{"id":123909,"date":"2025-05-01T15:05:06","date_gmt":"2025-05-01T13:05:06","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-sisteme-iniczializaczii-finit-pozvolyayushhaya-vojti-v-sistemu-bez-parolya"},"modified":"2025-05-01T15:05:06","modified_gmt":"2025-05-01T13:05:06","slug":"uyazvimost-v-sisteme-iniczializaczii-finit-pozvolyayushhaya-vojti-v-sistemu-bez-parolya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-sisteme-iniczializaczii-finit-pozvolyayushhaya-vojti-v-sistemu-bez-parolya","title":{"rendered":"Haavatavus finit k\u00e4ivituss\u00fcsteemis, mis v\u00f5imaldab siseneda s\u00fcsteemi ilma paroolita","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Finit'i initsialiseerimiss\u00fcsteemis avastati haavatavus (CVE-2025-29906), mis v\u00f5imaldab sisse logida igasuguse kasutajana ilma parooli kontrollimata. Haavatavuse ekspluateerimine toimub sisselogimisnupu (login) manipuleerimise kaudu ja n\u00f5uab juurdep\u00e4\u00e4su konsoolile. Haavatavus ilmnes alates versioonist 3.0 (oktoober 2017) ja on k\u00f5rvaldatud versioonis finit 4.11. Juba on v\u00e4lja t\u00f6\u00f6tatud versioon 4.12, milles on lahendatud pufferi \u00fclet\u00e4itumine urandom-plugin'is, mis pole klassifitseeritud haavatavuseks. <\/p>\n

Haavatavus puudutab getty programmi, mis kuvab sisestusprotsessi terminalis ja k\u00e4ivitab protsessi \/bin\/login kasutaja autentimiseks. Haavatavus tuleneb argumentide eraldamise puudumisest k\u00e4sureal \/bin\/login k\u00e4ivitamisel, mis v\u00f5imaldas kasutajanime sisestamisel m\u00e4\u00e4rata valiku \"-f\", mis keelab parooli kontrollimise (n\u00e4iteks v\u00f5is sisestada \"-f root\" asemel \"root\"). Probleem lahendati lisades argumendi \"--\" enne kasutajanime v\u00e4ljad: -- execl(_PATH_LOGIN, _PATH_LOGIN, \"-p\", name, NULL); + execl(_PATH_LOGIN, _PATH_LOGIN, \"-p\", \"--\", name, NULL); <\/p>\n

K\u00e4itumisviisina haavatavuse blokeerimiseks soovitatakse finit'is kasutada v\u00e4list getty teostust, n\u00e4iteks agetty. Debian 12, Ubuntu, Parrot, Raspbian ja Trisquel'i distributsioonides on paketid finitiga endiselt parandamata haavatavuse osas. <\/p>\n

Finit (Fast init) initsialiseerimiss\u00fcsteem areneb kui lihtne alternatiiv SysV init'ile ja systemd-le ning on levinud sisseehitatud s\u00fcsteemides. Projekt p\u00f5hineb fastinit initsialiseerimiss\u00fcsteemi tehnoloogiatel, mida kasutatakse Linuxi firmware'is netbook'ide EeePC ja mis on tuntud oma v\u00e4ga kiire bootimisprotsessi poolest. Finit toetab SysV init'i stiilis k\u00e4itamisaste (runlevel), teenuse automaatset taask\u00e4ivitamist t\u00f5rke korral, \u00fchekordsete t\u00f6\u00f6tlejate k\u00e4itamise, teenuste k\u00e4ivitamist s\u00f5ltuvuste ja erinevate tingimuste arvestamisega, t\u00e4iendavate t\u00f6\u00f6tlejate lisamist enne v\u00f5i p\u00e4rast teenuse k\u00e4ivitamist, funktsionaalsuse laiendamist pluginate abil, piirangute seadmist Cgroups v2 kaudu.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0438\u043d\u0438\u0446\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 finit \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-29906), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u043e\u0439\u0442\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u043f\u043e\u0434 \u043b\u044e\u0431\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u0431\u0435\u0437 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u0430\u0440\u043e\u043b\u044f. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u044e \u0441 \u043f\u0440\u0438\u0433\u043b\u0430\u0448\u0435\u043d\u0438\u0435\u043c \u0432\u0445\u043e\u0434\u0430 (login) \u0438 \u0442\u0440\u0435\u0431\u0443\u0435\u0442 \u043d\u0430\u043b\u0438\u0447\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043a\u043e\u043d\u0441\u043e\u043b\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u0435\u0440\u0441\u0438\u0438 3.0 (\u043e\u043a\u0442\u044f\u0431\u0440\u044c 2017 \u0433\u043e\u0434\u0430) \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0435 finit 4.11. \u0421\u043b\u0435\u0434\u043e\u043c \u0443\u0436\u0435 \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a 4.12 \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-123909","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Haavatavus finit initsialiseerimiss\u00fcsteemis, mis v\u00f5imaldab sisse logida ilma paroolita | ProHoster","description":"Finit'i initsialiseerimiss\u00fcsteemis avastati haavatavus (CVE-2025-29906), mis v\u00f5imaldab sisse logida igasuguse kasutajana ilma parooli kontrollimata.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-sisteme-iniczializaczii-finit-pozvolyayushhaya-vojti-v-sistemu-bez-parolya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0438\u043d\u0438\u0446\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 finit, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u043e\u0439\u0442\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0431\u0435\u0437 \u043f\u0430\u0440\u043e\u043b\u044f | ProHoster","og:description":"\u0412 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0438\u043d\u0438\u0446\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 finit \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-29906), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u043e\u0439\u0442\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u043f\u043e\u0434 \u043b\u044e\u0431\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u0431\u0435\u0437 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u0430\u0440\u043e\u043b\u044f.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-sisteme-iniczializaczii-finit-pozvolyayushhaya-vojti-v-sistemu-bez-parolya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-05-01T13:05:06+00:00","article:modified_time":"2025-05-01T13:05:06+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"123909","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 12:36:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 12:36:19","updated":"2026-01-23 12:36:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/123909","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=123909"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/123909\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=123909"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=123909"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=123909"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}