{"id":112136,"date":"2023-12-11T15:10:27","date_gmt":"2023-12-11T13:10:27","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-buildroot-pozvolyayushhie-cherez-mitm-ataku-vypolnit-kod-na-sborochnom-servere"},"modified":"2023-12-11T15:10:27","modified_gmt":"2023-12-11T13:10:27","slug":"uyazvimosti-v-buildroot-pozvolyayushhie-cherez-mitm-ataku-vypolnit-kod-na-sborochnom-servere","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimosti-v-buildroot-pozvolyayushhie-cherez-mitm-ataku-vypolnit-kod-na-sborochnom-servere","title":{"rendered":"Buildrooti haavatavused v\u00f5imaldavad MITM-r\u00fcnnaku kaudu koodi t\u00e4itmist ehitusteenustes.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Buildrooti s\u00fcsteemis, mis on suunatud laadimis\u00fcmbolite genereerimisele sisseehitatud s\u00fcsteemidele, avastati kuus haavatavust, mis v\u00f5imaldavad r\u00fcndajal, kes suudab pealt kuulata \u00fclekande liiklust (MITM), teha muudatusi genereeritavates s\u00fcsteemipiltides v\u00f5i korraldada koodi t\u00e4itmist ehituss\u00fcsteemi tasemel. Haavatavused on k\u00f5rvaldatud Buildrooti v\u00e4ljaannetes 2023.02.8, 2023.08.4 ja 2023.11. <\/p>\n

Esimesed viis haavatavust (CVE-2023-45841, CVE-2023-45842, CVE-2023-45838, CVE-2023-45839, CVE-2023-45840) puudutavad pakettide terviklikkuse kontrollimiseks kasutatavat koodi. Probleemid seisnevad v\u00f5imaluses kasutada HTTP-d failide allalaadimiseks ja teatud pakettide kontrollimisfailide puudumises, mis v\u00f5imaldab andmete sisu manipuleerida ehituse liiklusesse sekkumisel. serverile<\/a> (n\u00e4iteks kui kasutaja on \u00fchendatud r\u00fcndaja kontrollitud traadita v\u00f5rku). <\/p>\n

Konkreetsemalt laaditi aufs ja aufs-util paketid alla HTTP \u00fcle ja neid ei kontrollitud hashide abil. Hashid puudusid ka riscv64-elf-toolchain, versal-firmware ja mxsldr paketidelt, mis laaditi vaikimisi alla HTTPS kaudu, kuid probleemide korral p\u00f6\u00f6rduti allalaadimisele ilma kr\u00fcpteerimiseta aadressilt http:\/\/sources.buildroot.net. Kui failid '.hash' puudusid, pidas Buildroot t\u00f6\u00f6riistad allalaadimist edukaks ja t\u00f6\u00f6tles allalaaditud pakette, sealhulgas rakendas pakettidesse kuuluvaid pat\u0161e ning k\u00e4ivitas koostamisskeeme. V\u00f5imalusega asendada allalaaditud pakette sai r\u00fcndaja lisada neisse oma pat\u0161e v\u00f5i Makefile'i koostamisfailid, mis v\u00f5imaldas muuta tulemustootmispilti v\u00f5i koostamiss\u00fcsteemi skripte ning saavutada oma koodi t\u00e4itmine. <\/p>\n

Kuues haavatavus (CVE-2023-43608) tuleneb BR_NO_CHECK_HASH_FOR funktsionaalsuse rakendamise veast, mis v\u00f5imaldab keelata hashide kontrollimise teatud pakettide puhul. Teatud paketid, nagu Linuxi kernel, U-Boot ja versal-firmware, lubasid laadida viimaseid versioone, mille jaoks veel kontrollimishashid ei olnud kujunenud. Nende versioonide puhul kasutati valikut BR_NO_CHECK_HASH_FOR, mis keelas hashide kontrollimise. Andmed laaditi HTTPS kaudu, kuid vaikimisi eba\u00f5nnestumise korral kasutati tagasik\u00e4iku https:\/\/source.buildroot.net aadressil kr\u00fcptimata. R\u00fcndaja v\u00f5is MITM-r\u00fcnnaku k\u00e4igus blokeerida \u00fchenduse HTTPS-serveriga ning siis l\u00fckati laadimine tagasi http:\/\/sources.buildroot.net.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0441\u0431\u043e\u0440\u043a\u0438 Buildroot, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u0447\u043d\u044b\u0445 Linux-\u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u0439 \u0434\u043b\u044f \u0432\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0448\u0435\u0441\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u0432 \u0445\u043e\u0434\u0435 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0430 \u0442\u0440\u0430\u043d\u0437\u0438\u0442\u043d\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430 (MITM) \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u043d\u0435\u0441\u0435\u043d\u0438\u044f \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0432 \u0433\u0435\u043d\u0435\u0440\u0438\u0440\u0443\u0435\u043c\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0435 \u043e\u0431\u0440\u0430\u0437\u044b \u0438\u043b\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u0441\u0431\u043e\u0440\u043e\u0447\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 Buildroot 2023.02.8, 2023.08.4 \u0438 2023.11. \u041f\u0435\u0440\u0432\u044b\u0435 \u043f\u044f\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2023-45841, CVE-2023-45842, CVE-2023-45838, CVE-2023-45839, CVE-2023-45840) \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0442 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-112136","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Buildrooti haavatavused, mis v\u00f5imaldavad l\u00e4bi MITM-r\u00fcnnaku koodi t\u00e4itmist ehituss\u00fcsteemis | ProHoster","description":"Buildrooti s\u00fcsteemis, mis on suunatud laadimis\u00fcmbolite genereerimisele sisseehitatud s\u00fcsteemidele, avastati kuus haavatavust, mis v\u00f5imaldavad r\u00fcndajal, kes suudab pealt kuulata \u00fclekande liiklust (MITM), teha muudatusi genereeritavates s\u00fcsteemipiltides v\u00f5i korraldada koodi t\u00e4itmist ehituss\u00fcsteemi tasemel. Haavatavused on k\u00f5rvaldatud Buildrooti v\u00e4ljaannetes 2023.02.8, 2023.08.4 ja 2023.11. Esimesed viis haavatavust (CVE-2023-45841, CVE-2023-45842, CVE-2023-45838, CVE-2023-45839, CVE-2023-45840) puudutavad","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimosti-v-buildroot-pozvolyayushhie-cherez-mitm-ataku-vypolnit-kod-na-sborochnom-servere","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Buildroot, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u0447\u0435\u0440\u0435\u0437 MITM-\u0430\u0442\u0430\u043a\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0441\u0431\u043e\u0440\u043e\u0447\u043d\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 | ProHoster","og:description":"\u0412 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0441\u0431\u043e\u0440\u043a\u0438 Buildroot, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u0447\u043d\u044b\u0445 Linux-\u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u0439 \u0434\u043b\u044f \u0432\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0448\u0435\u0441\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u0432 \u0445\u043e\u0434\u0435 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0430 \u0442\u0440\u0430\u043d\u0437\u0438\u0442\u043d\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430 (MITM) \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u043d\u0435\u0441\u0435\u043d\u0438\u044f \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0432 \u0433\u0435\u043d\u0435\u0440\u0438\u0440\u0443\u0435\u043c\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0435 \u043e\u0431\u0440\u0430\u0437\u044b \u0438\u043b\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u0441\u0431\u043e\u0440\u043e\u0447\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 Buildroot 2023.02.8, 2023.08.4 \u0438 2023.11. \u041f\u0435\u0440\u0432\u044b\u0435 \u043f\u044f\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2023-45841, CVE-2023-45842, CVE-2023-45838, CVE-2023-45839, CVE-2023-45840) \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0442","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimosti-v-buildroot-pozvolyayushhie-cherez-mitm-ataku-vypolnit-kod-na-sborochnom-servere","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-12-11T13:10:27+00:00","article:modified_time":"2023-12-11T13:10:27+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"112136","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-22 15:30:24","updated":"2026-02-22 15:30:24","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/112136","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=112136"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/112136\/revisions"}],"predecessor-version":[{"id":162262,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/112136\/revisions\/162262"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=112136"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=112136"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=112136"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}