{"id":55016,"date":"2020-01-10T00:00:00","date_gmt":"2020-01-09T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/uyazvimost-v-e2fsck-proyavlyayushhayasya-pri-obrabotke-spetsialno-oformlennyh-katalogov"},"modified":"2020-02-18T14:03:05","modified_gmt":"2020-02-18T11:03:05","slug":"uyazvimost-v-e2fsck-proyavlyayushhayasya-pri-obrabotke-spetsialno-oformlennyh-katalogov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-v-e2fsck-proyavlyayushhayasya-pri-obrabotke-spetsialno-oformlennyh-katalogov","title":{"rendered":"Haavatavus e2fsck-s, mis ilmneb spetsiaalselt kujundatud kataloogide t\u00f6\u00f6tlemisel","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Utiliid e2fsck, mis on osa paketist e2fsprogs<\/a><\/noindex>, tuvastatud<\/a><\/noindex> haavatavus<\/a><\/noindex> (CVE-2019-5188<\/a><\/noindex>), mis v\u00f5imaldab kurjategijal saada koodi k\u00e4ivitamise \u00f5igusi, kui kontrollitakse failis\u00fcsteemi, mis sisaldab eriliselt vormistatud katalooge. Haavatavust on kinnitatud v\u00e4ljaannetest 1.43.3 kuni 1.45.4. Haavatavus on k\u00f5rvaldatud versioonis e2fsck 1.45.5<\/a><\/noindex>. Jaotustes j\u00e4\u00e4b probleem siiski lahendamata (Debian<\/a><\/noindex>, Arch Linuxis<\/a><\/noindex>, SUSE\/openSUSE<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, RHEL<\/a><\/noindex>).<\/p>\n

Haavatavus on p\u00f5hjustatud veast funktsioonis mutate_name() failis rehash.c, mida kasutatakse katalooge puudutavate hash-tabelite \u00fcmberkujundamisel, mis tagavad katalooge sisaldavate failide vastavuse. Katalooge puudutava hash_entry struktuuri kahjustamine v\u00f5ib viia r\u00fcndaja andmete kirjutamisele v\u00e4ljapoole m\u00e4\u00e4ratud bufferd. Kui hash-tabelis seondub kataloogiga mitu faili, millel on sama nimi, nimetab utiliit e2fsck korduvad failid \u00fcmber, lisades nimele ~0, ~1 jne. Selle \u00fcmbernimetamise ajal uue nime ajutiseks hoidmiseks eraldatakse virnas 256-baidine puhvers\u00fclearu. <\/p>\n

Kopeeritud andmete suurus m\u00e4\u00e4ratakse v\u00e4ljendiga «entry->name_len & 0xff», kuid entry->name_len v\u00e4\u00e4rtus laaditakse struktuurist kettal, mitte ei arvutata tegeliku nime suuruse p\u00f5hjal. Kui suurus on null, siis massiivi indeks v\u00f5tab v\u00e4\u00e4rtuse -1 ja luuakse tingimused, mis v\u00f5ivad p\u00f5hjustada t\u00e4isarvu \u00fclevoolu madalamast piirist (integer underflow) ning muude andmete \u00fclekirjutamist virnas v\u00e4\u00e4rtusega «~0». 64-bitistes s\u00fcsteemides peetakse haavatavuse \u00e4rakasutamist ebat\u00f5en\u00e4oliseks ja see n\u00f5uab virna suuruse piirangute puudumist (ulimit -s unlimited). 32-bitistes s\u00fcsteemides peetakse \u00e4rakasutamist v\u00f5imalikkuseks, kuid tulemus s\u00f5ltub suuresti sellest, kuidas oli k\u00e4ivitatav fail koostatud kompilaatori poolt.<\/p>\n

R\u00fcnnaku sooritamiseks peab r\u00fcndaja andmeid teatud viisil kahjustama ext2, ext3 v\u00f5i ext4 failis\u00fcsteemi osas. Kuna see operatsioon n\u00f5uab superkasutaja privileege, kujutab see haavatavus ohtu, kui e2fsck utiliit kontrollib v\u00e4listel andmekandjatel v\u00f5i v\u00e4ljastpoolt saadud failis\u00fcsteemi pilte.<\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0443\u0442\u0438\u043b\u0438\u0442\u0435 e2fsck, \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0439 \u0432 \u0441\u043e\u0441\u0442\u0430\u0432\u0435 \u043f\u0430\u043a\u0435\u0442\u0430 e2fsprogs, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2019-5188), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430 \u043f\u0440\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0435\u0439 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0435 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0438. \u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u043e \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 \u0441 1.43.3 \u043f\u043e 1.45.4. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438 e2fsck 1.45.5. \u0412 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u043e\u043a\u0430 \u043e\u0441\u0442\u0430\u0451\u0442\u0441\u044f \u043d\u0435\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u043e\u0439 (Debian, Arch Linux, SUSE\/openSUSE, Ubuntu, RHEL). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u0437\u0432\u0430\u043d\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-55016","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Haavatavus e2fsck-s, mis ilmneb spetsiaalselt kujundatud kataloogide t\u00f6\u00f6tlemisel | ProHoster","description":"T\u00f6\u00f6riistas e2fsck, mis on osa pakettidest e2fsprogs,","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-v-e2fsck-proyavlyayushhayasya-pri-obrabotke-spetsialno-oformlennyh-katalogov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 e2fsck, \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u044e\u0449\u0430\u044f\u0441\u044f \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u043e\u0432 | ProHoster","og:description":"\u0412 \u0443\u0442\u0438\u043b\u0438\u0442\u0435 e2fsck, \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0439 \u0432 \u0441\u043e\u0441\u0442\u0430\u0432\u0435 \u043f\u0430\u043a\u0435\u0442\u0430 e2fsprogs,","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-v-e2fsck-proyavlyayushhayasya-pri-obrabotke-spetsialno-oformlennyh-katalogov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-01-09T21:00:00+00:00","article:modified_time":"2020-02-18T11:03:05+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"55016","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 13:31:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:21:08","updated":"2026-01-24 13:31:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/55016","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=55016"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/55016\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=55016"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=55016"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=55016"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}