{"id":112136,"date":"2023-12-11T15:10:27","date_gmt":"2023-12-11T13:10:27","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-buildroot-pozvolyayushhie-cherez-mitm-ataku-vypolnit-kod-na-sborochnom-servere"},"modified":"2023-12-11T15:10:27","modified_gmt":"2023-12-11T13:10:27","slug":"uyazvimosti-v-buildroot-pozvolyayushhie-cherez-mitm-ataku-vypolnit-kod-na-sborochnom-servere","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/news\/uyazvimosti-v-buildroot-pozvolyayushhie-cherez-mitm-ataku-vypolnit-kod-na-sborochnom-servere","title":{"rendered":"Ranljivosti u Buildrootu koje omogu\u0107uju izvr\u0161enje koda na serveru za izgradnju putem MITM napada","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

U sustavu izrade Buildroot, usmjerenom na stvaranje pokreta\u010dkih Linux okru\u017eenja za ugra\u0111ene sustave, otkrivene su \u0161est ranjivosti koje omogu\u0107uju, tijekom presretanja prolaznog prometa (MITM), izmjene generiranih sistemskih slika ili provo\u0111enje koda na razini sustava izrade. Ranjivosti su ispravljene u izdanjima Buildroot 2023.02.8, 2023.08.4 i 2023.11. <\/p>\n

Prvih pet ranjivosti (CVE-2023-45841, CVE-2023-45842, CVE-2023-45838, CVE-2023-45839, CVE-2023-45840) odnose se na kod provjere cjelovitosti paketa prema he\u0161ovima. Problemi se svode na mogu\u0107nost kori\u0161tenja HTTP-a za preuzimanje datoteka i nedostatak provjernih hash-datoteka za neke pakete, \u0161to omogu\u0107uje izmjenu sadr\u017eaja tih paketa, s mogu\u0107no\u0161\u0107u upadanja u promet izrade. poslu\u017eitelja<\/a> (na primjer, kada se korisnik povezuje putem be\u017ei\u010dne mre\u017ee koju kontrolira napada\u010d). <\/p>\n

Naime, paketi aufs i aufs-util preuzimani su putem HTTP-a i nisu provjeravani po hash-ovima. Hash-ovi su tako\u0111er nedostajali za pakete riscv64-elf-toolchain, versal-firmware i mxsldr, koji su se po zadanim postavkama preuzimali putem HTTPS-a, ali su u slu\u010daju problema prebacivani na preuzimanje bez \u0161ifriranja s hosta http:\/\/sources.buildroot.net. U nedostatku datoteka \".hash\" alat Buildroot smatrao je provjeru uspje\u0161nom i obra\u0111ivao preuzete pakete, uklju\u010duju\u0107i primjenu zakrpa unutar paketa i pokretanje scripts za izgradnju. Imaju\u0107i mogu\u0107nost zamjene preuzetih paketa, napada\u010d je mogao dodati vlastite zakrpe ili datoteke Makefiles, \u0161to je omogu\u0107ilo izmjene u kona\u010dnom imid\u017eu ili skriptama sustava za izgradnju i izvr\u0161avanje vlastitog koda. <\/p>\n

\u0160esta ranjivost (CVE-2023-43608) uzrokovana je gre\u0161kom u implementaciji funkcionalnosti BR_NO_CHECK_HASH_FOR, koja omogu\u0107uje isklju\u010divanje provjere cjelovitosti prema he\u0161ovima za odabrane pakete. Neki paketi, poput Linux jezgre, U-Boot i versal-firmware, dopu\u0161tali su preuzimanje najnovijih verzija za koje jo\u0161 nisu formirani provjerni he\u0161evi. Za te verzije kori\u0161tena je opcija BR_NO_CHECK_HASH_FOR, koja isklju\u010duje provjeru prema he\u0161u. Podaci su preuzimani putem HTTPS-a, ali je po defaultu, u slu\u010daju neuspjeha preuzimanja, kori\u0161teno vra\u0107anje na pristup source.buildroot.net bez \u0161ifriranja putem protokola http:\/\/. Napada\u010d bi tijekom MITM napada mogao blokirati vezu s HTTPS serverom i tada bi se preuzimanje vra\u0107alo na http:\/\/sources.buildroot.net.
\n
Izvor: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0441\u0431\u043e\u0440\u043a\u0438 Buildroot, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u0447\u043d\u044b\u0445 Linux-\u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u0439 \u0434\u043b\u044f \u0432\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0448\u0435\u0441\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u0432 \u0445\u043e\u0434\u0435 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0430 \u0442\u0440\u0430\u043d\u0437\u0438\u0442\u043d\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430 (MITM) \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u043d\u0435\u0441\u0435\u043d\u0438\u044f \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0432 \u0433\u0435\u043d\u0435\u0440\u0438\u0440\u0443\u0435\u043c\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0435 \u043e\u0431\u0440\u0430\u0437\u044b \u0438\u043b\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u0441\u0431\u043e\u0440\u043e\u0447\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 Buildroot 2023.02.8, 2023.08.4 \u0438 2023.11. \u041f\u0435\u0440\u0432\u044b\u0435 \u043f\u044f\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2023-45841, CVE-2023-45842, CVE-2023-45838, CVE-2023-45839, CVE-2023-45840) \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0442 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-112136","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Ranjivosti u Buildrootu koje omogu\u0107uju izvr\u0161avanje koda na poslu\u017eitelju za izgradnju putem MITM napada | ProHoster","description":"U Buildroot sustavu za izradu, koji je usmjeren na kreiranje pokreta\u010dkih Linux okru\u017eenja za ugra\u0111ene sustave, otkrivene su \u0161est ranjivosti koje omogu\u0107uju izvr\u0161avanje koda tijekom presretanja tranzitnog prometa (MITM).","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/news\/uyazvimosti-v-buildroot-pozvolyayushhie-cherez-mitm-ataku-vypolnit-kod-na-sborochnom-servere","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Buildroot, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u0447\u0435\u0440\u0435\u0437 MITM-\u0430\u0442\u0430\u043a\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0441\u0431\u043e\u0440\u043e\u0447\u043d\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 | ProHoster","og:description":"\u0412 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0441\u0431\u043e\u0440\u043a\u0438 Buildroot, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u0447\u043d\u044b\u0445 Linux-\u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u0439 \u0434\u043b\u044f \u0432\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0448\u0435\u0441\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u0432 \u0445\u043e\u0434\u0435 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0430 \u0442\u0440\u0430\u043d\u0437\u0438\u0442\u043d\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430 (MITM) \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u043d\u0435\u0441\u0435\u043d\u0438\u044f.","og:url":"https:\/\/prohoster.info\/hr\/blog\/news\/uyazvimosti-v-buildroot-pozvolyayushhie-cherez-mitm-ataku-vypolnit-kod-na-sborochnom-servere","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-12-11T13:10:27+00:00","article:modified_time":"2023-12-11T13:10:27+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"112136","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-22 15:30:24","updated":"2026-02-22 15:30:24","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/112136","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=112136"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/112136\/revisions"}],"predecessor-version":[{"id":162262,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/112136\/revisions\/162262"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=112136"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=112136"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=112136"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}