{"id":53580,"date":"2019-12-05T00:00:00","date_gmt":"2019-12-04T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/uyazvimosti-v-openbsd-pozvolyayushhie-povysit-privilegii-i-obojti-autentifikatsiyu-v-smtpd-ldapd-i-radiusd"},"modified":"2021-02-01T11:40:32","modified_gmt":"2021-02-01T09:40:32","slug":"uyazvimosti-v-openbsd-pozvolyayushhie-povysit-privilegii-i-obojti-autentifikatsiyu-v-smtpd-ldapd-i-radiusd","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/news\/uyazvimosti-v-openbsd-pozvolyayushhie-povysit-privilegii-i-obojti-autentifikatsiyu-v-smtpd-ldapd-i-radiusd","title":{"rendered":"Ranjivosti u OpenBSD-u koje omogu\u0107uju eskalaciju privilegija i zaobila\u017eenje autentikacije u smtpd, ldapd i radiusd","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Tvrtka Qualys <noindex><a rel=\"nofollow\" href=\"https:\/\/blog.qualys.com\/laws-of-vulnerabilities\/2019\/12\/04\/openbsd-multiple-authentication-vulnerabilities\">otkrila<\/a><\/noindex> \u010detiri <noindex><a rel=\"nofollow\" href=\"https:\/\/www.qualys.com\/2019\/12\/04\/cve-2019-19521\/authentication-vulnerabilities-openbsd.txt\">ranjivosti<\/a><\/noindex> U OpenBSD-u postoji jedna ranjivost koja omogu\u0107uje udaljeni pristup bez autentifikacije nekim mre\u017enim uslugama, dok tri druge omogu\u0107uju povi\u0161enje privilegija u sustavu. U izvje\u0161\u0107u Qualys istaknuta je brza reakcija programera OpenBSD-a \u2014 svi problemi su rije\u0161eni. <noindex><a rel=\"nofollow\" href=\"https:\/\/www.openbsd.org\/errata66.html\">ispravljene su<\/a><\/noindex> u <noindex><a rel=\"nofollow\" href=\"https:\/\/www.openbsd.org\/errata65.html\">OpenBSD 6.5<\/a><\/noindex> i <noindex><a rel=\"nofollow\" href=\"https:\/\/www.openbsd.org\/errata66.html\">OpenBSD 6.6<\/a><\/noindex> tijekom 40 sati nakon privatnog obavje\u0161tenja.<\/p>\n<p>Daljinski iskori\u0161tavana ranjivost nastaje zbog gre\u0161ke u organizaciji poziva autentifikacijskog obrtnika u knji\u017enici libc, koja poziva<br \/>\nProgram \/usr\/libexec\/auth\/login_style podr\u017eava proslje\u0111ivanje argumenata putem naredbenog retka. Prilikom pozivanja login_style uz pomo\u0107 opcijskog parametra \"-s service\" dopu\u0161teno je proslijediti naziv protokola. Ako se u ime korisnika na po\u010detku koristi znak \"-\", to ime \u0107e biti obra\u0111eno kao opcija prilikom pokretanja login_style-a. Stoga, ako se prilikom autentifikacije koristi ime korisnika \"-schallenge\" ili \"-schallenge:passwd\", login_style \u0107e to protuma\u010diti kao zahtjev za kori\u0161tenje obrade. <noindex><a rel=\"nofollow\" href=\"https:\/\/ru.wikipedia.org\/wiki\/S\/Key\">S\/Kl\u0458u\u010d<\/a><\/noindex>.<\/p>\n<p>Problem je u tome \u0161to se protokol S\/Key u login_style-u podr\u017eava samo formalno, dok se zapravo ignorira prilikom prikaza oznake uspje\u0161ne autentifikacije. Na taj na\u010din, napada\u010d se mo\u017ee predstaviti kao korisnik \"-schallenge\" kako bi zaobi\u0161ao autentifikaciju i dobio pristup bez navo\u0111enja lozinke ili klju\u010deva. Potencijalno su svi mre\u017eni servisi koji koriste standardne pozive libc za autentifikaciju podlo\u017eni ovoj ranjivosti. Na primjer, mogu\u0107nost zaobila\u017eenja autentifikacije potvr\u0111ena je u smtpd (AUTH PLAIN), ldapd i radiusd.<\/p>\n<p>U sshd-u ranjivost se ne manifestira, jer postoji dodatna za\u0161tita koja provjerava prisutnost korisnika u sustavu. Ipak, sshd se mo\u017ee koristiti za provjeru podlo\u017enosti sustava toj ranjivosti \u2014 kada se obra\u0107a s imenom korisnika \"-sresponse:passwd\", veza se obustavlja jer sshd \u010deka od login_passwd-a povratne parametre poziva (challenge), a login_passwd \u010deka proslijediti nedostaju\u0107e parametre (ime \"-sresponse\" se do\u017eivljava kao opcija). Potencijalno lokalni napada\u010d mo\u017ee poku\u0161ati zaobi\u0107i autentifikaciju unutar alata su, ali proslje\u0111ivanje imena \"-sresponse\" dovodi do ru\u0161enja procesa zbog povratka nul-lokatora prilikom izvo\u0111enja funkcije getpwnam_r(\"-schallenge\", ...).<\/p>\n<p>Ostale ranjivosti:<\/p>\n<ul>\n<li class=\"l\">  CVE-2019-19520 \u2014 lokalno pove\u0107anje privilegija putem manipulacije alatom xlock, koji se isporu\u010duje s vlagom sgid, mijenjaju\u0107i grupu u \u201eauth\u201c. U kodu xlock, redefinirano putanje do biblioteka se zabranjuje samo pri promjeni korisni\u010dkog identifikatora (setuid), \u0161to napada\u010du omogu\u0107uje promjenu varijable okru\u017eenja \u201eLIBGL_DRIVERS_PATH\u201c i organiziranje u\u010ditavanja svoje dijeljene biblioteke, \u010diji \u0107e se kod izvr\u0161iti nakon pove\u0107anja privilegija do grupe \u201eauth\u201c.<\/li>\n<li class=\"l\"> CVE-2019-19522 \u2014 omogu\u0107uje lokalnom korisniku, koji je \u010dlan grupe \u201eauth\u201c, da pokrene kod s root pravima prilikom uklju\u010divanja u sustemu autentifikacije putem S\/Key ili YubiKey (po defaultu nisu aktivni). Pripadnost grupi \u201eauth\u201c, kojoj se mo\u017ee pristupiti kroz eksploataciju prethodno navedene ranjivosti u xlock, omogu\u0107uje zapisivanje datoteka u direktorije \/etc\/skey i \/var\/db\/yubikey. Na primjer, napada\u010d mo\u017ee dodati novu datoteku \/etc\/skey\/root za generiranje jednokratnih klju\u010deva za autentifikaciju pod korisni\u010dkim imenom root putem S\/Key.<\/li>\n<li class=\"l\"> CVE-2019-19519 \u2014 mogu\u0107nost pove\u0107anja limita na resursima putem manipulacije alatom su. Kada se koristi opcija \u201e-L\u201c, koja podrazumijeva cikli\u010dno ponavljanje poku\u0161aja autentifikacije u slu\u010daju neuspjeha, klasa korisnika se postavlja samo jednom i ne resetira se u sljede\u0107im poku\u0161ajima. Napada\u010d mo\u017ee izvr\u0161iti \u201esu -l -L\u201c i pri prvom poku\u0161aju unijeti tu\u0111e korisni\u010dko ime s drugom klasom ra\u010duna, ali pri drugom poku\u0161aju uspje\u0161no se autentificirati pod svojim imenom. U ovoj situaciji korisniku \u0107e biti postavljeni limiti koji odgovaraju klasi korisnika navedene pri prvom poku\u0161aju (na primjer, maksimalan broj procesa ili veli\u010dina memorije za proces). Ova metoda funkcionira samo za posu\u0111ivanje limita od nepovla\u0161tenih korisnika, jer za korisnika root je potrebna pripadnost grupi wheel).<\/li>\n<\/ul>\n<p>Dodatno se mo\u017ee istaknuti <noindex><a rel=\"nofollow\" href=\"http:\/\/undeadly.org\/cgi?action=article;sid=20191202105849\">implementacija<\/a><\/noindex> u OpenBSD novog metoda provjere valjanosti pristupanja sistemskim pozivima, dodatno ote\u017eavaju\u0107i iskori\u0161tavanje ranjivosti. Metod dopu\u0161ta izvr\u0161enje sistemskih poziva samo ako se obra\u0107aju iz prethodno registriranih podru\u010dja memorije. Za ozna\u010davanje podru\u010dja memorije <noindex><a rel=\"nofollow\" href=\"https:\/\/marc.info\/?l=openbsd-cvs&amp;m=157500930922882&amp;w=2\">predlo\u017een<\/a><\/noindex> novi sistemski poziv <noindex><a rel=\"nofollow\" href=\"https:\/\/man.openbsd.org\/msyscall\">msyscall()<\/a><\/noindex>.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Izvor: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=51979\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0447\u0435\u0442\u044b\u0440\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 OpenBSD, \u043e\u0434\u043d\u0430 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043a \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u043c \u0441\u0435\u0442\u0435\u0432\u044b\u043c \u0441\u0435\u0440\u0432\u0438\u0441\u0430\u043c, \u0430 \u0442\u0440\u0438 \u043e\u0441\u0442\u0430\u043b\u044c\u043d\u044b\u0435 \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u0412 \u043e\u0442\u0447\u0451\u0442\u0435 Qualys \u043e\u0442\u043c\u0435\u0447\u0435\u043d\u0430 \u0431\u044b\u0441\u0442\u0440\u0430\u044f \u0440\u0435\u0430\u043a\u0446\u0438\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 OpenBSD &#8212; \u0432\u0441\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0431\u044b\u043b\u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0432 OpenBSD 6.5 \u0438 OpenBSD 6.6 \u0432 \u0442\u0435\u0447\u0435\u043d\u0438\u0435 40 \u0447\u0430\u0441\u043e\u0432 \u043f\u043e\u0441\u043b\u0435 \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u043e\u0433\u043e \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u044f. \u0423\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0430\u044f [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-53580","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0447\u0435\u0442\u044b\u0440\u0435\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/hr\/blog\/news\/uyazvimosti-v-openbsd-pozvolyayushhie-povysit-privilegii-i-obojti-autentifikatsiyu-v-smtpd-ldapd-i-radiusd\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"hr_HR\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 OpenBSD, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0438 \u043e\u0431\u043e\u0439\u0442\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0432 smtpd, ldapd \u0438 radiusd | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0447\u0435\u0442\u044b\u0440\u0435\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/hr\/blog\/news\/uyazvimosti-v-openbsd-pozvolyayushhie-povysit-privilegii-i-obojti-autentifikatsiyu-v-smtpd-ldapd-i-radiusd\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-12-04T21:00:00+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2021-02-01T09:40:32+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ranjivosti u OpenBSD koje omogu\u0107uju podizanje privilegija i zaobila\u017eenje autentikacije u smtpd, ldapd i radiusd | ProHoster","description":"Tvrtka Qualys je otkrila \u010detiri","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/news\/uyazvimosti-v-openbsd-pozvolyayushhie-povysit-privilegii-i-obojti-autentifikatsiyu-v-smtpd-ldapd-i-radiusd","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 OpenBSD, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0438 \u043e\u0431\u043e\u0439\u0442\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0432 smtpd, ldapd \u0438 radiusd | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0447\u0435\u0442\u044b\u0440\u0435","og:url":"https:\/\/prohoster.info\/hr\/blog\/news\/uyazvimosti-v-openbsd-pozvolyayushhie-povysit-privilegii-i-obojti-autentifikatsiyu-v-smtpd-ldapd-i-radiusd","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-04T21:00:00+00:00","article:modified_time":"2021-02-01T09:40:32+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"53580","title":null,"description":"","keywords":"","keyphrases":null,"primary_term":null,"canonical_url":"","og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 07:57:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:22:50","updated":"2026-01-24 07:57:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/53580","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=53580"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/53580\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=53580"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=53580"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=53580"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}