{"id":106652,"date":"2023-02-06T18:48:11","date_gmt":"2023-02-06T16:48:12","guid":{"rendered":"https:\/\/prohoster.info\/?p=106652"},"modified":"2023-02-07T12:08:50","modified_gmt":"2023-02-07T10:08:50","slug":"uyazvimost-v-imagemagick-privodyashhaya-k-utechke-soderzhimogo-lokalnyh-fajlov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-imagemagick-privodyashhaya-k-utechke-soderzhimogo-lokalnyh-fajlov","title":{"rendered":"ImageMagickis avastatud haavatavus, mis p\u00f5hjustab kohalike failide sisu lekke","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

ImageMagick paketis, mida web-arendajad tihti kasutavad piltide t\u00f6\u00f6tlemiseks, on avastatud haavatavus CVE-2022-44268, mis v\u00f5ib p\u00f5hjustada failide sisu lekkimist, kui muudetud on r\u00fcndaja poolt ettevalmistatud PNG-pilte. Haavatavus ohustab s\u00fcsteeme, mis t\u00f6\u00f6tlevad v\u00e4liseid pilte ja annavad seej\u00e4rel v\u00f5imaluse laadida \u00fcles muudetud tulemusi. <\/p>\n

Haavatavus tuleneb sellest, et ImageMagick PNG-pildi t\u00f6\u00f6tlemisel kasutab metaandmete ploki 'profile' parameetri sisu faili nime m\u00e4\u00e4ramiseks, mis lisatakse tulemuseks saadud faili. R\u00fcnnaku teostamiseks on piisav, kui lisada PNG-pildile 'profile' parameeter vajaliku failiteega (nt '\/etc\/passwd') ja sellise pildi t\u00f6\u00f6tlemisel, n\u00e4iteks pildi suuruse muutmisel, lisatakse v\u00e4ljundfaili vajalik faili sisu. Kui faili nime asemel on m\u00e4\u00e4ratud '-', siis j\u00e4\u00e4b t\u00f6\u00f6tleja standardse sisendi ootama, mis v\u00f5ib olla kasutatud teenuse h\u00e4irimiseks (CVE-2022-44267). <\/p>\n

Haavatavuse parandava uuenduse v\u00e4ljalaskmine pole veel toimunud, kuid ImageMagicki arendajad on soovitanud leevendusena, et kaitsta lekete eest, luua konfiguratsioonis reegel, mis piirab juurdep\u00e4\u00e4su teatud failiteedele. N\u00e4iteks absoluutselt ja suhteliselt teeleruumi juurdep\u00e4\u00e4su keelamiseks v\u00f5ib policy.xml faili lisada: <\/p>\n

Avalikult on juba saadaval skript, mis genereerib haavatavaid PNG-pilte.

\"ImageMagickis<\/center>
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043f\u0430\u043a\u0435\u0442\u0435 ImageMagick, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0447\u0430\u0441\u0442\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f web-\u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430\u043c\u0438 \u0434\u043b\u044f \u043f\u0440\u0435\u043e\u0431\u0440\u0430\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0439, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2022-44268, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0442\u0435\u0447\u043a\u0435 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u043e\u0432 \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u043f\u0440\u0435\u043e\u0431\u0440\u0430\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 ImageMagick \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u043c PNG-\u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0439. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0433\u0440\u043e\u0436\u0430\u0435\u0442 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u044e\u0442 \u0432\u043d\u0435\u0448\u043d\u0438\u0435 \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u044f \u0438 \u0437\u0430\u0442\u0435\u043c \u0434\u0430\u044e\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u043f\u0440\u0435\u043e\u0431\u0440\u0430\u0437\u043e\u0432\u0430\u043d\u0438\u044f. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u0442\u0435\u043c, \u0447\u0442\u043e \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 PNG-\u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u044f ImageMagick \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430 «profile» […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":106653,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-106652","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Haavatavus ImageMagick'is, mis toob kaasa kohalikest failidest sisu leke | ProHoster","description":"ImageMagicki paketis, mida veebiarendajad sageli kasutavad piltide t\u00f6\u00f6tlemiseks, avastati haavatavus CVE-2022-44268, mis v\u00f5ib p\u00f5hjustada failisisu lekke failide t\u00f6\u00f6tlemise korral.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-imagemagick-privodyashhaya-k-utechke-soderzhimogo-lokalnyh-fajlov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 ImageMagick, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0443\u0442\u0435\u0447\u043a\u0435 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 | ProHoster","og:description":"\u0412 \u043f\u0430\u043a\u0435\u0442\u0435 ImageMagick, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0447\u0430\u0441\u0442\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f web-\u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430\u043c\u0438 \u0434\u043b\u044f \u043f\u0440\u0435\u043e\u0431\u0440\u0430\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0439, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2022-44268, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0442\u0435\u0447\u043a\u0435 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u043e\u0432 \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u043f\u0440\u0435\u043e\u0431\u0440\u0430\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0440\u0438.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-imagemagick-privodyashhaya-k-utechke-soderzhimogo-lokalnyh-fajlov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-02-06T16:48:12+00:00","article:modified_time":"2023-02-07T10:08:50+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/106652","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=106652"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/106652\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/106653"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=106652"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=106652"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=106652"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}