, men i den leverede arkiv fra Sourceforge-websitet kaldes der kode, som direkte henvender sig til \/etc\/shadow, men g\u00f8r dette ved hj\u00e6lp af en shell-konstruktion. For at udf\u00f8re angrebet er det tilstr\u00e6kkeligt at angive tegn «|» i feltet med det gamle kodeord, og koden efter dette vil blive udf\u00f8rt med root-rettigheder p\u00e5 serveren.<\/p>\n

If\u00f8lge erkl\u00e6ringen<\/a><\/noindex> udviklerne af Webmin, hvor den skadelige kode blev indsat som resultat af en kompromittering af projektets infrastruktur. Der gives endnu ikke flere oplysninger, s\u00e5 det er uklart, om hackingen udelukkende omfattede overtagelse af kontrollen med kontoen i Sourceforge eller ogs\u00e5 involverede andre elementer i udviklings- og byggeri-infrastrukturen for Webmin. Den skadelige kode har v\u00e6ret til stede i arkiver siden marts 2018. Problemet har ogs\u00e5 ber\u00f8rt Usermin-versioner<\/a><\/noindex>. I \u00f8jeblikket er alle bootarkiver blevet rekonstrueret fra Git.<\/p>\n

<\/a><\/noindex><\/p>\n

Kilde: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043f\u0430\u043a\u0435\u0442\u0435 Webmin, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u043c \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u043c, \u0432\u044b\u044f\u0432\u043b\u0435\u043d \u0431\u044d\u043a\u0434\u043e\u0440 (CVE-2019-15107), \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0439 \u0432 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0441\u0431\u043e\u0440\u043a\u0430\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u0430, \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u043c\u044b\u0445 \u0447\u0435\u0440\u0435\u0437 Sourceforge \u0438 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u043c \u0441\u0430\u0439\u0442\u0435. \u0411\u044d\u043a\u0434\u043e\u0440 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u043e\u0432\u0430\u043b \u0432 \u0441\u0431\u043e\u0440\u043a\u0430\u0445 \u0441 1.882 \u043f\u043e 1.921 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (\u0432 git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 \u043a\u043e\u0434 \u0441 \u0431\u044d\u043a\u0434\u043e\u0440\u043e\u043c \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u043e\u0432\u0430\u043b) \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0431\u0435\u0437 \u043f\u0440\u043e\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 shell-\u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root. \u0414\u043b\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-37292","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47En backdoor fundet i Webmin, der tillader fjernadgang med root-rettigheder | ProHoster","description":"I pakken Webmin, der tilbyder midler til fjernadministration af serveren,","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/v-webmin-najden-bekdor-pozvolyayushhij-udalyonno-poluchit-dostup-s-pravami-root","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 Webmin \u043d\u0430\u0439\u0434\u0435\u043d \u0431\u044d\u043a\u0434\u043e\u0440, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root | ProHoster","og:description":"\u0412 \u043f\u0430\u043a\u0435\u0442\u0435 Webmin, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u043c \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u043c,","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/v-webmin-najden-bekdor-pozvolyayushhij-udalyonno-poluchit-dostup-s-pravami-root","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:16:49+00:00","article:modified_time":"2019-10-31T19:16:49+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37292","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 17:08:31","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:29:59","updated":"2026-01-23 17:08:31","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/37292","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=37292"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/37292\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=37292"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=37292"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=37292"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}