{"id":102953,"date":"2022-01-13T15:37:33","date_gmt":"2022-01-13T13:37:33","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/%d1%83%d1%8f%d0%b7%d0%b2%d0%b8%d0%bc%d0%be%d1%81%d1%82%d0%b8-%d0%b2-systemd-flatpak-samba-freerdp-clamav-node-js"},"modified":"2022-01-13T15:37:33","modified_gmt":"2022-01-13T13:37:33","slug":"uyazvimosti-v-systemd-flatpak-samba-freerdp-clamav-node-js","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-v-systemd-flatpak-samba-freerdp-clamav-node-js","title":{"rendered":"\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432  systemd, Flatpak, Samba, FreeRDP, Clamav, Node.js","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Systemd-tmpfiles, which is part of systemd, has a vulnerability (CVE-2021-3997) that can lead to unbounded recursion. This issue can be exploited to create a denial of service during system boot by creating a large number of nested subdirectories in the \/tmp directory. A patch is currently available. Package updates to address the issue have been proposed in Ubuntu and SUSE but are not yet available in Debian, RHEL, and Fedora (fixes are in testing).     <\/p>\n<p>Tuhande kaustade loomisel p\u00f5hjustab k\u00e4su &#171;systemd-tmpfiles &#8212;remove&#187; teostamine operatiivm\u00e4lu \u00fcletust, mis viib kokkuvarisemiseni. Tavaliselt teostab utiliit systemd-tmpfiles \u00fches kutses kaustade loomise ja kustutamise toiminguid (&#171;systemd-tmpfiles &#8212;create &#8212;remove &#8212;boot &#8212;exclude-prefix=\\dev&#187;), alustades kustutamisega ja seej\u00e4rel loomisega. Seega toob kustutamise etapis tekkiv bug t\u00f5en\u00e4oliselt kaasa selle, et ei loodud t\u00f6\u00f6ks vajalikke faile, mis on toodud failis \/usr\/lib\/tmpfiles.d\/*.conf.      <\/p>\n<p>A more critical attack scenario is also mentioned for Ubuntu 21.04: since the crash of systemd-tmpfiles prevents the creation of the \/run\/lock\/subsys file, and the \/run\/lock directory is writable by all users, an attacker could create a \/run\/lock\/subsys directory under their own ID. By creating symbolic links that overlap with lock files from system processes, they could orchestrate a rewrite of system files.     <\/p>\n<p>Additionally, new releases of the Flatpak, Samba, FreeRDP, Clamav, and Node.js projects have been published, addressing vulnerabilities:    <\/p>\n<ul>\n<li class=\"l\"> Isemajandavate Flatpak pakettide koostamise t\u00f6\u00f6riista versiooni 1.10.6 ja 1.12.3 parandustes on k\u00f5rvaldatud kaks haavatavust: Esimene haavatavus (CVE-2021-43860) v\u00f5imaldab laadida paketti kontrollimata allikast, manipuleerides metainformatsiooniga, varjates paigaldamise k\u00e4igus teatud laiendatud \u00f5iguste kuvamist. Teine haavatavus (ilma CVE-ta) v\u00f5imaldab paketide koostamisel k\u00e4suga &#171;flatpak-builder &#8212;mirror-screenshots-url&#187; luua kaustu faili s\u00fcsteemis tervest koostamiskaustast v\u00e4ljaspool.\n<li class=\"l\">The update of Samba 4.13.16 fixes a vulnerability (CVE-2021-43566) that allows a client to manipulate symbolic links on SMB1 or NFS shares to create instances on <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/et\/server\/dts-newyork\/\"   title=\"serveris\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"2695\">serveris<\/a> katalooge v\u00e4ljaspool eksportimiseks etten\u00e4htud FS ala (probleemi p\u00f5hjustab v\u00f5istus ja see on praktikas keeruline, kuid teoreetiliselt v\u00f5imalik). Probleem m\u00f5jutab versioone kuni 4.13.16.\n<p>Samuti on avaldatud aruanne veel \u00fche sarnase haavatavuse (CVE-2021-20316) kohta, mis v\u00f5imaldab autentitud kliendil manipuleerida s\u00fcmboolsete linkidega ning lugeda v\u00f5i muuta faili v\u00f5i katalooge metainfot FS alal. <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/et\/server\/dts-los-angeles\/\"   title=\"serverilt\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"3788\">serverilt<\/a> v\u00e4ljaspool eksportitavat osa. Probleem on lahendatud versioonis 4.15.0, kuid see m\u00f5jutab ka vanemaid harusid. Samas ei avaldata vanadele harudele parandusi, kuna vana Samba VFS arhitektuur ei v\u00f5imalda probleemi lahendada metaandmete toimingute sidumise t\u00f5ttu failiteedele (Samba 4.15-s on VFS kiht t\u00e4ielikult \u00fcmber kujundatud). Probleemi ohtu v\u00e4hendab see, et see on piisavalt keeruline rakendada ja kasutaja ligip\u00e4\u00e4su \u00f5igused peavad lubama lugemist v\u00f5i kirjutamist sihtfaili v\u00f5i katalooge.      <\/p>\n<li class=\"l\"> FreeRDP projekti versioonis 2.5, mis pakub avatud RDP (Remote Desktop Protocol) protokolli teostust, on k\u00f5rvaldatud kolm turvaprobleemi (CVE identifikaatoreid ei ole m\u00e4\u00e4ratud), mis v\u00f5ivad p\u00f5hjustada puhvrik\u00fcllust, kui kasutatakse vale keelevalikut, struktuuriga registriparameetrite t\u00f6\u00f6tlemist ja vale nime lisamiste m\u00e4\u00e4ramist. Uues versioonis on m\u00e4rgitud OpenSSL 3.0 toe sisseviimine, TcpConnectTimeout seadmise rakendamine, parem \u00fchilduvus LibreSSL-iga ning probleemide lahendamine l\u00f5ike vahel Waylandi p\u00f5histes keskkondades.\n<li class=\"l\"> Uutes vabade viiruset\u00f5rje tarkvarapaki versioonides ClamAV 0.103.5 ja 0.104.2 on k\u00f5rvaldatud haavatavus CVE-2022-20698, mis on seotud vale p\u00f6\u00f6rdumise lugemisega ja v\u00f5imaldab kaugjuhtimise teel protsessi kokkuvarisemise, kui pakett on kompileeritud koos raamatukoguga libjson-c ja seadetes on aktiveeritud valik CL_SCAN_GENERAL_COLLECT_METADATA (clamscan &#8212;gen-json).\n<li class=\"l\"> Node.js versioonides 16.13.2, 14.18.3, 17.3.1 ja 12.22.9 on parandatud neli haavatavust: sertifikaadi kontrollimise \u00fcmbers\u00f5it v\u00f5rgu\u00fchenduse kinnitamisel vale SAN (Subject Alternative Names) stringiks muutmise t\u00f5ttu (CVE-2021-44532); mitme v\u00e4\u00e4rtuse haldamise vale t\u00f6\u00f6tlemine subject ja issuer v\u00e4ljade puhul, mida saab kasutada nende kontrollimise \u00fcmbers\u00f5itmiseks sertifikaatides (CVE-2021-44533); SAN-t\u00fc\u00fcpi URI piirangute \u00fcmbers\u00f5it sertifikaatides (CVE-2021-44531); sisendi kontrollimise ebapiisavus funktsioonis console.table(), mis v\u00f5ib v\u00f5imaldada t\u00fchjade stringide m\u00e4\u00e4ramist numbrilistele v\u00f5tmetele (CVE-2022-21824).          <\/ul>\n<p>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=56498\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412\u043e \u0432\u0445\u043e\u0434\u044f\u0449\u0435\u0439 \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 systemd \u0443\u0442\u0438\u043b\u0438\u0442\u0435 systemd-tmpfiles \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-3997), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043d\u0435\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u0443\u044e \u0440\u0435\u043a\u0443\u0440\u0441\u0438\u044e. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043e\u0442\u043a\u0430\u0437\u0430 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438 \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0447\u0435\u0440\u0435\u0437 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 \/tmp \u0431\u043e\u043b\u044c\u0448\u043e\u0433\u043e \u0447\u0438\u0441\u043b\u0430 \u0432\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0445 \u043f\u043e\u0434\u043a\u0430\u0442\u0430\u043b\u043e\u0433\u043e\u0432. \u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u043e\u043a\u0430 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e \u0432 \u0444\u043e\u0440\u043c\u0435 \u043f\u0430\u0442\u0447\u0430. \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u044b \u0432 Ubuntu \u0438 SUSE, \u043d\u043e \u043f\u043e\u043a\u0430 \u043d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u0432 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102953","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412\u043e \u0432\u0445\u043e\u0434\u044f\u0449\u0435\u0439 \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 systemd \u0443\u0442\u0438\u043b\u0438\u0442\u0435 systemd-tmpfiles \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-3997), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043d\u0435\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u0443\u044e \u0440\u0435\u043a\u0443\u0440\u0441\u0438\u044e.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-v-systemd-flatpak-samba-freerdp-clamav-node-js\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 systemd, Flatpak, Samba, FreeRDP, Clamav, Node.js | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412\u043e \u0432\u0445\u043e\u0434\u044f\u0449\u0435\u0439 \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 systemd \u0443\u0442\u0438\u043b\u0438\u0442\u0435 systemd-tmpfiles \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-3997), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043d\u0435\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u0443\u044e \u0440\u0435\u043a\u0443\u0440\u0441\u0438\u044e.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-v-systemd-flatpak-samba-freerdp-clamav-node-js\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2022-01-13T13:37:33+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2022-01-13T13:37:33+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Haavatavused systemd, Flatpak, Samba, FreeRDP, Clamav, Node.js | ProHoster","description":"systemd komponenti kuuluvas utiliidis systemd-tmpfiles avastati haavatavus (CVE-2021-3997), mis v\u00f5imaldab kontrollimatut rekursiooni.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-v-systemd-flatpak-samba-freerdp-clamav-node-js","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 systemd, Flatpak, Samba, FreeRDP, Clamav, Node.js | ProHoster","og:description":"\u0412\u043e \u0432\u0445\u043e\u0434\u044f\u0449\u0435\u0439 \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 systemd \u0443\u0442\u0438\u043b\u0438\u0442\u0435 systemd-tmpfiles \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-3997), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043d\u0435\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u0443\u044e \u0440\u0435\u043a\u0443\u0440\u0441\u0438\u044e.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-v-systemd-flatpak-samba-freerdp-clamav-node-js","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-01-13T13:37:33+00:00","article:modified_time":"2022-01-13T13:37:33+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102953","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-01-13 13:38:58","updated":"2026-02-22 15:30:39","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/102953","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=102953"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/102953\/revisions"}],"predecessor-version":[{"id":162316,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/102953\/revisions\/162316"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=102953"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=102953"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=102953"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}