{"id":105610,"date":"2022-11-17T15:36:49","date_gmt":"2022-11-17T13:36:49","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/kriticheskie-uyazvimosti-v-netatalk-privodyashhie-k-udalyonnomu-vypolneniyu-koda"},"modified":"2022-11-17T15:36:49","modified_gmt":"2022-11-17T13:36:49","slug":"kriticheskie-uyazvimosti-v-netatalk-privodyashhie-k-udalyonnomu-vypolneniyu-koda","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/kriticheskie-uyazvimosti-v-netatalk-privodyashhie-k-udalyonnomu-vypolneniyu-koda","title":{"rendered":"Kriitilised haavatavused Netatalkis, mis v\u00f5ivad viia kaugjuhtimise t\u00e4itmiseni","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Netatalkis on AppleTalki ja Apple Filing Protocoli (AFP) v\u00f5rguprotokollide rakendusega server, milles on avastatud kuus kaugelt kasutatavat haavatavust, mis v\u00f5imaldavad koguda oma koodi t\u00e4itmist juur\u00f5igustes spetsiaalselt vormindatud paketide edastamise kaudu. Netatalkit kasutavad paljusid andmesalvestusseadmete (NAS) tootjaid, et v\u00f5imaldada failide jagamist ja printerite juurde p\u00e4\u00e4semist Apple'i arvutitest. N\u00e4iteks on seda kasutatud Western Digitali seadmetes (probleem lahendatud Netatalki eemaldamisega WD-firmware'ist). Netatalk kuulub ka paljude distributsioonide hulka, sealhulgas OpenWRT (eemaldatud alates OpenWrt 22.03 harust), Debian, Ubuntu, SUSE, Fedora ja FreeBSD, kuid see ei ole vaikeinstallatsioonis. Probleemid on k\u00f5rvaldatud Netatalki versioonis 3.1.13.    <\/p>\n<p>Tuvastatud probleemid:  <\/p>\n<ul>\n<li class=\"l\"> CVE-2022-0194 \u2014 puudulik kontroll v\u00e4listest andmete suuruse \u00fcle funktsioonis ad_addcomment(), enne nende kopeerimist fikseeritud puhvrisse. Haavatavus v\u00f5imaldab kaugr\u00fcndajatel, kes ei ole autentimisele allunud, k\u00e4itada oma koodi root-\u00f5igustega.\n<li class=\"l\"> CVE-2022-23121 \u2014 vigane vigade k\u00e4sitlemine funktsioonis parse_entries(), mis tekivad AppleDouble kirjeid anal\u00fc\u00fcsides. Haavatavus v\u00f5imaldab kaugr\u00fcndajatel, kes ei ole autentimisele allunud, k\u00e4itada oma koodi root-\u00f5igustega.\n<li class=\"l\"> CVE-2022-23122 \u2014 puudulik kontroll v\u00e4listest andmete suuruse \u00fcle funktsioonis setfilparams(), enne nende kopeerimist fikseeritud puhvrisse. Haavatavus v\u00f5imaldab kaugr\u00fcndajatel, kes ei ole autentimisele allunud, k\u00e4itada oma koodi root-\u00f5igustega.\n<li class=\"l\"> CVE-2022-23124 \u2014 puudulik sissetulevate andmete kontroll meetodis get_finderinfo(), mis p\u00f5hjustab lugemist eraldatud puhvrisse kuuluvast piirkonnast v\u00e4ljaspool. Haavatavus v\u00f5imaldab kaugr\u00fcndajatel, kes ei ole autentimisele allunud, eraldada m\u00e4luprotsessi andmeid. Koos teiste haavatavustega v\u00f5ib see viga samuti olla kasutatav koodi k\u00e4itamiseks root-\u00f5igustega.\n<li class=\"l\"> CVE-2022-23125 \u2014 puudulik suuruse kontroll elementi \u201elen\u201c anal\u00fc\u00fcsides funktsioonis copyapplfile(), enne andmete kopeerimist fikseeritud puhvrisse. Haavatavus v\u00f5imaldab kaugr\u00fcndajatel, kes ei ole autentimisele allunud, k\u00e4itada oma koodi root-\u00f5igustega.\n<li class=\"l\"> CVE-2022-23123 \u2014 puudulik sissetulevate andmete kontroll meetodis getdirparams(), mis p\u00f5hjustab lugemist eraldatud puhvrisse kuuluvast piirkonnast v\u00e4ljaspool. Haavatavus v\u00f5imaldab kaugr\u00fcndajatel, kes ei ole autentimisele allunud, eraldada m\u00e4luprotsessi andmeid.       <\/ul>\n<p>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=58129\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 Netatalk, \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0441 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u043e\u0432 AppleTalk \u0438 Apple Filing Protocol (AFP), \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e \u0448\u0435\u0441\u0442\u044c \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432. Netatalk \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u043c\u043d\u043e\u0433\u0438\u043c\u0438 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f\u043c\u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 \u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0434\u0430\u043d\u043d\u044b\u0445 (NAS) \u0434\u043b\u044f \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u043e\u0431\u043c\u0435\u043d\u0430 \u0444\u0430\u0439\u043b\u0430\u043c\u0438 \u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043f\u0440\u0438\u043d\u0442\u0435\u0440\u0430\u043c c \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043e\u0432 Apple, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u043b\u0441\u044f \u0432 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-105610","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 Netatalk, \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0441 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u043e\u0432 AppleTalk \u0438 Apple Filing Protocol (AFP), \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e \u0448\u0435\u0441\u0442\u044c \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u0447\u0435\u0440\u0435\u0437.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/news\/kriticheskie-uyazvimosti-v-netatalk-privodyashhie-k-udalyonnomu-vypolneniyu-koda\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Netatalk, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0438\u0435 \u043a \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 Netatalk, \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0441 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u043e\u0432 AppleTalk \u0438 Apple Filing Protocol (AFP), \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e \u0448\u0435\u0441\u0442\u044c \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u0447\u0435\u0440\u0435\u0437.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/news\/kriticheskie-uyazvimosti-v-netatalk-privodyashhie-k-udalyonnomu-vypolneniyu-koda\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2022-11-17T13:36:49+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2022-11-17T13:36:49+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kriitilised haavatavused Netatalkis, mis viivad eemaloleva koodi t\u00e4itmiseni | ProHoster","description":"Netatalkis, serveris, mis rakendab AppleTalki ja Apple Filing Protocol (AFP) v\u00f5rguprotokolle, on tuvastatud kuus eemalt ekspluateeritavat haavatavust, mis v\u00f5imaldab koodi t\u00e4itmist root \u00f5igustes.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/kriticheskie-uyazvimosti-v-netatalk-privodyashhie-k-udalyonnomu-vypolneniyu-koda","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Netatalk, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0438\u0435 \u043a \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 | ProHoster","og:description":"\u0412 Netatalk, \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0441 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u043e\u0432 AppleTalk \u0438 Apple Filing Protocol (AFP), \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e \u0448\u0435\u0441\u0442\u044c \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u0447\u0435\u0440\u0435\u0437.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/kriticheskie-uyazvimosti-v-netatalk-privodyashhie-k-udalyonnomu-vypolneniyu-koda","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-11-17T13:36:49+00:00","article:modified_time":"2022-11-17T13:36:49+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/105610","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=105610"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/105610\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=105610"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=105610"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=105610"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}