{"id":53580,"date":"2019-12-05T00:00:00","date_gmt":"2019-12-04T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/uyazvimosti-v-openbsd-pozvolyayushhie-povysit-privilegii-i-obojti-autentifikatsiyu-v-smtpd-ldapd-i-radiusd"},"modified":"2021-02-01T11:40:32","modified_gmt":"2021-02-01T09:40:32","slug":"uyazvimosti-v-openbsd-pozvolyayushhie-povysit-privilegii-i-obojti-autentifikatsiyu-v-smtpd-ldapd-i-radiusd","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/news\/uyazvimosti-v-openbsd-pozvolyayushhie-povysit-privilegii-i-obojti-autentifikatsiyu-v-smtpd-ldapd-i-radiusd","title":{"rendered":"Vulnerabilit\u00e0 in OpenBSD che consentono di elevare i privilegi e bypassare l'autenticazione in smtpd, ldapd e radiusd","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Azienda Qualys ha identificato<\/a><\/noindex> quattro vulnerabilit\u00e0<\/a><\/noindex> In OpenBSD, one of which allows for remote connections without authentication to certain network services, while the other three can elevate their privileges in the system. The Qualys report highlights the swift response of OpenBSD developers \u2014 all issues were risolte<\/a><\/noindex> in OpenBSD 6.5<\/a><\/noindex> e OpenBSD 6.6<\/a><\/noindex> risolti entro 40 ore dalla notifica privata.<\/p>\n

La vulnerabilit\u00e0 sfruttabile da remoto \u00e8 causata da un errore nell'organizzazione della chiamata del gestore di autenticazione nella libreria libc, che chiama
\nthe program \/usr\/libexec\/auth\/login_style with argument passing in the command line. This includes calling login_style with the optional parameter \u00ab-s service\u00bb, which allows passing the protocol name. If a username starts with the character \u00ab-\u00bb, it will be treated as an option when starting login_style. Accordingly, if during authentication the username \u00ab-schallenge\u00bb or \u00ab-schallenge:passwd\u00bb is specified, login_style will interpret the request as a request for the handler S\/Key<\/a><\/noindex>.<\/p>\n

The problem is that the S\/Key protocol in login_style is only supported in theory, and is actually ignored with no indication of successful authentication. Thus, an attacker can, by presenting themselves as the user \u00ab-schallenge\u00bb, bypass authentication and gain access without providing a password or keys. All network services that use standard libc calls for authentication are potentially vulnerable. For instance, the ability to bypass authentication has been confirmed in smtpd (AUTH PLAIN), ldapd, and radiusd.<\/p>\n

In sshd, the vulnerability does not manifest, as it has additional protection by checking for the user's presence in the system. However, sshd can be used to check the system's vulnerability \u2014 when accessed with the username \u00ab-sresponse:passwd\u00bb, the connection hangs, as sshd awaits the return of call parameters (challenge) from login_passwd, while login_passwd waits for the missing parameters to be transmitted (the name \u00ab-sresponse\u00bb is treated as an option). A local attacker may potentially attempt to bypass authentication in the su utility, but passing the name \u00ab-sresponse\u00bb causes the process to crash due to a null pointer being returned when executing the function getpwnam_r(\u00ab-schallenge\u00bb, \u2026).<\/p>\n

Altre vulnerabilit\u00e0:<\/p>\n