{"id":105107,"date":"2022-09-16T03:36:41","date_gmt":"2022-09-16T01:36:41","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-polzovatelskom-okruzhenii-enlightenment-pozvolyayushhaya-poluchit-prava-root"},"modified":"2022-09-16T03:36:41","modified_gmt":"2022-09-16T01:36:41","slug":"uyazvimost-v-polzovatelskom-okruzhenii-enlightenment-pozvolyayushhaya-poluchit-prava-root","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/uyazvimost-v-polzovatelskom-okruzhenii-enlightenment-pozvolyayushhaya-poluchit-prava-root","title":{"rendered":"Vuln\u00e9rabilit\u00e9 dans l'environnement utilisateur Enlightenment, permettant d'obtenir des droits root","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Une vuln\u00e9rabilit\u00e9 (CVE-2022-37706) a \u00e9t\u00e9 identifi\u00e9e dans l'environnement utilisateur Enlightenment, permettant \u00e0 un utilisateur local non privil\u00e9gi\u00e9 d'ex\u00e9cuter du code avec des droits root. La vuln\u00e9rabilit\u00e9 n'est pas encore corrig\u00e9e (0-day), mais un exploit test\u00e9 sur Ubuntu 22.04 est d\u00e9j\u00e0 disponible publiquement. <\/p>\n

Le probl\u00e8me r\u00e9side dans le fichier ex\u00e9cutable enlightenment_sys, livr\u00e9 avec l'indicateur suid root et ex\u00e9cutant via un appel system() certaines commandes autoris\u00e9es, telles que le montage de p\u00e9riph\u00e9riques avec l'outil mount. En raison d'une mauvaise gestion de la fonction qui forme la cha\u00eene transmise \u00e0 l'appel system(), les guillemets des arguments de la commande ex\u00e9cut\u00e9e sont supprim\u00e9s, ce qui peut \u00eatre exploit\u00e9 pour ex\u00e9cuter son propre code. Par exemple, lors de l'ex\u00e9cution de mkdir -p \/tmp\/net mkdir -p \u00ab \/tmp\/;\/tmp\/exploit \u00bb echo \u00ab \/bin\/sh \u00bb > \/tmp\/exploit chmod a+x \/tmp\/exploit enlightenment_sys \/bin\/mount -o noexec,nosuid,utf8,nodev,iocharset=utf8,utf8=0,utf8=1,uid=$(id -u), \u00ab \/dev\/..;\/tmp\/exploit \u00bb \/tmp\/\/\/net <\/p>\n

En raison de la suppression des guillemets doubles, au lieu de la commande sp\u00e9cifi\u00e9e \u2018\/bin\/mount \u2026 \u00ab \/dev\/..;\/tmp\/exploit \u00bb \/tmp\/\/\/net\u2019, la cha\u00eene sans les guillemets doubles \u2018\/bin\/mount \u2026 \/dev\/..;\/tmp\/exploit \/tmp\/\/\/net\u2019 sera transmise \u00e0 la fonction system(), ce qui conduira \u00e0 l'ex\u00e9cution s\u00e9par\u00e9e de la commande \u2018\/tmp\/exploit \/tmp\/\/\/net\u2019 au lieu de l'interpr\u00e9ter comme une partie du chemin du p\u00e9riph\u00e9rique. Les cha\u00eenes \u00ab \/dev\/.. \u00bb et \u00ab \/tmp\/\/\/net \u00bb sont choisies pour contourner la v\u00e9rification des arguments de la commande mount dans enlightenment_sys (le p\u00e9riph\u00e9rique de montage doit commencer par \/dev\/ et pointer vers un fichier existant, et les trois caract\u00e8res \u00ab \/ \u00bb dans le point de montage sont sp\u00e9cifi\u00e9s pour atteindre la taille de chemin requise).
\n
Source : opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u043c \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u0438 Enlightenment \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-37706), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u043a\u0430 \u043d\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 (0-day), \u043d\u043e \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435 \u0443\u0436\u0435 \u0438\u043c\u0435\u0435\u0442\u0441\u044f \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442, \u043f\u0440\u043e\u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0432 Ubuntu 22.04. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u043e\u043c \u0444\u0430\u0439\u043b\u0435 enlightenment_sys, \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u043c \u0441 \u0444\u043b\u0430\u0433\u043e\u043c suid root \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u044e\u0449\u0435\u043c \u0447\u0435\u0440\u0435\u0437 \u0432\u044b\u0437\u043e\u0432 system() \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u0435 \u0440\u0430\u0437\u0440\u0435\u0448\u0451\u043d\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b, \u0442\u0430\u043a\u0438\u0435 \u043a\u0430\u043a \u043c\u043e\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043d\u0430\u043a\u043e\u043f\u0438\u0442\u0435\u043b\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-105107","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vuln\u00e9rabilit\u00e9 dans l'environnement utilisateur Enlightenment, permettant d'obtenir des droits root | ProHoster","description":"Une vuln\u00e9rabilit\u00e9 (CVE-2022-37706) a \u00e9t\u00e9 identifi\u00e9e dans l'environnement utilisateur Enlightenment, permettant \u00e0 un utilisateur local non privil\u00e9gi\u00e9 d'ex\u00e9cuter du code avec des droits root.","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/uyazvimost-v-polzovatelskom-okruzhenii-enlightenment-pozvolyayushhaya-poluchit-prava-root","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u043c \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u0438 Enlightenment, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root | ProHoster","og:description":"\u0412 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u043c \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u0438 Enlightenment \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-37706), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root.","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/uyazvimost-v-polzovatelskom-okruzhenii-enlightenment-pozvolyayushhaya-poluchit-prava-root","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-09-16T01:36:41+00:00","article:modified_time":"2022-09-16T01:36:41+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/105107","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=105107"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/105107\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=105107"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=105107"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=105107"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}