{"id":92097,"date":"2020-08-22T19:42:16","date_gmt":"2020-08-22T17:42:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-chrony"},"modified":"2020-08-22T19:42:16","modified_gmt":"2020-08-22T17:42:16","slug":"uyazvimost-v-chrony","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/uyazvimost-v-chrony","title":{"rendered":"Vuln\u00e9rabilit\u00e9 dans chrony","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Dans chrony<\/a><\/noindex>, impl\u00e9mentation du protocole NTP, utilis\u00e9 pour synchroniser le temps pr\u00e9cis dans diverses distributions Linux, une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 identifi\u00e9e<\/a><\/noindex> une vuln\u00e9rabilit\u00e9 (CVE-2020-14367<\/a><\/noindex>), permettant de remplacer n'importe quel fichier dans le syst\u00e8me avec un acc\u00e8s \u00e0 un utilisateur non privil\u00e9gi\u00e9 local chrony. La vuln\u00e9rabilit\u00e9 ne peut \u00eatre exploit\u00e9e que par l'utilisateur chrony, ce qui r\u00e9duit son danger. Cependant, le probl\u00e8me compromet le niveau d'isolation dans chrony et peut \u00eatre utilis\u00e9 en cas de d\u00e9couverte d'une autre vuln\u00e9rabilit\u00e9 dans le code ex\u00e9cut\u00e9 apr\u00e8s la restauration des privil\u00e8ges.<\/p>\n

La vuln\u00e9rabilit\u00e9 est caus\u00e9e par la cr\u00e9ation non s\u00e9curis\u00e9e d'un fichier pid, qui \u00e9tait cr\u00e9\u00e9 \u00e0 un moment o\u00f9 chrony n'avait pas encore r\u00e9voqu\u00e9 ses privil\u00e8ges et s'ex\u00e9cute avec les droits root. Le r\u00e9pertoire \/run\/chrony, dans lequel le fichier pid est enregistr\u00e9, a \u00e9t\u00e9 cr\u00e9\u00e9 avec les droits 0750 via systemd-tmpfiles ou lors du d\u00e9marrage de chronyd li\u00e9 \u00e0 l'utilisateur et au groupe \u00ab chrony \u00bb. Ainsi, en cas d'acc\u00e8s \u00e0 l'utilisateur chrony, il est possible de remplacer le fichier pid \/run\/chrony\/chronyd.pid par un lien symbolique. Ce lien symbolique peut pointer vers n'importe quel fichier syst\u00e8me qui sera \u00e9cras\u00e9 au moment du d\u00e9marrage de chronyd.<\/p>\n

root# systemctl stop chronyd.service
\n root# sudo -u chrony \/bin\/bash<\/p>\n

chrony$ cd \/run\/chrony
\n chrony$ ln -s \/etc\/shadow chronyd.pid
\n chrony$ exit<\/p>\n

root# \/usr\/sbin\/chronyd -n
\n ^C
\n # \u0432\u043c\u0435\u0441\u0442\u043e \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \/etc\/shadow \u0431\u0443\u0434\u0435\u0442 \u0441\u043e\u0445\u0440\u0430\u043d\u0451\u043d \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 chronyd
\n root# cat \/etc\/shadow
\n 15287<\/p>\n

Vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 corrig\u00e9e<\/a><\/noindex> dans la version chrony 3.5.1<\/a><\/noindex>. Des mises \u00e0 jour des paquets corrigeant la vuln\u00e9rabilit\u00e9 sont disponibles pour Fedora<\/a><\/noindex>. Dans le cadre des pr\u00e9parations de mise \u00e0 jour pour RHEL<\/a><\/noindex>, Debian<\/a><\/noindex> et Ubuntu<\/a><\/noindex>.<\/p>\n

SUSE et openSUSE, le probl\u00e8me n'est pas soumis<\/a><\/noindex>, car le lien symbolique pour chrony est cr\u00e9\u00e9 directement dans le r\u00e9pertoire \/run, sans utiliser de sous-r\u00e9pertoires suppl\u00e9mentaires. <\/p>\n

<\/a><\/noindex><\/p>\n

Source : opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 chrony, \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 NTP, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0439 \u0434\u043b\u044f \u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0442\u043e\u0447\u043d\u043e\u0433\u043e \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 Linux, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-14367), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0430\u0442\u044c \u043b\u044e\u0431\u043e\u0439 \u0444\u0430\u0439\u043b \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0438\u043c\u0435\u044f \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e chrony. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0442\u043e\u043b\u044c\u043a\u043e \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f chrony, \u0447\u0442\u043e \u0441\u043d\u0438\u0436\u0430\u0435\u0442 \u0435\u0451 \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c. \u0422\u0435\u043c \u043d\u0435 \u043c\u0435\u043d\u0435\u0435, \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u0443\u0435\u0442 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 \u0432 chrony \u0438 \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-92097","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Vuln\u00e9rabilit\u00e9 dans chrony | ProHoster","description":"Dans chrony, impl\u00e9mentation du protocole NTP, utilis\u00e9 pour synchroniser le temps pr\u00e9cis dans diverses distributions Linux,","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/uyazvimost-v-chrony","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 chrony | ProHoster","og:description":"\u0412 chrony, \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 NTP, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0439 \u0434\u043b\u044f \u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0442\u043e\u0447\u043d\u043e\u0433\u043e \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 Linux,","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/uyazvimost-v-chrony","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-08-22T17:42:16+00:00","article:modified_time":"2020-08-22T17:42:16+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"92097","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:15:35","updated":"2022-10-02 06:51:32","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/92097","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=92097"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/92097\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=92097"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=92097"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=92097"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}