{"id":53580,"date":"2019-12-05T00:00:00","date_gmt":"2019-12-04T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/uyazvimosti-v-openbsd-pozvolyayushhie-povysit-privilegii-i-obojti-autentifikatsiyu-v-smtpd-ldapd-i-radiusd"},"modified":"2021-02-01T11:40:32","modified_gmt":"2021-02-01T09:40:32","slug":"uyazvimosti-v-openbsd-pozvolyayushhie-povysit-privilegii-i-obojti-autentifikatsiyu-v-smtpd-ldapd-i-radiusd","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/uyazvimosti-v-openbsd-pozvolyayushhie-povysit-privilegii-i-obojti-autentifikatsiyu-v-smtpd-ldapd-i-radiusd","title":{"rendered":"Vulnerabilit\u00e0 in OpenBSD che consentono di elevare i privilegi e di bypassare l'autenticazione in smtpd, ldapd e radiusd.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Qualys ha messo in luce<\/a><\/noindex> quattro vulnerabilit\u00e0<\/a><\/noindex> In OpenBSD, one of which allows remote connections without authentication to certain network services, while three others can elevate privileges in the system. The Qualys report noted the rapid response of OpenBSD developers \u2014 all issues were risolte<\/a><\/noindex> in OpenBSD 6.5<\/a><\/noindex> e OpenBSD 6.6<\/a><\/noindex> addressed within 40 hours after private notification.<\/p>\n

The remotely exploitable vulnerability is caused by an error in the authentication handler call organization in the libc library, which triggers
\nthe program \/usr\/libexec\/auth\/login_style with arguments passed in the command line. Specifically, when calling login_style with the optional parameter \u2018-s service\u2019, the protocol name can be passed. If the username begins with the character \u2018-\u2019, this name will be processed as an option when launching login_style. Accordingly, if during authentication the username \u2018-schallenge\u2019 or \u2018-schallenge:passwd\u2019 is specified, login_style will interpret the request as a call to use the handler S\/Key<\/a><\/noindex>.<\/p>\n

The issue is that the S\/Key protocol in login_style is only supported formally and is in fact ignored when indicating a successful authentication. Thus, an attacker can, posing as the user \u2018-schallenge\u2019, bypass authentication and gain access without providing a password or keys. All network services that use standard libc calls for authentication are potentially vulnerable. For example, the ability to bypass authentication has been confirmed in smtpd (AUTH PLAIN), ldapd, and radiusd.<\/p>\n

In sshd, the vulnerability does not manifest as it has additional protection by verifying the user's presence in the system. Nevertheless, sshd can be used to check the system's vulnerability \u2014 when accessing with the username \u2018-sresponse:passwd\u2019, the connection hangs as sshd waits for the return parameters (challenge) from login_passwd, while login_passwd awaits the provision of the missing parameters (the name \u2018-sresponse\u2019 is perceived as an option). A potential local attacker might attempt to bypass authentication in the su utility, but providing the name \u2018-sresponse\u2019 leads to a crash due to the return of a null pointer during the execution of the getpwnam_r(\u2018-schallenge\u2019, \u2026) function.<\/p>\n

Altre vulnerabilit\u00e0:<\/p>\n