chiwopsezo cha sudo chokhudza Linux Mint ndi Elementary OS

Mu zothandiza sudo, amagwiritsidwa ntchito pokonzekera kuchitidwa kwa malamulo m'malo mwa ogwiritsa ntchito ena, kudziwika kusatetezeka (CVE-2019-18634), zomwe zimakupatsani mwayi wowonjezera mwayi wanu mudongosolo kwa wogwiritsa ntchito mizu. Vuto limangowonekera kuyambira kutulutsidwa kwa sudo 1.7.1 mukamagwiritsa ntchito njira ya "pwfeedback" mu fayilo ya / etc/sudoers, yomwe imayimitsidwa mwachisawawa koma imathandizidwa pazigawo zina monga Linux Mint ndi Elementary OS. Nkhani yokhazikika pakumasulidwa wachikondi 1.8.31, lofalitsidwa maola angapo apitawo. Chiwopsezocho sichinakhazikike m'magawo ogawa.

Njira ya "pwfeedback" imathandizira kuwonetsa "*" munthu aliyense atalowa polemba mawu achinsinsi. Chifukwa cha zolakwa Pokhazikitsa getln() ntchito, yofotokozedwa mu fayilo ya tgetpass.c, chingwe chachikulu kwambiri chachinsinsi chomwe chimadutsa pamtsinje wamba (stdin) pansi pazikhalidwe zina sichingagwirizane ndi buffer yomwe yaperekedwa ndikulembanso deta ina pa stack. Kusefukira kumachitika mukamagwiritsa ntchito sudo code ngati mizu.

Chofunikira pavutoli ndikuti mukamagwiritsa ntchito zilembo zapadera ^U (kuchotsa mizere) panthawi yolowetsamo komanso ngati kulemba sikulephera, nambala yomwe imayang'anira kuchotsa zilembo "*" imakhazikitsanso deta pa kukula kwa buffer yomwe ilipo, koma sichitha. bweretsani cholozera pamtengo woyambira pomwe pano mu buffer. Chinanso chomwe chimathandizira kuti mazunzowa awonongeke ndi kusowa kwa kuyimitsa njira ya "pwfeedback" pomwe deta ifika osati kuchokera ku terminal, koma kudzera mumtsinje wolowera (cholakwika ichi chimalola kuti pakhale zovuta zojambulira, mwachitsanzo, pamakina omwe ali ndi vuto lojambulira. unidirectional mayendedwe osatchulidwa mayina cholakwika chimachitika poyesa kulemba mpaka kumapeto kwa njira yowerengera).

Popeza wowukirayo ali ndi mphamvu zonse pakulemba zambiri pa stack, sikovuta kupanga mwayi womwe umamupangitsa kuti achulukitse mwayi wake. Vutoli litha kugwiritsidwa ntchito ndi wogwiritsa ntchito aliyense, mosasamala kanthu za zilolezo za sudo kapena zosintha za ogwiritsa ntchito mu sudoers. Kuti mulepheretse vutoli, muyenera kuwonetsetsa kuti palibe "pwfeedback" mu /etc/sudoers ndipo, ngati kuli kofunikira, kuyimitsa ("Defaults !pwfeedback"). Kuti muwone ngati pali vuto, mutha kuyendetsa nambalayi:

$ perl -e 'sindikiza(("A" x 100 . "\x{00}") x 50)' | sudo -S id
Achinsinsi: Kulakwitsa kwa magawo

Source: opennet.ru