Ettev\u00f5tete Claroty ja JFrog teadlased avaldasid BusyBoxi, laialdaselt kasutatava paketi, turvaauditi tulemused, mis pakub komplekti standardseid UNIXi utiliite \u00fches t\u00e4itmisfailis. Kontrollimise k\u00e4igus tuvastati 14 haavatavust, mis on juba parandatud BusyBoxi 1.34 augusti versioonis. Peaaegu k\u00f5ik probleemid on mittesoovitavad ja k\u00fcsitavad, kui arvestada nende kasutamist reaalses r\u00fcnnakus, kuna need n\u00f5uavad utiliitide k\u00e4ivitamist v\u00e4liste argumentidega. <\/p>\n
Eraldi v\u00e4lja tuuakse haavatavus CVE-2021-42374, mis v\u00f5imaldab teenuse katkestamist spetsiaalselt vormindatud kompressitud faili t\u00f6\u00f6tlemisel utiliidiga unlzma, ning juhul, kui on kokku pandud CONFIG_FEATURE_SEAMLESS_LZMA valikutega, ka teiste BusyBoxi komponentidega, sealhulgas tar, unzip, rpm, dpkg, lzma ja man. <\/p>\n
CVE-2021-42373, CVE-2021-42375, CVE-2021-42376 ja CVE-2021-42377 haavatavused v\u00f5ivad p\u00f5hjustada teenuse katkestamise, kuid n\u00f5uavad, et r\u00fcndaja k\u00e4ivitaks utiliidid man, ash ja hush, millega on seotud r\u00fcndaja m\u00e4\u00e4ratud parameetrid. Haavatavused, mis on nimetatud CVE-2021-42378 kuni CVE-2021-42386, m\u00f5jutavad utiliiti awk ja v\u00f5ivad potentsiaalselt viia koodi k\u00e4ivitamiseni, kuid selleks peab r\u00fcndaja saavutama awk-s teatud mustri t\u00e4itmise (awk tuleb k\u00e4ivitada, edastades esimeses argumendis k\u00e4sureal andmed, mis on saadud r\u00fcndajalt). <\/p>\n
Lisaks v\u00f5ib m\u00e4rkida haavatavuse (CVE-2021-43523) uclibc ja uclibc-ng raamatukogudes, mis on seotud sellega, et gethostbyname(), getaddrinfo(), gethostbyaddr() ja getnameinfo() funktsioonide kutsumise korral ei kontrollita ja puhastata DNS-serveri tagastatud domeeninime. N\u00e4iteks v\u00f5ib halva mainega DNS-server teatud lahendamise p\u00e4ringule vastuseks tagastada hoste nagu .attacker.com ja need tagastatakse muutumatul kujul m\u00f5nele programmile, mis ilma puhastamiseta v\u00f5ib neid kuvada oma veebiliideses. Probleem on lahendatud uclibc-ng versioonis 1.0.39, lisades koodi tagastatud tulemuste kehtivuse kontrollimiseks. domeeninimesid<\/a>, mis loodud Glibc sarnasel p\u00f5him\u00f5ttel. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 Claroty \u0438 JFrog \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u0443\u0434\u0438\u0442\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043f\u0430\u043a\u0435\u0442\u0430 BusyBox, \u0448\u0438\u0440\u043e\u043a\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0433\u043e \u0432\u043e \u0432\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 \u0438 \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u044e\u0449\u0435\u0433\u043e \u043d\u0430\u0431\u043e\u0440 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0445 \u0443\u0442\u0438\u043b\u0438\u0442 UNIX, \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u0432 \u0432\u0438\u0434\u0435 \u0435\u0434\u0438\u043d\u043e\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430. \u0412 \u0445\u043e\u0434\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 14 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0443\u0436\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0432 \u0430\u0432\u0433\u0443\u0441\u0442\u043e\u0432\u0441\u043a\u043e\u043c \u0432\u044b\u043f\u0443\u0441\u043a\u0435 BusyBox 1.34. \u041f\u043e\u0447\u0442\u0438 \u0432\u0441\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043d\u0435\u043e\u043f\u0430\u0441\u043d\u044b \u0438 \u0441\u043e\u043c\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b \u0441 \u0442\u043e\u0447\u043a\u0438 \u0437\u0440\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102257","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47BusyBoxi turbeanal\u00fc\u00fcs tuvastas 14 ebaolulist haavatavust | ProHoster","description":"Claroty ja JFrog ettev\u00f5tete uuringud avaldasid BusyBoxi turbeanal\u00fc\u00fcsi tulemused, mis on laialdaselt kasutatav sisseehitatud seadmetes ja pakub komplekti standardseid UNIX-i utiliite, mis on esitatud \u00fches t\u00e4itvas failis. Kontrollimise k\u00e4igus leiti 14 haavatavust, mis on juba k\u00f5rvaldatud BusyBox 1.34 augustikuu versioonis. Peaaegu k\u00f5ik probleemid on olemuselt mitteohtlikud ja kahtlased reaalses kasutuses.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/analiz-bezopasnosti-paketa-busybox-vyyavil-14-nesushhestvennyh-uyazvimostej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u043d\u0430\u043b\u0438\u0437 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043f\u0430\u043a\u0435\u0442\u0430 BusyBox \u0432\u044b\u044f\u0432\u0438\u043b 14 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 Claroty \u0438 JFrog \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u0443\u0434\u0438\u0442\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043f\u0430\u043a\u0435\u0442\u0430 BusyBox, \u0448\u0438\u0440\u043e\u043a\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0433\u043e \u0432\u043e \u0432\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 \u0438 \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u044e\u0449\u0435\u0433\u043e \u043d\u0430\u0431\u043e\u0440 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0445 \u0443\u0442\u0438\u043b\u0438\u0442 UNIX, \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u0432 \u0432\u0438\u0434\u0435 \u0435\u0434\u0438\u043d\u043e\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430. \u0412 \u0445\u043e\u0434\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 14 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0443\u0436\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0432 \u0430\u0432\u0433\u0443\u0441\u0442\u043e\u0432\u0441\u043a\u043e\u043c \u0432\u044b\u043f\u0443\u0441\u043a\u0435 BusyBox 1.34. \u041f\u043e\u0447\u0442\u0438 \u0432\u0441\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043d\u0435\u043e\u043f\u0430\u0441\u043d\u044b \u0438 \u0441\u043e\u043c\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b \u0441 \u0442\u043e\u0447\u043a\u0438 \u0437\u0440\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/analiz-bezopasnosti-paketa-busybox-vyyavil-14-nesushhestvennyh-uyazvimostej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-11-09T19:36:46+00:00","article:modified_time":"2021-11-09T19:36:46+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102257","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-11-09 19:37:47","updated":"2026-02-08 20:56:14","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/102257","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=102257"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/102257\/revisions"}],"predecessor-version":[{"id":158106,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/102257\/revisions\/158106"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=102257"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=102257"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=102257"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"