{"id":93156,"date":"2020-09-03T19:42:00","date_gmt":"2020-09-03T17:42:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-skanerah-bezopasnosti-obrazov-docker-kontejnerov"},"modified":"2020-09-03T19:42:00","modified_gmt":"2020-09-03T17:42:00","slug":"uyazvimosti-v-skanerah-bezopasnosti-obrazov-docker-kontejnerov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-v-skanerah-bezopasnosti-obrazov-docker-kontejnerov","title":{"rendered":"Haavatavused Docker-konteinerite turvaskannerites","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Avaldatud<\/a><\/noindex> Testitulemused nende t\u00f6\u00f6riistade toimimiseks, et tuvastada parandamata haavatavusi ja turvaprobleeme Docker'i isolatesitud konteinerite piltides. Kontrollimine n\u00e4itas, et 4 6 tuntud Docker'i pildiskannerist sisaldas kriitilisi haavatavusi, mis v\u00f5imaldasid r\u00fcnnata skannerit ennast ja saavutada koodi t\u00e4itmine s\u00fcsteemis, m\u00f5nel juhul (n\u00e4iteks Snyki kasutamisel) root-\u00f5igustes. <\/p>\n

R\u00fcndamiseks piisab r\u00fcndajast, kes algatab oma Dockerfile v\u00f5i manifest.json-i kontrollimise, mis sisaldab spetsiaalselt vormindatud \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0435, v\u00f5i paigutab pildisse failid Podfile ja gradlew. Eksploitide protot\u00fc\u00fcbid \u00f5nnestus ette valmistada<\/a><\/noindex> s\u00fcsteemidele
\nWhiteSource<\/a><\/noindex>, Snyk<\/a><\/noindex>,
\nFossa<\/a><\/noindex> ja
\nAnchore<\/a><\/noindex>. Parim turvalisus n\u00e4itas pakett Clair<\/a><\/noindex>, mis on algselt kirjutatud turvalisuse tagamise suunaga. Probleeme ei tuvastatud ka paketis Trivy<\/a><\/noindex>. Kokkuv\u00f5ttes on j\u00f5utud j\u00e4reldusele, et Docker'i konteinerite skannereid tuleks k\u00e4ivitada isoleeritud keskkondades v\u00f5i kasutada ainult oma piltide kontrollimiseks ning olla ettevaatlik nende t\u00f6\u00f6riistade liitmisel automatiseeritud pideva integreerimise s\u00fcsteemidega.<\/p>\n

FOSSA, Snyk ja WhiteSource'is seondus haavatavus v\u00e4list pakihalduri kasutamisse s\u00f5ltuvuste m\u00e4\u00e4ratlemiseks, mis v\u00f5imaldas koodi k\u00e4ivitada, kui faile, kus on k\u00e4sud touch ja system, oli m\u00e4\u00e4ratud. gradlew<\/a><\/noindex> ja Podfile<\/a><\/noindex>.<\/p>\n

Snyk ja WhiteSource leidis lisaks tugevuse s\u00fcsteemsete k\u00e4skude k\u00e4ivitamiseks Dockerfile'i anal\u00fc\u00fcsi k\u00e4igus (n\u00e4iteks Snyk'is saab Dockerfile kaudu asendada utiliidi \/bin\/ls, mida skanner kutsub, ning WhiteSource'is saab argumendina sisestada koodi vormis \"echo \u2018;touch \/tmp\/hacked_whitesource_pip;=1.0\u2018\").<\/a><\/noindex> haavatavusest<\/a><\/noindex>, mis on seotud<\/a><\/noindex> s\u00fcsteemsete k\u00e4skude k\u00e4ivitamise korraldamine Dockerfile'i anal\u00fc\u00fcsimisel (n\u00e4iteks Snyk'is sai Dockerfile'is asendada skanneri kutsutud utiliidi \"\/bin\/ls\", samas kui WhiteSource'i puhul sai koodi sisestada argumendina kujul \u201eecho \u2018;touch \/tmp\/hacked_whitesource_pip;=1.0\u2018\u201d). <\/p>\n

oli p\u00f5hjustatud utiliidi<\/a><\/noindex> skopeo kasutamisest docker-piltide t\u00f6\u00f6tlemisel. Ekspluateerimine piirnes manifest.json faili lisamisega parameetritega nagu '\"os\": \"$(touch hacked_anchore)\"', mis osutuvad skopeo kutse ajal korrektselt j\u00e4tmata (k\u00f5igepealt eemaldati ainult s\u00fcmbolid \";&<>\", samas kui konstruktsioon \"$()\" oli lubatud).<\/a><\/noindex> docker-piltide t\u00f6\u00f6tlemiseks. Kasutamine piirdus manifest.json faili lisamisega parameetritega nagu \u2018\"os\": \"$(touch hacked_anchore)\"\u2019, mida sisestati skopeo kutsumisel ilma n\u00f5uetekohase escape'imiseta (v\u00e4lja l\u00f5igatud olid vaid s\u00fcmbolid \u2018;;<>\u2019, kuid konstruktsioon \u2018$( )\u2019 oli lubatud).<\/p>\n

Sama autor on uurinud docker-konteinerite turvaskannerite vigade tuvastamise t\u00f5husust ja valeh\u00e4irete taset (osa 1<\/a><\/noindex>, osa 2<\/a><\/noindex>, osa 3<\/a><\/noindex>). Allpool on test results for 73 images containing known vulnerabilities, as well as an assessment of the effectiveness of identifying typical applications in the images (nginx, tomcat, haproxy, gunicorn, redis, ruby, node).<\/p>\n

\"Haavatavused<\/a><\/noindex><\/center><\/p>\n

\"Haavatavused<\/a><\/noindex><\/center><\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0434\u043b\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u043d\u0435\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e \u0432 \u043e\u0431\u0440\u0430\u0437\u0430\u0445 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 Docker. \u041f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u0430, \u0447\u0442\u043e \u0432 4 \u0438\u0437 6 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0445 \u0441\u043a\u0430\u043d\u0435\u0440\u043e\u0432 \u043e\u0431\u0440\u0430\u0437\u043e\u0432 Docker \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u043e\u0432\u0430\u043b\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u0442\u044c \u043d\u0435\u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u0441\u0430\u043c \u0441\u043a\u0430\u043d\u0435\u0440 \u0438 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0432 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u0441\u043b\u0443\u0447\u0430\u044f\u0445 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 Snyk) \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root. \u0414\u043b\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":93157,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-93156","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilities in Docker container image security scanners | ProHoster","description":"Avalikustatud on t\u00f6\u00f6riistade testimise tulemused m\u00e4\u00e4ratlemiseks.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-v-skanerah-bezopasnosti-obrazov-docker-kontejnerov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0441\u043a\u0430\u043d\u0435\u0440\u0430\u0445 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043e\u0431\u0440\u0430\u0437\u043e\u0432 Docker-\u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0434\u043b\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-v-skanerah-bezopasnosti-obrazov-docker-kontejnerov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-09-03T17:42:00+00:00","article:modified_time":"2020-09-03T17:42:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"93156","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 11:54:00","updated":"2022-10-01 01:38:05","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/93156","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=93156"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/93156\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/93157"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=93156"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=93156"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=93156"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}