{"id":38918,"date":"2019-10-31T22:26:45","date_gmt":"2019-10-31T19:26:45","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimost-v-sudo-pozvolyayushhaya-povysit-privilegii-pri-ispolzovanii-spetsifichnyh-pravil\/"},"modified":"2019-10-31T22:26:45","modified_gmt":"2019-10-31T19:26:45","slug":"uyazvimost-v-sudo-pozvolyayushhaya-povysit-privilegii-pri-ispolzovanii-spetsifichnyh-pravil","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-sudo-pozvolyayushhaya-povysit-privilegii-pri-ispolzovanii-spetsifichnyh-pravil","title":{"rendered":"O vulnerabilitate \u00een sudo care permite cre\u0219terea privilegiilor folosind reguli specifice","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00cen utilitarul Sudo<\/a><\/noindex>, utilizat pentru a organiza executarea comenzilor \u00een numele altor utilizatori, a fost identificat\u0103<\/a><\/noindex> vulnerabilitatea<\/a><\/noindex> (CVE-2019-14287<\/a><\/noindex>), care permite executarea comenzilor cu privilegii root, atunci c\u00e2nd \u00een set\u0103rile sudoers exist\u0103 reguli \u00een care, \u00een sec\u021biunea de verificare a identificatorului utilizatorului, dup\u0103 cuv\u00e2ntul cheie permissiv «ALL» urmeaz\u0103 o interdic\u021bie clar\u0103 de a rula cu privilegii root («… (ALL, !root) …»). \u00cen configura\u021biile implicite din distribu\u021bii, vulnerabilitatea nu se manifest\u0103. <\/p>\n

\u00cen cazul \u00een care \u00een sudoers exist\u0103 reguli permise, dar extrem de rar \u00eent\u00e2lnite \u00een practic\u0103, care permit executarea unei anumite comenzi sub identificatorul UID al oric\u0103rui utilizator, cu excep\u021bia root, atacatorul, care are permisiunea de a executa aceast\u0103 comand\u0103, poate ocoli restric\u021bia stabilit\u0103 \u0219i poate executa comanda cu privilegii root. Pentru a ocoli restric\u021bia, este suficient s\u0103 \u00eencerce s\u0103 execute comanda specificat\u0103 \u00een set\u0103ri cu UID «-1» sau «4294967295», ceea ce va duce la executarea ei cu UID 0. <\/p>\n

De exemplu, dac\u0103 \u00een configurare exist\u0103 o regul\u0103 care ofer\u0103 oric\u0103rui utilizator dreptul de a executa programul \/usr\/bin\/id sub orice UID:<\/p>\n

myhost ALL = (ALL, !root) \/usr\/bin\/id<\/p>\n

sau o variant\u0103 care permite executarea doar de c\u0103tre un anumit utilizator bob:<\/p>\n

myhost bob = (ALL, !root) \/usr\/bin\/id<\/p>\n

Utilizatorul poate executa «sudo -u ‘#-1’ id» \u0219i utilitarul \/usr\/bin\/id va fi lansat cu privilegii root, \u00een ciuda interdic\u021biei clare din set\u0103ri. Problema este cauzat\u0103 de neaten\u021bia fa\u021b\u0103 de valorile speciale «-1» sau «4294967295», care nu duc la schimbarea UID, dar deoarece sudo este deja executat sub root, f\u0103r\u0103 a schimba UID, comanda \u021bint\u0103 este, de asemenea, executat\u0103 cu privilegii root. <\/p>\n

\u00cen distribu\u021biile SUSE \u0219i openSUSE, f\u0103r\u0103 a specifica \u00een regul\u0103 «NOPASSWD», vulnerabilitatea nu este exploatabil\u0103<\/a><\/noindex>, deoarece \u00een sudoers, \u00een mod implicit, este activat modul «Defaults targetpw», \u00een care se efectueaz\u0103 verificarea UID din baza de date a parolelor, gener\u00e2nd o solicitare de introducere a parolei pentru utilizatorul \u021bint\u0103. Pentru astfel de sisteme, atacul poate fi realizat doar \u00een prezen\u021ba unor reguli de tip:<\/p>\n

myhost ALL = (ALL, !root) NOPASSWD: \/usr\/bin\/id<\/p>\n

Problema a fost remediat\u0103 \u00een versiunea Sudo 1.8.28<\/a><\/noindex>. Corec\u021bia este, de asemenea, disponibil\u0103 sub form\u0103 patch<\/a><\/noindex>. \u00cen distribu\u021biile vulnerabilitatea a fost deja rezolvat\u0103 \u00een Debian<\/a><\/noindex>, Arch Linux<\/a><\/noindex>, SUSE\/openSUSE<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, Gentoo<\/a><\/noindex> \u0219i FreeBSD<\/a><\/noindex>. La momentul redact\u0103rii acestei \u0219tiri, problema r\u0103m\u00e2ne nerezolvat\u0103 \u00een RHEL<\/a><\/noindex> \u0219i Fedora<\/a><\/noindex>. Vulnerabilitatea a fost identificat\u0103 de cercet\u0103torii \u00een securitate de la compania Apple.<\/p>\n

<\/a><\/noindex><\/p>\n

Sursa: opennet.ro<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0443\u0442\u0438\u043b\u0438\u0442\u0435 Sudo, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0439 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u0430\u043d\u0434 \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2019-14287), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u0430\u043d\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root, \u043f\u0440\u0438 \u043d\u0430\u043b\u0438\u0447\u0438\u0438 \u0432 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430\u0445 sudoers \u043f\u0440\u0430\u0432\u0438\u043b, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0432 \u0441\u0435\u043a\u0446\u0438\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u043f\u043e\u0441\u043b\u0435 \u0440\u0430\u0437\u0440\u0435\u0448\u0430\u044e\u0449\u0435\u0433\u043e \u043a\u043b\u044e\u0447\u0435\u0432\u043e\u0433\u043e \u0441\u043b\u043e\u0432\u0430 «ALL» \u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u044f\u0432\u043d\u044b\u0439 \u0437\u0430\u043f\u0440\u0435\u0442 \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root («… (ALL, !root) …»). \u0412 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f\u0445 \u043f\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-38918","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitate \u00een sudo, care permite cre\u0219terea privilegiilor prin utilizarea regulilor specifice | ProHoster","description":"\u00cen utilitarul Sudo, utilizat pentru organizarea execut\u0103rii comenzilor \u00een numele altor utilizatori,","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-sudo-pozvolyayushhaya-povysit-privilegii-pri-ispolzovanii-spetsifichnyh-pravil","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 sudo, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u0447\u043d\u044b\u0445 \u043f\u0440\u0430\u0432\u0438\u043b | ProHoster","og:description":"\u0412 \u0443\u0442\u0438\u043b\u0438\u0442\u0435 Sudo, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0439 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u0430\u043d\u0434 \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439,","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-sudo-pozvolyayushhaya-povysit-privilegii-pri-ispolzovanii-spetsifichnyh-pravil","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:26:45+00:00","article:modified_time":"2019-10-31T19:26:45+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"38918","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 23:57:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:00:27","updated":"2026-01-23 23:57:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/38918","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=38918"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/38918\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=38918"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=38918"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=38918"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}