{"id":112583,"date":"2023-12-30T09:10:13","date_gmt":"2023-12-30T07:10:13","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-gnu-inetutils-2-5-s-ustraneniem-uyazvimosti-v-suid-prilozheniyah"},"modified":"2023-12-30T09:10:13","modified_gmt":"2023-12-30T07:10:13","slug":"vypusk-gnu-inetutils-2-5-s-ustraneniem-uyazvimosti-v-suid-prilozheniyah","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/vypusk-gnu-inetutils-2-5-s-ustraneniem-uyazvimosti-v-suid-prilozheniyah","title":{"rendered":"Release of GNU inetutils 2.5 addressing vulnerabilities in suid applications","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
After 14 months of development, the release of GNU inetutils 2.5 has been finalized, featuring a collection of network programs, most of which have been ported from BSD systems. In particular, it includes inetd and syslogd, servers and clients for ftp, telnet, rsh, rlogin, tftp, and talk, as well as common utilities like ping, ping6, traceroute, whois, hostname, dnsdomainname, ifconfig, logger, etc. <\/p>\n
The new version addresses a vulnerability (CVE-2023-40303) in the suid programs ftpd, rcp, rlogin, rsh, rshd, and uucpd, caused by the absence of checks on the return values from the setuid(), setgid(), seteuid(), and setguid() functions. This vulnerability can be exploited to create conditions where a set*id() call does not drop privileges, allowing the application to continue running with elevated privileges and perform operations intended for a non-privileged user. For example, processes such as ftpd, uucpd, and rshd, started with root privileges, would continue to use root privileges after a failed set*id() call when user sessions are initiated. <\/p>\n
In addition to fixing vulnerabilities and minor bugs in the new version, the ping6 utility now includes support for ICMPv6 messages with information about unreachable hosts (\"destination unreachable\", RFC 4443). <\/p>\n