{"id":102257,"date":"2021-11-09T21:36:46","date_gmt":"2021-11-09T19:36:46","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/analiz-bezopasnosti-paketa-busybox-vyyavil-14-nesushhestvennyh-uyazvimostej"},"modified":"2021-11-09T21:36:46","modified_gmt":"2021-11-09T19:36:46","slug":"analiz-bezopasnosti-paketa-busybox-vyyavil-14-nesushhestvennyh-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/analiz-bezopasnosti-paketa-busybox-vyyavil-14-nesushhestvennyh-uyazvimostej","title":{"rendered":"Analiza de securitate a pachetului BusyBox a identificat 14 vulnerabilit\u0103\u021bi minore.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Cercet\u0103torii de la companiile Claroty \u0219i JFrog au publicat rezultatele auditului de securitate al pachetului BusyBox, utilizat pe scar\u0103 larg\u0103 \u00een dispozitivele \u00eencorporate \u0219i care ofer\u0103 un set standard de utilitare UNIX, grupate \u00eentr-un singur fi\u0219ier executabil. \u00cen timpul verific\u0103rii, au fost identificate 14 vulnerabilit\u0103\u021bi, care au fost deja remediate \u00een versiunea BusyBox 1.34 din august. Aproape toate problemele sunt considerate inofensive \u0219i discutabile din punct de vedere al aplicabilit\u0103\u021bii \u00een atacuri reale, deoarece necesit\u0103 executarea utilitarelor cu argumente primite din exterior. <\/p>\n

Se eviden\u021biaz\u0103 \u00een mod special vulnerabilitatea CVE-2021-42374, care permite inducerea unei interdic\u021bii de serviciu (DoS) \u00een procesarea unui fi\u0219ier comprimat special format de utilitarul unlzma, iar \u00een cazul unei construc\u021bii cu op\u021biunea CONFIG_FEATURE_SEAMLESS_LZMA, de asemenea cu orice alte componente BusyBox, inclusiv tar, unzip, rpm, dpkg, lzma \u0219i man. <\/p>\n

Vulnerabilit\u0103\u021bile CVE-2021-42373, CVE-2021-42375, CVE-2021-42376 \u0219i CVE-2021-42377 permit inducerea unei interdic\u021bii de serviciu, dar necesit\u0103 executarea utilitarelor man, ash \u0219i hush cu parametrii stabili\u021bi de atacator. Vulnerabilit\u0103\u021bile de la CVE-2021-42378 la CVE-2021-42386 afecteaz\u0103 utilitarul awk \u0219i pot conduce la execu\u021bia de cod, dar pentru aceasta atacatorul trebuie s\u0103 ob\u021bin\u0103 executarea \u00een awk a unui anumit model (este necesar s\u0103 se execute awk cu transmiterea unui prim argument de linie de comand\u0103 de date primite de la atacator). <\/p>\n

De asemenea, se poate remarca vulnerabilitatea (CVE-2021-43523) \u00een bibliotecile uclibc \u0219i uclibc-ng, legat\u0103 de faptul c\u0103, \u00een timpul apel\u0103rii func\u021biilor gethostbyname(), getaddrinfo(), gethostbyaddr() \u0219i getnameinfo(), nu se efectueaz\u0103 verificarea \u0219i cur\u0103\u021barea numelui de domeniu returnat de serverul DNS. De exemplu, ca r\u0103spuns la o anumit\u0103 solicitare de rezolvare, un server DNS controlat de un atacator poate returna adrese de tip «<script>alert(‘xss’)<\\\/script>.attacker.com» \u0219i acestea vor fi returnate nemodificate oric\u0103rei aplica\u021bii care, f\u0103r\u0103 cur\u0103\u021bare, le poate afi\u0219a \u00een interfa\u021ba sa web. Problema a fost rezolvat\u0103 \u00een versiunea uclibc-ng 1.0.39 prin ad\u0103ugarea de cod pentru a verifica corectitudinea celor returnate. nume de domeniu<\/a>, implementat dup\u0103 modelul Glibc.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 Claroty \u0438 JFrog \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u0443\u0434\u0438\u0442\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043f\u0430\u043a\u0435\u0442\u0430 BusyBox, \u0448\u0438\u0440\u043e\u043a\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0433\u043e \u0432\u043e \u0432\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 \u0438 \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u044e\u0449\u0435\u0433\u043e \u043d\u0430\u0431\u043e\u0440 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0445 \u0443\u0442\u0438\u043b\u0438\u0442 UNIX, \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u0432 \u0432\u0438\u0434\u0435 \u0435\u0434\u0438\u043d\u043e\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430. \u0412 \u0445\u043e\u0434\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 14 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0443\u0436\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0432 \u0430\u0432\u0433\u0443\u0441\u0442\u043e\u0432\u0441\u043a\u043e\u043c \u0432\u044b\u043f\u0443\u0441\u043a\u0435 BusyBox 1.34. \u041f\u043e\u0447\u0442\u0438 \u0432\u0441\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043d\u0435\u043e\u043f\u0430\u0441\u043d\u044b \u0438 \u0441\u043e\u043c\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b \u0441 \u0442\u043e\u0447\u043a\u0438 \u0437\u0440\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102257","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Analiza de securitate a pachetului BusyBox a identificat 14 vulnerabilit\u0103\u021bi nesemnificative | ProHoster","description":"Cercet\u0103torii de la companiile Claroty \u0219i JFrog au publicat rezultatele auditului de securitate al pachetului BusyBox, utilizat pe scar\u0103 larg\u0103 \u00een dispozitivele \u00eencorporate \u0219i care ofer\u0103 un set standard de utilitare UNIX, grupate \u00eentr-un singur fi\u0219ier executabil.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/analiz-bezopasnosti-paketa-busybox-vyyavil-14-nesushhestvennyh-uyazvimostej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u043d\u0430\u043b\u0438\u0437 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043f\u0430\u043a\u0435\u0442\u0430 BusyBox \u0432\u044b\u044f\u0432\u0438\u043b 14 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 Claroty \u0438 JFrog \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u0443\u0434\u0438\u0442\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043f\u0430\u043a\u0435\u0442\u0430 BusyBox, \u0448\u0438\u0440\u043e\u043a\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0433\u043e \u0432\u043e \u0432\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 \u0438 \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u044e\u0449\u0435\u0433\u043e \u043d\u0430\u0431\u043e\u0440 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0445 \u0443\u0442\u0438\u043b\u0438\u0442 UNIX, \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u0432 \u0432\u0438\u0434\u0435.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/analiz-bezopasnosti-paketa-busybox-vyyavil-14-nesushhestvennyh-uyazvimostej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-11-09T19:36:46+00:00","article:modified_time":"2021-11-09T19:36:46+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102257","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-11-09 19:37:47","updated":"2026-02-08 20:56:14","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/102257","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=102257"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/102257\/revisions"}],"predecessor-version":[{"id":158106,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/102257\/revisions\/158106"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=102257"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=102257"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=102257"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}