{"id":119929,"date":"2024-09-24T09:43:11","date_gmt":"2024-09-24T07:43:11","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-pcp-i-nix-pozvolyayushhie-podnyat-privilegii-v-sisteme"},"modified":"2024-09-24T09:43:11","modified_gmt":"2024-09-24T07:43:11","slug":"uyazvimosti-v-pcp-i-nix-pozvolyayushhie-podnyat-privilegii-v-sisteme","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-v-pcp-i-nix-pozvolyayushhie-podnyat-privilegii-v-sisteme","title":{"rendered":"PCP ja Nixi haavatavused, mis v\u00f5imaldavad s\u00fcsteemis \u00f5iguseid t\u00f5sta.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

PCP (Performance Co-Pilot) t\u00f6\u00f6riistakomplektis, mida kasutatakse s\u00fcsteemi j\u00f5udluse statistika kogumiseks (n\u00e4iteks kasutatakse Cockpit liideses), on tuvastatud kaks haavatavust. Esimene haavatavus (CVE-2024-45770) on olemas pmpost utiliidis, mis on m\u00f5eldud logisse s\u00f5numite saatmiseks ja k\u00e4ideldakse k\u00f5rgendatud \u00f5igustega teatud k\u00e4ivitustingimustes. Haavatavuse \u00e4rakasutamine v\u00f5imaldab t\u00e4ita koodi root'i \u00f5igustes, kuid r\u00fcnnakuks on vajalik juurdep\u00e4\u00e4s PCP kasutajakontole. R\u00fcnnak seisneb s\u00fcmboolse lingi asendamises failiga \"\/var\/log\/pcp\/NOTICES\", kuhu kirjutatakse root'i \u00f5igustega protsessi poolt, ilma et faili avamisel kasutataks lippu O_NOFOLLOW. <\/p>\n

Teine haavatavus PCP-s (CVE-2024-45769) m\u00f5jutab taustaprotsessi pcmd ja viib m\u00e4lust v\u00e4ljaspool puhvertsooni juurdep\u00e4\u00e4seni, kui saadetakse spetsiaalselt vormindatud andmeid. Haavatavuse ohtu v\u00e4hendab see, et vaikimisi on pcmd-s v\u00f5rgu p\u00e4ringute vastuv\u00f5tt teistelt s\u00fcsteemidelt v\u00e4lja l\u00fclitatud. Haavatavused on k\u00f5rvaldatud PCP versioonis 6.3.1. Probleemid tuvastati SUSE projekti arendajate l\u00e4bi viidud auditi k\u00e4igus. <\/p>\n

Lisaks on Nix pakihalduris, mida kasutatakse NixOS-i distributsioonis, tuvastatud haavatavus (CVE-2024-45593). Haavatavus v\u00f5imaldab spetsiaalselt vormindatud NAR (Nix Archive) vormingus failide lahtipakkimisel kirjutada juhuslikesse failis\u00fcsteemi aladesse, nii palju kui selleks on \u00f5igused, millega t\u00f6\u00f6tleja k\u00e4itatakse (taustaprotsessi Nix korral lahtipakkimine toimub root \u00f5igustega). Probleem ilmneb Nix harust 2.24 ja on k\u00f5rvaldatud versioonis 2.24.6. <\/p>\n

Lisaks v\u00f5ib mainida hoiatuse avaldamist kriitilise haavatavuse tuvastamise kohta, mis m\u00f5jutab GNU\/Linux distributsioone ja v\u00f5imaldab kaugjuhtimise teel ilma autentimiseta koodi t\u00e4itmist s\u00fcsteemis. Praegu ei ole mingit teavet probleemide olemuse ja alams\u00fcsteemide kohta, mida see m\u00f5jutab. On \u00f6eldud, et kokkuleppel distributsioonide arendajatega kavatsetakse algne probleemiaruanne avaldada 30. septembril ja t\u00e4ielik aruanne, mis sisaldab detaile \u2014 6. oktoobril. CVE-le ei ole probleemi veel m\u00e4\u00e4ratud. Probleemi avastanud teadlase s\u00f5nul on ettev\u00f5tted Canonical ja Red Hat m\u00e4\u00e4ranud haavatavusele kriitilise ohu taseme (9.9 skaalal 10).
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0438 PCP (Performance Co-Pilot), \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0434\u043b\u044f \u0441\u0431\u043e\u0440\u0430 \u0441\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0438 \u043e \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0435 Cockpit), \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438. \u041f\u0435\u0440\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-45770) \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u0443\u0442\u0438\u043b\u0438\u0442\u0435 pmpost, \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u043e\u0439 \u0434\u043b\u044f \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0439 \u0432 \u043b\u043e\u0433 \u0438 \u043f\u0440\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u043c\u043e\u0439 \u0441 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u043d\u044b\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root, \u043d\u043e \u0434\u043b\u044f \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-119929","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47PCP ja Nix haavatavused, mis v\u00f5imaldavad t\u00f5sta \u00f5igusi s\u00fcsteemis | ProHoster","description":"PCP (Performance Co-Pilot) t\u00f6\u00f6riistakomplektis, mida kasutatakse s\u00fcsteemi j\u00f5udluse statistika kogumiseks (n\u00e4iteks Cockpit'i liideses), tuvastati kaks haavatavust.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-v-pcp-i-nix-pozvolyayushhie-podnyat-privilegii-v-sisteme","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 PCP \u0438 Nix, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043f\u043e\u0434\u043d\u044f\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 | ProHoster","og:description":"\u0412 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0438 PCP (Performance Co-Pilot), \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0434\u043b\u044f \u0441\u0431\u043e\u0440\u0430 \u0441\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0438 \u043e \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0435 Cockpit), \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-v-pcp-i-nix-pozvolyayushhie-podnyat-privilegii-v-sisteme","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-09-24T07:43:11+00:00","article:modified_time":"2024-09-24T07:43:11+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"119929","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 06:47:22","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 06:47:22","updated":"2026-01-23 06:47:22","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/119929","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=119929"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/119929\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=119929"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=119929"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=119929"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}