{"id":53889,"date":"2019-12-12T00:00:00","date_gmt":"2019-12-11T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/uyazvimost-v-ld-so-openbsd"},"modified":"2020-02-18T14:01:50","modified_gmt":"2020-02-18T11:01:50","slug":"uyazvimost-v-ld-so-openbsd","status":"publish","type":"post","link":"https:\/\/prohoster.info\/lv\/blog\/news\/uyazvimost-v-ld-so-openbsd","title":{"rendered":"Vainojam\u012bba ld.so OpenBSD","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Dinamisks iel\u0101d\u0113t\u0101js ld.so<\/a><\/noindex>, kas ir da\u013ca no OpenBSD, noteiktos apst\u0101k\u013cos var SUID\/SGID<\/a><\/noindex>-lietojumprogramm\u0101m atst\u0101t vides main\u012bgo LD_LIBRARY_PATH un t\u0101d\u0113j\u0101di \u013caut iel\u0101d\u0113t tre\u0161o pu\u0161u kodu procesa kontekst\u0101, kas tiek izpild\u012bts ar palielin\u0101t\u0101m privil\u0113\u0123ij\u0101m. Ievainojam\u012bbas labojumu pl\u0101ksteri ir pieejami izlaidumiem 6.5<\/a><\/noindex> un 6.6<\/a><\/noindex>. Bin\u0101rie pl\u0101ksteri (syspatch<\/a><\/noindex>) platform\u0101m amd64, i386 un arm64 jau ir palaisti ra\u017eo\u0161an\u0101 un tiem j\u0101b\u016bt pieejamiem lejupiel\u0101dei, kad tiks public\u0113tas \u0161\u012bs zi\u0146as.<\/p>\n

Probl\u0113mas b\u016bt\u012bba: ld.so darba laik\u0101 vispirms izvelk no vides LD_LIBRARY_PATH main\u012bg\u0101 v\u0113rt\u012bbu, izmantojot funkciju _dl_split_path(), un p\u0101rv\u0113r\u0161 to mas\u012bv\u0101 ar virk\u0146u - katalogu ce\u013ciem. Ja v\u0113l\u0101k noskaidrojas, ka pa\u0161reiz\u0113jais process ir palaists SUID\/SGID lietojumprogramm\u0101, izveidotais mas\u012bvs un pati LD_LIBRARY_PATH main\u012bg\u0101 tiek not\u012br\u012btas. Ja _dl_split_path() laik\u0101 rodas atmi\u0146as tr\u016bkums (kas ir gr\u016bti sakar\u0101 ar ac\u012bmredzamo ierobe\u017eojumu uz vidi main\u012bgo izm\u0113ru 256 kB, bet teor\u0113tiski iesp\u0113jams), tad _dl_libpath main\u012bgais sa\u0146ems NULL v\u0113rt\u012bbu, un turpm\u0101kais \u0161\u012bs main\u012bg\u0101s v\u0113rt\u012bbas p\u0101rbaude nov\u0113rs\u012bs _dl_unsetenv('LD_LIBRARY_PATH') izsauk\u0161anu.<\/p>\n

Ievainojam\u012bbu atkl\u0101ju\u0161i speci\u0101listi Qualys<\/a><\/noindex>, k\u0101 ar\u012b da\u017eas iepriek\u0161 atkl\u0101t\u0101s<\/a><\/noindex> probl\u0113mas. Ievainojam\u012bbu atkl\u0101ju\u0161ie dro\u0161\u012bbas p\u0113tnieki nor\u0101d\u012bja uz probl\u0113mas risin\u0101\u0161anas \u0101trumu: pl\u0101ksters tika sagatavots, un atjaunin\u0101jumi izlaisti tr\u012bs stundu laik\u0101 p\u0113c br\u012bdin\u0101juma sa\u0146em\u0161anas no OpenBSD projekta.<\/p>\n

Papildin\u0101jums: probl\u0113mai pie\u0161\u0137irts numurs CVE-2019-19726<\/a><\/noindex>. Osa dro\u0161\u012bbas sarakst\u0101 ir veikts ofici\u0101ls pazi\u0146ojums<\/a><\/noindex>, kas ietver eksplu\u0101tras prototipu, kas darbojas OpenBSD 6.6, 6.5, 6.2 un 6.1 arhitekt\u016br\u0101s
\namd64 un i386 (eksplu\u0101tra var tikt piel\u0101gota ar\u012b cit\u0101m arhitekt\u016br\u0101m).
\n Probl\u0113ma ir ekspluat\u0113jama noklus\u0113juma instal\u0101cij\u0101 un \u013cauj nep\u0101rvald\u012btam viet\u0113j\u0101m lietot\u0101jiem izpild\u012bt kodu ar root ties\u012bb\u0101m, izmantojot bibliot\u0113kas aizvieto\u0161anu, kad tiek palaistas suid util\u012btas chpass vai passwd. Lai rad\u012btu nepiecie\u0161amos apst\u0101k\u013cus ekspluat\u0101cijai, izmanto atmi\u0146as ierobe\u017eojumu RLIMIT_DATA, izmantojot setrlimit.<\/p>\n

<\/a><\/noindex><\/p>\n

Avots: opennet.lv<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0414\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a ld.so, \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0439 \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 OpenBSD, \u043f\u0440\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u043c\u043e\u0436\u0435\u0442 \u0434\u043b\u044f SUID\/SGID-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u043e\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u0443\u044e \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f LD_LIBRARY_PATH \u0438 \u0442\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0439 \u043a\u043e\u0434 \u0432 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u0441 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u043d\u044b\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438. \u041f\u0430\u0442\u0447\u0438 \u0441 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u0434\u043b\u044f \u0440\u0435\u043b\u0438\u0437\u043e\u0432 6.5 \u0438 6.6. \u0411\u0438\u043d\u0430\u0440\u043d\u044b\u0435 \u043f\u0430\u0442\u0447\u0438 (syspatch) \u0434\u043b\u044f \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c amd64, i386 \u0438 arm64 \u0443\u0436\u0435 \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u044b \u0432 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0441\u0442\u0432\u043e \u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-53889","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ievainojam\u012bba ld.so OpenBSD | ProHoster","description":"Dinamisks iel\u0101d\u0113t\u0101js ld.so, kas ir da\u013ca no OpenBSD, noteiktos apst\u0101k\u013cos var","canonical_url":"https:\/\/prohoster.info\/lv\/blog\/news\/uyazvimost-v-ld-so-openbsd","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"lv_LV","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 ld.so OpenBSD | ProHoster","og:description":"\u0414\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a ld.so, \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0439 \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 OpenBSD, \u043f\u0440\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u043c\u043e\u0436\u0435\u0442 \u0434\u043b\u044f","og:url":"https:\/\/prohoster.info\/lv\/blog\/news\/uyazvimost-v-ld-so-openbsd","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-11T21:00:00+00:00","article:modified_time":"2020-02-18T11:01:50+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"53889","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 09:10:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:16:27","updated":"2026-01-24 09:10:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/53889","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/comments?post=53889"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/53889\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/media?parent=53889"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/categories?post=53889"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/tags?post=53889"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}