{"id":53889,"date":"2019-12-12T00:00:00","date_gmt":"2019-12-11T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/uyazvimost-v-ld-so-openbsd"},"modified":"2020-02-18T14:01:50","modified_gmt":"2020-02-18T11:01:50","slug":"uyazvimost-v-ld-so-openbsd","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/news\/uyazvimost-v-ld-so-openbsd","title":{"rendered":"Vulnerabilidade em ld.so OpenBSD","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Loader din\u00e2mico ld.so<\/a><\/noindex>, que faz parte do OpenBSD, pode em determinadas condi\u00e7\u00f5es SUID\/SGID<\/a><\/noindex>-deixar a vari\u00e1vel de ambiente LD_LIBRARY_PATH e assim permitir o carregamento de c\u00f3digo externo no contexto de um processo executado com privil\u00e9gios elevados. Os patches para corrigir a vulnerabilidade est\u00e3o dispon\u00edveis para os lan\u00e7amentos 6.5<\/a><\/noindex> e 6.6<\/a><\/noindex>. Patches bin\u00e1rios (syspatch<\/a><\/noindex>) para as plataformas amd64, i386 e arm64 j\u00e1 foram lan\u00e7ados e devem estar dispon\u00edveis para download no momento da publica\u00e7\u00e3o desta not\u00edcia.<\/p>\n

A ess\u00eancia do problema: durante a execu\u00e7\u00e3o, ld.so primeiro extrai o valor da vari\u00e1vel LD_LIBRARY_PATH do ambiente, utilizando a fun\u00e7\u00e3o _dl_split_path() para convert\u00ea-lo em um array de strings \u2014 os caminhos para os diret\u00f3rios. Se mais tarde for verificado que o processo atual foi iniciado como um aplicativo SUID\/SGID, o array criado e, de fato, a vari\u00e1vel LD_LIBRARY_PATH s\u00e3o limpos. Al\u00e9m disso, se durante a execu\u00e7\u00e3o _dl_split_path() encontrar falta de mem\u00f3ria (o que \u00e9 dif\u00edcil devido a uma limita\u00e7\u00e3o expl\u00edcita no tamanho das vari\u00e1veis de ambiente de 256 kB, mas teoricamente poss\u00edvel), a vari\u00e1vel _dl_libpath receber\u00e1 o valor NULL, e a verifica\u00e7\u00e3o seguinte do valor dessa vari\u00e1vel far\u00e1 com que a chamada _dl_unsetenv(\u2018LD_LIBRARY_PATH\u2019) seja ignorada.<\/p>\n

LD_LIBRARY_PATH\" seja pulada. A vulnerabilidade foi encontrada por especialistas<\/a><\/noindex>Qualys , assim como<\/a><\/noindex> v\u00e1rias outras<\/p>\n

quest\u00f5es reveladas anteriormente. Os pesquisadores de seguran\u00e7a que identificaram a vulnerabilidade notaram a rapidez na resolu\u00e7\u00e3o do problema: um patch foi preparado e as atualiza\u00e7\u00f5es lan\u00e7adas dentro de tr\u00eas horas ap\u00f3s o aviso do projeto OpenBSD. Adicional: O problema recebeu o n\u00famero<\/a><\/noindex>CVE-2019-19726 . Um an\u00fancio oficial foi feito na lista de discuss\u00e3o oss-security,<\/a><\/noindex>incluindo um prot\u00f3tipo de exploit que funciona no OpenBSD 6.6, 6.5, 6.2 e 6.1 em arquiteturas
\namd64 e i386 (o exploit pode ser adaptado para outras arquiteturas).
\n O problema \u00e9 explor\u00e1vel na instala\u00e7\u00e3o padr\u00e3o e permite que um usu\u00e1rio local n\u00e3o privilegiado execute c\u00f3digo com permiss\u00f5es de root atrav\u00e9s da substitui\u00e7\u00e3o de biblioteca ao iniciar utilit\u00e1rios suid como chpass ou passwd. Para criar as condi\u00e7\u00f5es necess\u00e1rias para a explora\u00e7\u00e3o da falta de mem\u00f3ria, utiliza-se a restri\u00e7\u00e3o RLIMIT_DATA atrav\u00e9s de setrlimit.<\/p>\n

<\/a><\/noindex><\/p>\n

Fonte: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0414\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a ld.so, \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0439 \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 OpenBSD, \u043f\u0440\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u043c\u043e\u0436\u0435\u0442 \u0434\u043b\u044f SUID\/SGID-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u043e\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u0443\u044e \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f LD_LIBRARY_PATH \u0438 \u0442\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0439 \u043a\u043e\u0434 \u0432 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u0441 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u043d\u044b\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438. \u041f\u0430\u0442\u0447\u0438 \u0441 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u0434\u043b\u044f \u0440\u0435\u043b\u0438\u0437\u043e\u0432 6.5 \u0438 6.6. \u0411\u0438\u043d\u0430\u0440\u043d\u044b\u0435 \u043f\u0430\u0442\u0447\u0438 (syspatch) \u0434\u043b\u044f \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c amd64, i386 \u0438 arm64 \u0443\u0436\u0435 \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u044b \u0432 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0441\u0442\u0432\u043e \u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-53889","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Vulnerabilidade no ld.so OpenBSD | ProHoster","description":"O loader din\u00e2mico ld.so, que faz parte do OpenBSD, pode em determinadas condi\u00e7\u00f5es","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/uyazvimost-v-ld-so-openbsd","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 ld.so OpenBSD | ProHoster","og:description":"\u0414\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a ld.so, \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0439 \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 OpenBSD, \u043f\u0440\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u043c\u043e\u0436\u0435\u0442 \u0434\u043b\u044f","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/uyazvimost-v-ld-so-openbsd","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-11T21:00:00+00:00","article:modified_time":"2020-02-18T11:01:50+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"53889","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 09:10:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:16:27","updated":"2026-01-24 09:10:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/53889","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=53889"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/53889\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=53889"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=53889"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=53889"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}