{"id":124670,"date":"2025-05-13T03:05:07","date_gmt":"2025-05-13T01:05:07","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-gnu-screen-pozvolyayushhaya-vypolnit-kod-s-pravami-root"},"modified":"2025-05-13T03:05:07","modified_gmt":"2025-05-13T01:05:07","slug":"uyazvimost-v-gnu-screen-pozvolyayushhaya-vypolnit-kod-s-pravami-root","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-gnu-screen-pozvolyayushhaya-vypolnit-kod-s-pravami-root","title":{"rendered":"O vulnerabilitate \u00een GNU screen, care permite executarea codului cu privilegii de root","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>\u00cen managerul de feronerie (multiplexor de terminale) GNU screen, care ofer\u0103 o interfa\u021b\u0103 cu mai multe feronerie \u00een consol\u0103, au fost identificate 5 vulnerabilit\u0103\u021bi. Cea mai periculoas\u0103 problem\u0103 (CVE-2025-23395) permite ob\u021binerea drepturilor de root \u00een sistem. Corectarea este inclus\u0103 \u00een versiunea de ast\u0103zi a screen 5.0.1.      <\/p>\n<p>Vulnerabilitatea CVE-2025-23395 se manifest\u0103 doar \u00een ramura screen 5.0.0, care este livrat\u0103 \u00een Fedora Linux, Arch Linux, NetBSD, OpenBSD \u0219i Alpine. \u00cen Debian, Ubuntu, RHEL (EPEL 9), Gentoo, FreeBSD, SUSE\/openSUSE \u0219i OpenWrt, ramura screen 4.x este \u00een continuare utilizat\u0103. Exploatarea vulnerabilit\u0103\u021bii este posibil\u0103 pe sistemele care instaleaz\u0103 fi\u0219ierul executabil screen cu flagul setuid root, cum ar fi \u00een Arch Linux \u0219i NetBSD. \u00cen Fedora, utilitarul este instalat cu flagul setgid pentru a ob\u021bine drepturile grupului screen, permi\u021b\u00e2nd crearea de socketuri \u00een directorul sistemic \/run\/screen, ceea ce limiteaz\u0103 posibilit\u0103\u021bile de atac prin refuz de serviciu.       <\/p>\n<p>Vulnerabilitatea este cauzat\u0103 de faptul c\u0103, atunci c\u00e2nd este rulat cu drepturi de root, func\u021bia logfile_reopen() se execut\u0103 \u00eenainte de resetarea privilegiilor, dar proceseaz\u0103 datele \u00een contextul directoarelor utilizatorului non-privilegiat care a lansat screen. Este de remarcat c\u0103 deschiderea ini\u021bial\u0103 a logului se face cu resetarea corect\u0103 a privilegiilor, dar la reaprinderea fi\u0219ierului de log, resetarea privilegiilor nu se efectueaz\u0103.    <\/p>\n<p>Prin manipul\u0103rile cu activarea modului de jurnalizare a sesiunii, utilizatorul poate ob\u021bine \u00eenregistrarea datelor \u00eentr-un fi\u0219ier cu permisiuni root, \u00een timp ce fi\u0219ierul poate fi salvat \u00een directorul home al utilizatorului. Atacul const\u0103 \u00een \u0219tergerea fi\u0219ierului de log creat \u0219i \u00eenlocuirea acestuia cu un link simbolic, care indic\u0103 orice fi\u0219ier din sistem. Dac\u0103 fi\u0219ierul exist\u0103 deja, datele con\u021bin\u00e2nd con\u021binutul ecranului din sesiunea screen vor fi ad\u0103ugate f\u0103r\u0103 a se schimba proprietarul. Dac\u0103 fi\u0219ierul nu exist\u0103 \u2014 acesta va fi creat cu permisiuni 0644, proprietar root \u0219i grup ca utilizatorul curent.    <\/p>\n<p>Algoritmul atacului, care creeaz\u0103 fi\u0219ierul \/etc\/profile.d\/exploit.sh cu comanda \u201echown $USER \/root\u201d:  <\/p>\n<ul>\n<li class=\"l\"> Crearea unei sesiuni screen cu activarea jurnaliz\u0103rii       $ screen -Logfile $HOME\/screen.log\n<li class=\"l\"> Ap\u0103sarea combina\u021biei de taste Ctrl-a-H pentru activarea jurnalului.\n<li class=\"l\"> \u0218tergerea fi\u0219ierului de log \u0219i \u00eenlocuirea acestuia cu un link simbolic, ceea ce va determina crearea fi\u0219ierului \/etc\/profile.d\/exploit.sh        $ rm $HOME\/screen.log; ln -s \/etc\/profile.d\/exploit.sh $HOME\/screen.log\n<li class=\"l\"> \u00centoarcerea \u00een sesiunea screen \u0219i afi\u0219area pe ecran a datelor care vor fi \u00eenregistrate \u00een fi\u0219ierul de log.       $ echo -e \u201e\nchown $USER \/root;\u201d\n<li class=\"l\"> Dup\u0103 ce sistemul va fi conectat de un real root, se va rula scriptul \/etc\/profile.d\/exploit.sh, care va schimba proprietarul pentru directorul \/root.       $ ls -lhd \/root     drwxr-x\u2014 5 user root 4.0K Dec 30  2020 .\n<li class=\"l\"> \u00cen mod similar, se pot crea fi\u0219iere de configura\u021bie sudo sau se pot ad\u0103uga comenzi la sf\u00e2r\u0219itul scripturilor sistemului.    <\/ul>\n<p>Vulnerabilit\u0103\u021bi mai pu\u021bin periculoase \u00een screen:  <\/p>\n<ul>\n<li class=\"l\"> CVE-2025-46802 \u2014 interceptarea dispozitivului TTY \u00een sesiunile multi-utilizator (utilizatorul poate ob\u021bine setarea drepturilor crw-rw-rw- pentru dispozitivul \/dev\/pts\/1). Problema apare \u00een versiunile screen 4.x \u0219i 5.x.\n<li class=\"l\"> CVE-2025-46803 \u2014 setarea implicit\u0103 a drepturilor 0622 pentru dispozitivul PTY, permi\u021b\u00e2nd scrierea de c\u0103tre orice utilizator. Problema apare doar \u00een versiunea screen 5.0.\n<li class=\"l\"> CVE-2025-46804 \u2014 scurgerea informa\u021biilor despre existen\u021ba fi\u0219ierelor \u0219i directoarelor \u00een directoare \u00eenchise (indic\u00e2nd un director pentru socket-uri, folosind variabila de mediu SCREENDIR, utilitarul returneaz\u0103 texte de eroare diferite, permi\u021b\u00e2nd deducerea existen\u021bei fi\u0219ierelor \u0219i directoarelor cu acest nume). Problema apare \u00een versiunile screen 4.x \u0219i 5.x.\n<li class=\"l\"> CVE-2025-46805 \u2014 stare de competi\u021bie la trimiterea semnalelor SIGCONT \u0219i SIGHUP, duc\u00e2nd la refuzarea serviciului. Problema apare \u00een versiunile screen 4.x \u0219i 5.x.\n<li class=\"l\"> Utilizare incorect\u0103 a func\u021biei strncpy (\u00eenlocuirea strcpy cu strncpy f\u0103r\u0103 a lua \u00een considerare diferen\u021ba \u00een gestionarea caracterelor nule \u201e\u201d), duc\u00e2nd la \u00eencheierea nea\u0219teptat\u0103 a execu\u021biei la rularea comenzilor special formate. Problema apare doar \u00een versiunea screen 5.0.  <\/ul>\n<p>Vulnerabilit\u0103\u021bile au fost identificate \u00een urma unui audit al codului surs\u0103 GNU screen efectuat de echipa responsabil\u0103 cu securitatea distribu\u021biei SUSE Linux. Informa\u021biile despre vulnerabilitate au fost trimise dezvoltatorilor screen pe 7 februarie, dar \u00een termenul de 90 de zile, ace\u0219tia nu au reu\u0219it s\u0103 preg\u0103teasc\u0103 corec\u021bii pentru toate vulnerabilit\u0103\u021bile, iar angaja\u021bii SUSE au fost nevoi\u021bi s\u0103 dezvolte unele patch-uri pe cont propriu. Cercet\u0103torii care au efectuat auditul consider\u0103 c\u0103 actualii mentenan\u021bi ai GNU screen nu sunt suficient de familiariza\u021bi cu baza de cod a proiectului \u0219i nu pot \u00een\u021belege complet problemele de securitate identificate.<br \/>\n<br \/>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=63226\">opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u043a\u043e\u043d\u0441\u043e\u043b\u044c\u043d\u043e\u043c \u043e\u043a\u043e\u043d\u043d\u043e\u043c \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0435 (\u043c\u0443\u043b\u044c\u0442\u0438\u043f\u043b\u0435\u043a\u0441\u043e\u0440\u0435 \u0442\u0435\u0440\u043c\u0438\u043d\u0430\u043b\u043e\u0432) GNU screen, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u043c \u043c\u043d\u043e\u0433\u043e\u043e\u043a\u043e\u043d\u043d\u044b\u0439 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 \u0432 \u043a\u043e\u043d\u0441\u043e\u043b\u0438, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 5 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \u041d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u043e\u043f\u0430\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 (CVE-2025-23395) \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0432\u044b\u043a\u043b\u044e\u0447\u0435\u043d\u043e \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 \u0441\u0435\u0433\u043e\u0434\u043d\u044f\u0448\u043d\u0435\u0433\u043e \u0432\u044b\u043f\u0443\u0441\u043a\u0430 screen 5.0.1. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2025-23395 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0432\u0435\u0442\u043a\u0435 screen 5.0.0, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 Fedora Linux, Arch Linux, NetBSD, OpenBSD \u0438 Alpine. \u0412 Debian, [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-124670","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u043a\u043e\u043d\u0441\u043e\u043b\u044c\u043d\u043e\u043c \u043e\u043a\u043e\u043d\u043d\u043e\u043c \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0435 (\u043c\u0443\u043b\u044c\u0442\u0438\u043f\u043b\u0435\u043a\u0441\u043e\u0440\u0435 \u0442\u0435\u0440\u043c\u0438\u043d\u0430\u043b\u043e\u0432) GNU screen, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u043c \u043c\u043d\u043e\u0433\u043e\u043e\u043a\u043e\u043d\u043d\u044b\u0439 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 \u0432 \u043a\u043e\u043d\u0441\u043e\u043b\u0438, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 5 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-gnu-screen-pozvolyayushhaya-vypolnit-kod-s-pravami-root\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 GNU screen, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u043a\u043e\u043d\u0441\u043e\u043b\u044c\u043d\u043e\u043c \u043e\u043a\u043e\u043d\u043d\u043e\u043c \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0435 (\u043c\u0443\u043b\u044c\u0442\u0438\u043f\u043b\u0435\u043a\u0441\u043e\u0440\u0435 \u0442\u0435\u0440\u043c\u0438\u043d\u0430\u043b\u043e\u0432) GNU screen, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u043c \u043c\u043d\u043e\u0433\u043e\u043e\u043a\u043e\u043d\u043d\u044b\u0439 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 \u0432 \u043a\u043e\u043d\u0441\u043e\u043b\u0438, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 5 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-gnu-screen-pozvolyayushhaya-vypolnit-kod-s-pravami-root\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2025-05-13T01:05:07+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2025-05-13T01:05:07+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitate \u00een GNU screen care permite execu\u021bia de cod cu drepturi de root | ProHoster","description":"\u00cen managerul de feronier\u0103 (multiplexor de terminale) GNU screen, care ofer\u0103 o interfa\u021b\u0103 multi-fereastr\u0103 \u00een consol\u0103, au fost identificate 5 vulnerabilit\u0103\u021bi.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-gnu-screen-pozvolyayushhaya-vypolnit-kod-s-pravami-root","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 GNU screen, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root | ProHoster","og:description":"\u0412 \u043a\u043e\u043d\u0441\u043e\u043b\u044c\u043d\u043e\u043c \u043e\u043a\u043e\u043d\u043d\u043e\u043c \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0435 (\u043c\u0443\u043b\u044c\u0442\u0438\u043f\u043b\u0435\u043a\u0441\u043e\u0440\u0435 \u0442\u0435\u0440\u043c\u0438\u043d\u0430\u043b\u043e\u0432) GNU screen, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u043c \u043c\u043d\u043e\u0433\u043e\u043e\u043a\u043e\u043d\u043d\u044b\u0439 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 \u0432 \u043a\u043e\u043d\u0441\u043e\u043b\u0438, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 5 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-gnu-screen-pozvolyayushhaya-vypolnit-kod-s-pravami-root","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-05-13T01:05:07+00:00","article:modified_time":"2025-05-13T01:05:07+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"124670","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 12:46:45","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 12:46:45","updated":"2026-01-23 12:46:45","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/124670","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=124670"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/124670\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=124670"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=124670"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=124670"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}