O vulnerabilitate a fost identificat\u0103 \u00een sistemul de ini\u021bializare finit (CVE-2025-29906), permi\u021b\u00e2nd accesul \u00een sistem ca orice utilizator f\u0103r\u0103 verificarea parolei. Exploatarea vulnerabilit\u0103\u021bii se realizeaz\u0103 prin manipularea promptului de autentificare (login) \u0219i necesit\u0103 acces la consol\u0103. Vulnerabilitatea este prezent\u0103 \u00eencep\u00e2nd cu versiunea 3.0 (octombrie 2017) \u0219i a fost remediat\u0103 \u00een versiunea finit 4.11. De asemenea, a fost lansat\u0103 versiunea 4.12, care remediaz\u0103 o dep\u0103\u0219ire a buffer-ului \u00een plugin-ul urandom, care nu este marcat\u0103 ca vulnerabilitate. <\/p>\n
Vulnerabilitatea afecteaz\u0103 implementarea programului getty, care afi\u0219eaz\u0103 promptul de autentificare \u00een terminal \u0219i lanseaz\u0103 procesul \/bin\/login pentru a autentifica utilizatorul. Vulnerabilitatea este cauzat\u0103 de lipsa separ\u0103rii argumentelor din linia de comand\u0103 la lansarea \/bin\/login, ceea ce permitea specificarea op\u021biunii \u00ab-f\u00bb \u00een numele de utilizator, dezactiv\u00e2nd verificarea parolei (de exemplu, se putea introduce \u00ab-f root\u00bb \u00een loc de \u00abroot\u00bb). Problema a fost rezolvat\u0103 prin ad\u0103ugarea argumentului \u00ab--\u00bb \u00eenainte de c\u00e2mpul cu numele de utilizator: execl(_PATH_LOGIN, _PATH_LOGIN, \u00ab-p\u00bb, name, NULL); + execl(_PATH_LOGIN, _PATH_LOGIN, \u00ab-p\u00bb, \u00ab--\u00bb, name, NULL); <\/p>\n
Ca solu\u021bie alternativ\u0103 pentru blocarea vulnerabilit\u0103\u021bii, se recomand\u0103 utilizarea \u00een finit a unei implement\u0103ri externe a procesului getty, de exemplu, agetty. \u00cen distribu\u021biile Debian 12, Ubuntu, Parrot, Raspbian \u0219i Trisquel, pachetele care con\u021bin finit r\u0103m\u00e2n deocamdat\u0103 necorectate pentru vulnerabilitate. <\/p>\n
Sistemul de ini\u021bializare Finit (Fast init) se dezvolt\u0103 ca o alternativ\u0103 simpl\u0103 la SysV init \u0219i systemd, fiind utilizat pe sisteme integrate. Proiectul se bazeaz\u0103 pe tehnologiile sistemului de ini\u021bializare fastinit, folosit \u00een firmware-ul Linux pentru netbook-uri EeePC \u0219i se remarc\u0103 printr-un proces de \u00eenc\u0103rcare foarte rapid. Finit suport\u0103 niveluri de execu\u021bie (runlevel) \u00een stil SysV init, repornirea automat\u0103 a serviciilor \u00een caz de defectare, executarea handlerelor unice, lansarea serviciilor \u021bin\u00e2nd cont de dependen\u021be \u0219i condi\u021bii arbitrare, ata\u0219area de handleri suplimentari pentru a rula \u00eenainte sau dup\u0103 execu\u021bia serviciului, extinderea func\u021bionalit\u0103\u021bii prin plugin-uri, precum \u0219i configurarea restric\u021biilor prin Cgroups v2. \u0412 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0438\u043d\u0438\u0446\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 finit \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-29906), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u043e\u0439\u0442\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u043f\u043e\u0434 \u043b\u044e\u0431\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u0431\u0435\u0437 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u0430\u0440\u043e\u043b\u044f. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u044e \u0441 \u043f\u0440\u0438\u0433\u043b\u0430\u0448\u0435\u043d\u0438\u0435\u043c \u0432\u0445\u043e\u0434\u0430 (login) \u0438 \u0442\u0440\u0435\u0431\u0443\u0435\u0442 \u043d\u0430\u043b\u0438\u0447\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043a\u043e\u043d\u0441\u043e\u043b\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u0435\u0440\u0441\u0438\u0438 3.0 (\u043e\u043a\u0442\u044f\u0431\u0440\u044c 2017 \u0433\u043e\u0434\u0430) \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0435 finit 4.11. \u0421\u043b\u0435\u0434\u043e\u043c \u0443\u0436\u0435 \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a 4.12 \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-123909","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitate \u00een sistemul de ini\u021bializare finit, permit\u00e2nd accesul \u00een sistem f\u0103r\u0103 parol\u0103 | ProHoster","description":"A fost identificat\u0103 o vulnerabilitate \u00een sistemul de ini\u021bializare finit (CVE-2025-29906), care permite accesul \u00een sistem ca orice utilizator f\u0103r\u0103 a verifica parola.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-sisteme-iniczializaczii-finit-pozvolyayushhaya-vojti-v-sistemu-bez-parolya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0438\u043d\u0438\u0446\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 finit, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u043e\u0439\u0442\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0431\u0435\u0437 \u043f\u0430\u0440\u043e\u043b\u044f | ProHoster","og:description":"\u0412 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0438\u043d\u0438\u0446\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 finit \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-29906), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u043e\u0439\u0442\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u043f\u043e\u0434 \u043b\u044e\u0431\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u0431\u0435\u0437 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u0430\u0440\u043e\u043b\u044f.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-sisteme-iniczializaczii-finit-pozvolyayushhaya-vojti-v-sistemu-bez-parolya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-05-01T13:05:06+00:00","article:modified_time":"2025-05-01T13:05:06+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"123909","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 12:36:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 12:36:19","updated":"2026-01-23 12:36:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/123909","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=123909"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/123909\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=123909"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=123909"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=123909"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"