{"id":138584,"date":"2025-07-01T17:11:57","date_gmt":"2025-07-01T15:11:57","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-utilite-sudo-pozvolyayushhie-poluchit-prava-root-v-sisteme"},"modified":"2025-07-01T17:11:57","modified_gmt":"2025-07-01T15:11:57","slug":"uyazvimosti-v-utilite-sudo-pozvolyayushhie-poluchit-prava-root-v-sisteme","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-v-utilite-sudo-pozvolyayushhie-poluchit-prava-root-v-sisteme","title":{"rendered":"Vulnerabilities in the sudo utility that allow obtaining root privileges in the system","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A vulnerability has been identified in the sudo package, used to execute commands on behalf of other users (CVE-2025-32463), allowing any non-privileged user to execute code with root privileges, even if the user is not specified in the sudoers configuration. The issue affects distributions using the configuration file \/etc\/nsswitch.conf, for example, the vulnerability has been demonstrated in Ubuntu 24.04 and Fedora 41. <\/p>\n
The vulnerability manifests in the default configuration and has been confirmed in sudo releases from 1.9.14 to 1.9.17 (potentially affecting all versions starting from 1.8.33). The issue has been resolved in the sudo update 1.9.17p1. To check the status of the new package version or the preparation of a patch in distributions, you can visit the following pages (if the page is unavailable, it means the distribution developers have not yet started addressing the issue): Debian, Ubuntu, Fedora, SUSE\/openSUSE, RHEL, Gentoo, and Arch (1, 2). <\/p>\n
Probleem tekib siis, kui chroot-keskkonnas k\u00e4ivitamisel kasutatakse valikut «-R» («—chroot»), et valida kasutaja juurkataloog, fail \\\/etc\\\/nsswitch.conf laaditakse uue juurkatalooge kontekstis, mitte s\u00fcsteemi katalooge. Kuna kasutaja v\u00f5ib kasutada oma katalooge chrooti juurkataloogina, v\u00f5ib ta sinna paigutada ka nsswitch.conf konfigureerimisfaili. Kontrollides NSS (Nimi Teenuse L\u00fclitus) s\u00fcsteemile laadimist fail \\\/etc\\\/nsswitch.conf, saab kasutaja lisada seadeid, mis kutsuvad esile t\u00e4iendavate t\u00f6\u00f6tlejate aktiveerimise. Sellised t\u00f6\u00f6tlejad laaditakse NSS-i kujul jagatud teekidena, mida saab samuti paigutada kasutaja kontrollitavasse katalooge. Asendades oma teegi, v\u00f5ib kasutaja tagada, et selle kood k\u00e4ivitub root-re\u017eiimis, kuna NSSi t\u00f6\u00f6tlemine toimub enne privileegide t\u00fchistamist. <\/p>\n
Sudo versioonis 1.9.17p1 on samuti k\u00f5rvaldatud veel \u00fcks haavatavus (CVE-2025-32462), mis v\u00f5imaldab k\u00e4ivitada k\u00e4ske root-re\u017eiimis, kuid avaldub vaid sudoers-i seadistustes, kus parameeter «host» on seatud teistsuguseks kui ALL v\u00f5i praeguse hosti nimi. Haavatavus on p\u00f5hjustatud veast, mille t\u00f5ttu valik «-h» («—host») toiminud mitte ainult koos valikuga «-l» («—list») hostiga seotud privileegide kuvamiseks, vaid ka k\u00e4skude k\u00e4ivitamisel. Seega sai kasutaja, kutsudes sudo, m\u00e4\u00e4rata mis tahes hosti ja m\u00f6\u00f6da minna sudoers-i reeglite piirangutest, mis on seotud hosti nimega. <\/p>\n
R\u00fcnnaku sooritamiseks peab kasutaja olema mainitud sudoers-is, n\u00e4iteks kui seadistustes on m\u00e4\u00e4ratud «testuser testhost = ALL», siis sai kasutaja «testuser» m\u00e4\u00e4rata «sudo -h testhost» ja k\u00e4ivitada k\u00e4ske root-re\u017eiimis mistahes hostides, mitte ainult hostis testhost. Haavatavused ei m\u00f5juta seadistusi, kus seadistus on n\u00e4htud kujul «testuser ALL = ALL» v\u00f5i ilma konkreetse kasutaja jaoks selgete reeglitega. \n Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"