{"id":115168,"date":"2024-04-19T02:30:08","date_gmt":"2024-04-19T00:30:08","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-vo-flatpak-pozvolyayushhaya-obojti-sandbox-izolyacziyu"},"modified":"2024-04-19T02:30:08","modified_gmt":"2024-04-19T00:30:08","slug":"uyazvimost-vo-flatpak-pozvolyayushhaya-obojti-sandbox-izolyacziyu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-vo-flatpak-pozvolyayushhaya-obojti-sandbox-izolyacziyu","title":{"rendered":"Flatpaki haavatavus, mis v\u00f5imaldab v\u00e4ltida sandbox-eratust.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Flatpak'i t\u00f6\u00f6riistades, mis on m\u00f5eldud s\u00f5ltumatute pakettide loomiseks, mis ei ole seotud konkreetsete Linuxi distributsioonidega ja on s\u00fcsteemist eraldatud, avastati haavatavus (CVE-2024-32462). See haavatavus v\u00f5imaldab pahatahtlikul v\u00f5i kompromiteeritud rakendusel, mis on pakendis flatpak, k\u00f5igepealt m\u00f6\u00f6da hiilida kehtestatud liivakasti eraldatusest ja p\u00e4\u00e4seda juurde p\u00f5hikoha failidele. Probleem ilmneb ainult paketides, mis kasutavad Freedesktop'i porte (xdg-desktop-portal), mida kasutatakse ressurside ligip\u00e4\u00e4su korraldamiseks kasutajakeskkonnast eraldatud rakendustest. Haavatavus on k\u00f5rvaldhef noopist ja v\u00e4rskendustes flatpak versioonides 1.15.8, 1.14.6, 1.12.9 ja 1.10.9. Kaitsemeetmed on samuti pakutud xdg-desktop-portal'i v\u00e4ljaannetes 1.16.1 ja 1.18.4. <\/p>\n

Haavatavuse t\u00f5ttu saab isoleeritud keskkonnas asuv rakendus kasutada xdg-desktop-portal'i liidest, et luua fail «.desktop» rakenduse k\u00e4ivitamise k\u00e4suga flatpak'ist, mis v\u00f5imaldab p\u00e4\u00e4seda juurde p\u00f5hiss\u00fcsteemi failidele. Isoleeritud keskkonnast v\u00e4ljumiseks kasutatakse parameetrit «—command», millega edastatakse programmi nimi, mis asub flatpak-pakendis ja mida tuleb isoleeritud keskkonnas k\u00e4ivitada. Isoleeritud keskkonna seadistamiseks kutsub flatpak v\u00e4lja bwrap utiliidi, edastades sellele m\u00e4\u00e4ratud programmi nime. N\u00e4iteks, et k\u00e4ivitada utiliit ls isoleeritud keskkonnas, saab kasutada konstruktsiooni «flatpak run —command=ls org.gnome.gedit», mis toob kaasa «bwrap <isolatsiooni_parameetrid> ls» k\u00e4ivitamise. <\/p>\n

Haavatavuse tuum on see, et kui programmi nimi algab m\u00e4rkidega «—«, tajub utiliit bwrap seda kui enda valikut. N\u00e4iteks, kui k\u00e4ivitada «flatpak run —command=—bind org.gnome.gedit \/ \/host ls -l \/host», viiakse ellu «bwrap <isolatsiooni_parameetrid> —bind \/ \/host ls -l \/host», st nimi «—bind» t\u00f6\u00f6deldakse mitte k\u00e4ivitatava rakenduse nime, vaid bwrap'i valikuna. <\/p>\n

Haavatavust s\u00fcvendab see, et D-Bus liides «org.freedesktop.portal.Background.RequestBackground» v\u00f5imaldab Flatpak'i paketist p\u00e4rit rakendusel m\u00e4\u00e4rata ette igasuguseid k\u00e4ske, sealhulgas alustada need «—« s\u00fcmbolidega, kasutades «flatpak run —command». Eeldati, et igasuguste k\u00e4skude edastamine ei ole ohtlik, kuna need t\u00e4idetakse pakendi isoleeritud keskkonnas. Kuid ei arvestatud, et k\u00e4sud, mis algavad «—» s\u00fcmboliga, t\u00f6\u00f6deldakse bwrap'i utiliidi valikutena. L\u00f5ppkokkuv\u00f5ttes v\u00f5ib xdg-desktop-portal'i liidest kasutada failide «.desktop» loomiseks, mis sisaldab seda haavatavust \u00e4rakasutavat k\u00e4sku.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0438 Flatpak, \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u043e\u043c \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0441\u0430\u043c\u043e\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043d\u0435 \u043f\u0440\u0438\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u043a \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u044b\u043c \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u043c Linux \u0438 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043e\u0442 \u043e\u0441\u0442\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-32462). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u043c\u0443 \u0438\u043b\u0438 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044e, \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u043c\u0443 \u0432 \u043f\u0430\u043a\u0435\u0442\u0435 flatpak, \u043e\u0431\u043e\u0439\u0442\u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0439 \u0440\u0435\u0436\u0438\u043c sandbox-\u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0444\u0430\u0439\u043b\u0430\u043c \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u043f\u0430\u043a\u0435\u0442\u0430\u0445, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u043f\u043e\u0440\u0442\u0430\u043b\u044b Freedesktop (xdg-desktop-portal), \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0435 \u0434\u043b\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-115168","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Flatpak'i haavatavus, mis v\u00f5imaldab m\u00f6\u00f6da hiilida liivakasti eraldatusest | ProHoster","description":"Flatpak'i t\u00f6\u00f6riistades, mis on m\u00f5eldud s\u00f5ltumatute pakettide loomiseks, mis ei ole seotud konkreetsete Linuxi distributsioonidega ja on s\u00fcsteemist eraldatud, avastati haavatavus (CVE-2024-32462). See haavatavus v\u00f5imaldab pahatahtlikul v\u00f5i kompromiteeritud rakendusel, mis on pakendis flatpak, k\u00f5igepealt m\u00f6\u00f6da hiilida kehtestatud liivakasti eraldatusest ja p\u00e4\u00e4seda juurde p\u00f5hikoha failidele. Probleem ilmneb ainult paketides, mis kasutavad Freedesktop'i porte (xdg-desktop-portal), mida kasutatakse.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-vo-flatpak-pozvolyayushhaya-obojti-sandbox-izolyacziyu","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u043e flatpak, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 sandbox-\u0438\u0437\u043e\u043b\u044f\u0446\u0438\u044e | ProHoster","og:description":"\u0412 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0438 Flatpak, \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u043e\u043c \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0441\u0430\u043c\u043e\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u043d\u0435 \u043f\u0440\u0438\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u043a \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u044b\u043c \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u043c Linux \u0438 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043e\u0442 \u043e\u0441\u0442\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-32462). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u043c\u0443 \u0438\u043b\u0438 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044e, \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u043c\u0443 \u0432 \u043f\u0430\u043a\u0435\u0442\u0435 flatpak, \u043e\u0431\u043e\u0439\u0442\u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0439 \u0440\u0435\u0436\u0438\u043c sandbox-\u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0444\u0430\u0439\u043b\u0430\u043c \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u043f\u0430\u043a\u0435\u0442\u0430\u0445, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u043f\u043e\u0440\u0442\u0430\u043b\u044b Freedesktop (xdg-desktop-portal), \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0435 \u0434\u043b\u044f","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-vo-flatpak-pozvolyayushhaya-obojti-sandbox-izolyacziyu","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-04-19T00:30:08+00:00","article:modified_time":"2024-04-19T00:30:08+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"115168","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 22:37:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-22 22:37:20","updated":"2026-01-22 22:37:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/115168","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=115168"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/115168\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=115168"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=115168"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=115168"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}