{"id":105611,"date":"2022-11-17T15:36:54","date_gmt":"2022-11-17T13:36:54","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-samba-i-mit-heimdal-kerberos-privodyashhaya-k-perepolneniyu-bufera"},"modified":"2022-11-17T15:36:54","modified_gmt":"2022-11-17T13:36:54","slug":"uyazvimost-v-samba-i-mit-heimdal-kerberos-privodyashhaya-k-perepolneniyu-bufera","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-samba-i-mit-heimdal-kerberos-privodyashhaya-k-perepolneniyu-bufera","title":{"rendered":"Samba ja MIT\/Heimdal Kerberose haavatavus, mis viib puhver\u00fcletuseni","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

On v\u00e4lja antud Samba 4.17.3, 4.16.7 ja 4.15.12 korrigeerivad versioonid, mis k\u00f5rvaldasid haavatavuse (CVE-2022-42898) Kerberose teeki, mis p\u00f5hjustas t\u00e4isarvude \u00fclevaatamise ja andmete kirjutamise v\u00e4ljapoole eraldatud pufferit, kui t\u00f6\u00f6tleti PAC (Privileged Attribute Certificate) parameetreid, mille saatis autentitud kasutaja. Pakettide uuenduste avaldamist jaotustes saab j\u00e4lgida lehtedel: Debian, Ubuntu, Gentoo, RHEL, SUSE, Arch, FreeBSD. <\/p>\n

Lisaks Samba-le ilmneb probleem ka MIT Kerberose ja Heimdal Kerberose pakettides. Samba projekti haavatavuse aruanne ei t\u00e4psusta ohtu, kuid MIT Kerberose aruandes on m\u00e4rgitud, et haavatavus v\u00f5ib viia kaugk\u00e4itamiseni. Haavatavuse rakendamine on v\u00f5imalik ainult 32-bitistes s\u00fcsteemides. <\/p>\n

Probleem m\u00f5jutab konfiguratsioone, kus on KDC (Key Distribution Center) v\u00f5i kadmind. Konfiguratsioonides, mis ei kasuta Active Directory't, ilmneb haavatavus ka failiserverites, mis kasutavad Kerberost. serverites<\/a> Probleem on p\u00f5hjustatud veast funktsioonis krb5_parse_pac(), mille t\u00f5ttu arvutati vale pufferi suurus, mis on vajalik PAC v\u00e4ljade anal\u00fc\u00fcsimiseks. 32-bitistes s\u00fcsteemides v\u00f5is spetsiaalselt koostatud PAC-de t\u00f6\u00f6tlemisel t\u00f5rge viia r\u00fcndajalt edastatud 16-baidise ploki paigutamiseni v\u00e4ljapoole eraldatud puhvrit.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u043f\u0430\u043a\u0435\u0442\u0430 Samba 4.17.3, 4.16.7 \u0438 4.15.12 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2022-42898) \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 Kerberos, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0435\u0439 \u043a \u0446\u0435\u043b\u043e\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u0438 \u0437\u0430\u043f\u0438\u0441\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0431\u0443\u0444\u0435\u0440\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043e\u0432 PAC (Privileged Attribute Certificate), \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c. \u041f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u044e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 \u043c\u043e\u0436\u043d\u043e \u043f\u0440\u043e\u0441\u043b\u0435\u0434\u0438\u0442\u044c \u043d\u0430 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0430\u0445: Debian, Ubuntu, Gentoo, RHEL, SUSE, Arch, FreeBSD. \u041a\u0440\u043e\u043c\u0435 Samba […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-105611","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Haavatavus Samba ja MIT\/Heimdal Kerberoses, mis p\u00f5hjustab puhvri \u00fclevaatamise | ProHoster","description":"On v\u00e4lja antud Samba 4.17.3, 4.16.7 ja 4.15.12 korrigeerivad versioonid, mis k\u00f5rvaldasid haavatavuse (CVE-2022-42898) Kerberose teeki, mis p\u00f5hjustas t\u00e4isarvude \u00fclevaatamise ja andmete kirjutamise v\u00e4ljapoole.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-samba-i-mit-heimdal-kerberos-privodyashhaya-k-perepolneniyu-bufera","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Samba \u0438 MIT\/Heimdal Kerberos, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u0431\u0443\u0444\u0435\u0440\u0430 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u043f\u0430\u043a\u0435\u0442\u0430 Samba 4.17.3, 4.16.7 \u0438 4.15.12 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2022-42898) \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 Kerberos, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0435\u0439 \u043a \u0446\u0435\u043b\u043e\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u0438 \u0437\u0430\u043f\u0438\u0441\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-samba-i-mit-heimdal-kerberos-privodyashhaya-k-perepolneniyu-bufera","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-11-17T13:36:54+00:00","article:modified_time":"2022-11-17T13:36:54+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/105611","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=105611"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/105611\/revisions"}],"predecessor-version":[{"id":164425,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/105611\/revisions\/164425"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=105611"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=105611"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=105611"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}