Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 identifi\u00e9e dans le syst\u00e8me d'initialisation finit (CVE-2025-29906), permettant de se connecter au syst\u00e8me en tant qu'utilisateur quelconque sans v\u00e9rification du mot de passe. L'exploitation de cette vuln\u00e9rabilit\u00e9 se fait par manipulation de l'invite de connexion et n\u00e9cessite un acc\u00e8s \u00e0 la console. La vuln\u00e9rabilit\u00e9 appara\u00eet \u00e0 partir de la version 3.0 (octobre 2017) et a \u00e9t\u00e9 corrig\u00e9e dans la version finit 4.11. La version 4.12 a ensuite \u00e9t\u00e9 publi\u00e9e, corrigeant un d\u00e9bordement de tampon dans le plugin urandom, qui n'est pas consid\u00e9r\u00e9 comme une vuln\u00e9rabilit\u00e9. <\/p>\n
La vuln\u00e9rabilit\u00e9 concerne l'impl\u00e9mentation du programme getty, qui affiche une invite de connexion dans le terminal et lance le processus \/bin\/login pour l'authentification de l'utilisateur. La vuln\u00e9rabilit\u00e9 est due \u00e0 l'absence de s\u00e9paration des arguments en ligne de commande lors du lancement de \/bin\/login, ce qui permettait de sp\u00e9cifier l'option \u00ab -f \u00bb dans le nom d'utilisateur, d\u00e9sactivant ainsi la v\u00e9rification du mot de passe (par exemple, il est possible d'entrer \u00ab -f root \u00bb au lieu de \u00ab root \u00bb). Le probl\u00e8me a \u00e9t\u00e9 r\u00e9solu en ajoutant l'argument \u00ab -- \u00bb avant le champ du nom d'utilisateur : -- execl(_PATH_LOGIN, _PATH_LOGIN, \u00ab -p \u00bb, name, NULL); + execl(_PATH_LOGIN, _PATH_LOGIN, \u00ab -p \u00bb, \u00ab -- \u00bb, name, NULL); <\/p>\n
Comme solution de contournement pour bloquer la vuln\u00e9rabilit\u00e9, il est recommand\u00e9 d'utiliser dans finit une impl\u00e9mentation externe du processus getty, comme agetty. Dans les distributions Debian 12, Ubuntu, Parrot, Raspbian et Trisquel, les paquets contenant finit restent pour l'instant sans correction de la vuln\u00e9rabilit\u00e9. <\/p>\n
Le syst\u00e8me d'initialisation Finit (Fast init) se d\u00e9veloppe comme une alternative simple \u00e0 SysV init et systemd, et a gagn\u00e9 en popularit\u00e9 dans les syst\u00e8mes int\u00e9gr\u00e9s. Le projet est bas\u00e9 sur les technologies du syst\u00e8me d'initialisation fastinit, utilis\u00e9 dans le firmware Linux des netbooks EeePC, notable pour son processus de d\u00e9marrage tr\u00e8s rapide. Finit prend en charge les niveaux d'ex\u00e9cution (runlevel) de style SysV init, le red\u00e9marrage automatique des services en cas d'\u00e9chec, l'ex\u00e9cution de gestionnaires temporaires, le d\u00e9marrage de services en tenant compte des d\u00e9pendances et des conditions arbitraires, l'attachement de gestionnaires suppl\u00e9mentaires pour le d\u00e9clenchement avant ou apr\u00e8s l'ex\u00e9cution d'un service, l'extension des fonctionnalit\u00e9s via des plugins, et la configuration des restrictions via Cgroups v2. \u0412 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0438\u043d\u0438\u0446\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 finit \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-29906), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u043e\u0439\u0442\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u043f\u043e\u0434 \u043b\u044e\u0431\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u0431\u0435\u0437 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u0430\u0440\u043e\u043b\u044f. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u044e \u0441 \u043f\u0440\u0438\u0433\u043b\u0430\u0448\u0435\u043d\u0438\u0435\u043c \u0432\u0445\u043e\u0434\u0430 (login) \u0438 \u0442\u0440\u0435\u0431\u0443\u0435\u0442 \u043d\u0430\u043b\u0438\u0447\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043a\u043e\u043d\u0441\u043e\u043b\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u0435\u0440\u0441\u0438\u0438 3.0 (\u043e\u043a\u0442\u044f\u0431\u0440\u044c 2017 \u0433\u043e\u0434\u0430) \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0435 finit 4.11. \u0421\u043b\u0435\u0434\u043e\u043c \u0443\u0436\u0435 \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a 4.12 \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-123909","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vuln\u00e9rabilit\u00e9 dans le syst\u00e8me d'initialisation finit, permettant de se connecter au syst\u00e8me sans mot de passe | ProHoster","description":"Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 identifi\u00e9e dans le syst\u00e8me d'initialisation finit (CVE-2025-29906), permettant de se connecter au syst\u00e8me en tant qu'utilisateur quelconque sans v\u00e9rification du mot de passe.","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/uyazvimost-v-sisteme-iniczializaczii-finit-pozvolyayushhaya-vojti-v-sistemu-bez-parolya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0438\u043d\u0438\u0446\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 finit, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u043e\u0439\u0442\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0431\u0435\u0437 \u043f\u0430\u0440\u043e\u043b\u044f | ProHoster","og:description":"\u0412 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0438\u043d\u0438\u0446\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 finit \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-29906), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u043e\u0439\u0442\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u043f\u043e\u0434 \u043b\u044e\u0431\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u0431\u0435\u0437 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u0430\u0440\u043e\u043b\u044f.","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/uyazvimost-v-sisteme-iniczializaczii-finit-pozvolyayushhaya-vojti-v-sistemu-bez-parolya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-05-01T13:05:06+00:00","article:modified_time":"2025-05-01T13:05:06+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"123909","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 12:36:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 12:36:19","updated":"2026-01-23 12:36:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/123909","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=123909"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/123909\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=123909"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=123909"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=123909"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Source : opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"