{"id":53577,"date":"2019-12-05T00:00:00","date_gmt":"2019-12-04T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/mnozhestvennye-uyazvimosti-v-openbsd"},"modified":"2020-02-18T14:01:30","modified_gmt":"2020-02-18T11:01:30","slug":"mnozhestvennye-uyazvimosti-v-openbsd","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pl\/blog\/news\/mnozhestvennye-uyazvimosti-v-openbsd","title":{"rendered":"Wielokrotne podatno\u015bci w OpenBSD","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Specjali\u015bci z Qualys Labs odkryli kilka problem\u00f3w z bezpiecze\u0144stwem zwi\u0105zanych z mo\u017cliwo\u015bci\u0105 oszukania program\u00f3w odpowiedzialnych za wykorzystywane w BSD mechanizmy weryfikacji hase\u0142 (analogiczne do PAM). Oszustwo polega na przekazaniu nazwy u\u017cytkownika «-schallenge» lub «-schallenge:passwd», kt\u00f3ra nast\u0119pnie jest interpretowana nie jako nazwa u\u017cytkownika, ale jako opcja. Po tym system akceptuje ka\u017cde has\u0142o. Wra\u017cliwe, tzn. dopuszczaj\u0105ce ostatecznie nieautoryzowany dost\u0119p, s\u0105 us\u0142ugi smtpd, ldapd, radiusd. Us\u0142uga sshd nie mo\u017ce zosta\u0107 wykorzystana, poniewa\u017c sshd zauwa\u017ca, \u017ce u\u017cytkownik «-schallenge» w rzeczywisto\u015bci nie istnieje. Program su przy pr\u00f3bie oszustwa w spos\u00f3b bezpo\u015bredni ko\u0144czy dzia\u0142anie, poniewa\u017c r\u00f3wnie\u017c pr\u00f3buje ustali\u0107 uid nieistniej\u0105cego u\u017cytkownika.<\/p>\n

Og\u0142oszono r\u00f3wnie\u017c r\u00f3\u017cnorodne podatno\u015bci w xlock, w autoryzacji przez S\/Klucz i Yubikey, a tak\u017ce w su, nie zwi\u0105zane z okre\u015bleniem u\u017cytkownika «-schallenge». Podatno\u015b\u0107 w xlock pozwala zwyk\u0142emu u\u017cytkownikowi podnie\u015b\u0107 uprawnienia do grupy auth. Poprzez niew\u0142a\u015bciwe dzia\u0142anie mechanizm\u00f3w autoryzacji za pomoc\u0105 S\/Klucz i Yubikey mo\u017cna podnie\u015b\u0107 uprawnienia z grupy auth do u\u017cytkownika root, ale w konfiguracji OpenBSD domy\u015blnie to nie dzia\u0142a, poniewa\u017c autoryzacja przez S\/Klucz i Yubikey jest wy\u0142\u0105czona. Wreszcie, podatno\u015b\u0107 w su pozwala u\u017cytkownikowi zwi\u0119kszy\u0107 limity na zasoby systemowe, takie jak liczba otwartych deskryptor\u00f3w plik\u00f3w.<\/p>\n

W tej chwili luki zosta\u0142y usuni\u0119te, aktualizacje zabezpiecze\u0144 s\u0105 dost\u0119pne poprzez standardowy mechanizm syspatch(8).<\/p>\n

\u0179r\u00f3d\u0142o: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0421\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u0438\u0437 Qualys Labs \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c\u044e \u043e\u0431\u043c\u0430\u043d\u0443\u0442\u044c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b, \u043e\u0442\u0432\u0435\u0447\u0430\u044e\u0449\u0438\u0435 \u0437\u0430 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0435 \u0432 BSD \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u044b \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u0430\u0440\u043e\u043b\u0435\u0439 (\u0430\u043d\u0430\u043b\u043e\u0433 PAM). \u041e\u0431\u043c\u0430\u043d \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u0432 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0435 \u0438\u043c\u0435\u043d\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f «-schallenge» \u0438\u043b\u0438 «-schallenge:passwd», \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0437\u0430\u0442\u0435\u043c \u0438\u043d\u0442\u0435\u0440\u043f\u0440\u0435\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043d\u0435 \u043a\u0430\u043a \u0438\u043c\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0430 \u043a\u0430\u043a \u043e\u043f\u0446\u0438\u044f. \u041f\u043e\u0441\u043b\u0435 \u044d\u0442\u043e\u0433\u043e \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u043b\u044e\u0431\u043e\u0439 \u043f\u0430\u0440\u043e\u043b\u044c. \u0423\u044f\u0437\u0432\u0438\u043c\u044b, \u0442.\u0435. \u0440\u0430\u0437\u0440\u0435\u0448\u0430\u044e\u0442 \u0432 \u0438\u0442\u043e\u0433\u0435 \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-53577","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Wielokrotne luki w OpenBSD | ProHoster","description":"Specjali\u015bci z Qualys Labs odkryli kilka problem\u00f3w bezpiecze\u0144stwa zwi\u0105zanych z mo\u017cliwo\u015bci\u0105 oszukania program\u00f3w odpowiedzialnych za stosowane w BSD mechanizmy weryfikacji hase\u0142 (odpowiednik PAM).","canonical_url":"https:\/\/prohoster.info\/pl\/blog\/news\/mnozhestvennye-uyazvimosti-v-openbsd","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pl_PL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 OpenBSD | ProHoster","og:description":"\u0421\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u0438\u0437 Qualys Labs \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c\u044e \u043e\u0431\u043c\u0430\u043d\u0443\u0442\u044c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b, \u043e\u0442\u0432\u0435\u0447\u0430\u044e\u0449\u0438\u0435 \u0437\u0430 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0435 \u0432 BSD \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u044b \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u0430\u0440\u043e\u043b\u0435\u0439 (\u0430\u043d\u0430\u043b\u043e\u0433 PAM).","og:url":"https:\/\/prohoster.info\/pl\/blog\/news\/mnozhestvennye-uyazvimosti-v-openbsd","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-04T21:00:00+00:00","article:modified_time":"2020-02-18T11:01:30+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"53577","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 07:55:22","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:22:50","updated":"2026-01-24 07:55:22","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/53577","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/comments?post=53577"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/53577\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media?parent=53577"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/categories?post=53577"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/tags?post=53577"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}