{"id":53580,"date":"2019-12-05T00:00:00","date_gmt":"2019-12-04T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/uyazvimosti-v-openbsd-pozvolyayushhie-povysit-privilegii-i-obojti-autentifikatsiyu-v-smtpd-ldapd-i-radiusd"},"modified":"2021-02-01T11:40:32","modified_gmt":"2021-02-01T09:40:32","slug":"uyazvimosti-v-openbsd-pozvolyayushhie-povysit-privilegii-i-obojti-autentifikatsiyu-v-smtpd-ldapd-i-radiusd","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-openbsd-pozvolyayushhie-povysit-privilegii-i-obojti-autentifikatsiyu-v-smtpd-ldapd-i-radiusd","title":{"rendered":"Vulnerabilit\u0103\u021bi \u00een OpenBSD care permit cre\u0219terea privilegiilor \u0219i ocolirea autentific\u0103rii \u00een smtpd, ldapd \u0219i radiusd","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Compania Qualys <noindex><a rel=\"nofollow\" href=\"https:\/\/blog.qualys.com\/laws-of-vulnerabilities\/2019\/12\/04\/openbsd-multiple-authentication-vulnerabilities\">a eviden\u021biat<\/a><\/noindex> patru <noindex><a rel=\"nofollow\" href=\"https:\/\/www.qualys.com\/2019\/12\/04\/cve-2019-19521\/authentication-vulnerabilities-openbsd.txt\">vulnerabilit\u0103\u021bi<\/a><\/noindex> \u00cen OpenBSD, una dintre acestea permite conectarea de la distan\u021b\u0103 f\u0103r\u0103 autentificare la anumite servicii de re\u021bea, iar celelalte trei permit cre\u0219terea privilegiilor \u00een sistem. \u00cen raportul Qualys este men\u021bionat\u0103 reac\u021bia rapid\u0103 a dezvoltatorilor OpenBSD \u2014 toate problemele au fost <noindex><a rel=\"nofollow\" href=\"https:\/\/www.openbsd.org\/errata66.html\">remediate<\/a><\/noindex> \u00een <noindex><a rel=\"nofollow\" href=\"https:\/\/www.openbsd.org\/errata65.html\">OpenBSD 6.5<\/a><\/noindex> \u0219i <noindex><a rel=\"nofollow\" href=\"https:\/\/www.openbsd.org\/errata66.html\">OpenBSD 6.6<\/a><\/noindex> rezolvate \u00een termen de 40 de ore de la notificarea privat\u0103.<\/p>\n<p>Vulnerabilitatea exploatabil\u0103 de la distan\u021b\u0103 este cauzat\u0103 de o eroare \u00een organizarea apelului handler-ului de autentificare \u00een biblioteca libc, care apeleaz\u0103<br \/>\nprogramul \/usr\/libexec\/auth\/login_style cu transmiterea argumentelor \u00een linia de comand\u0103. Inclusiv la apelarea login_style cu op\u021biunea \u201e-s service\u201d este permis\u0103 transmiterea denumirii protocolului. \u00cen cazul utiliz\u0103rii, la \u00eenceputul numelui de utilizator, a caracterului \u201e-\u201d, acest nume va fi tratat ca o op\u021biune la lansarea login_style. Prin urmare, dac\u0103 \u00een timpul autentific\u0103rii se specific\u0103 numele de utilizator \u201e-schallenge\u201d sau \u201e-schallenge:passwd\u201d, login_style va interpreta apelul ca o solicitare de utilizare a handler-ului <noindex><a rel=\"nofollow\" href=\"https:\/\/ru.wikipedia.org\/wiki\/S\/Key\">S\/Key<\/a><\/noindex>.<\/p>\n<p>Problema este c\u0103 protocolul S\/Key \u00een login_style este sus\u021binut doar formal, iar de fapt este ignorat, fiind returnat\u0103 o dovad\u0103 a autentific\u0103rii de succes. Astfel, un atacator se poate prezenta ca utilizator \u201e-schallenge\u201d, elud\u00e2nd autentificarea \u0219i ob\u021bin\u00e2nd acces f\u0103r\u0103 a furniza o parol\u0103 sau chei. Poten\u021bial, problema afecteaz\u0103 toate serviciile de re\u021bea care folosesc apeluri standard libc pentru efectuarea autentific\u0103rii. De exemplu, posibilitatea de a ocoli autentificarea este confirmat\u0103 \u00een smtpd (AUTH PLAIN), ldapd \u0219i radiusd.<\/p>\n<p>\u00cen sshd, vulnerabilitatea nu se manifest\u0103, deoarece exist\u0103 o protec\u021bie suplimentar\u0103 care verific\u0103 prezen\u021ba utilizatorului \u00een sistem. Cu toate acestea, sshd poate fi folosit pentru a verifica dac\u0103 sistemul este vulnerabil \u2014 la apelarea cu numele de utilizator \u201e-sresponse:passwd\u201d, conexiunea se blocheaz\u0103, deoarece sshd a\u0219teapt\u0103 retornoarea parametrilor de apel (challange) de la login_passwd, iar login_passwd a\u0219teapt\u0103 transmiterea parametrilor lips\u0103 (numele \u201e-sresponse\u201d este perceput ca o op\u021biune). Poten\u021bial, un atacator local ar putea \u00eencerca s\u0103 eludeze autentificarea \u00een utilitarul su, dar transmiterea numelui \u201e-sresponse\u201d duce la pr\u0103bu\u0219irea procesului din cauza return\u0103rii unui pointer nul la execu\u021bia func\u021biei getpwnam_r(\u201e-schallenge\u201d, \u2026).<\/p>\n<p>Alte vulnerabilit\u0103\u021bi:<\/p>\n<ul>\n<li class=\"l\">  CVE-2019-19520 \u2014 o cre\u0219tere local\u0103 a privilegiilor prin manipularea utilitarului xlock, livrat cu un flag sgid, care schimb\u0103 grupul \u00een \u201eauth\u201d. \u00cen codul xlock, redefinirea c\u0103ilor c\u0103tre biblioteci este permis\u0103 doar \u00een cazul schimb\u0103rii identificatorului utilizatorului (setuid), ceea ce permite atacatorului s\u0103 modifice variabila de mediu \u201eLIBGL_DRIVERS_PATH\u201d \u0219i s\u0103 organizeze \u00eenc\u0103rcarea bibliotecii sale partajate, codul c\u0103reia va fi executat dup\u0103 cre\u0219terea privilegiilor la grupul \u201eauth\u201d.<\/li>\n<li class=\"l\"> CVE-2019-19522 \u2014 permite unui utilizator local, care este membru al grupului \u201eauth\u201d, s\u0103 execute cod cu drepturi de root atunci c\u00e2nd se utilizeaz\u0103 autentificarea \u00een sistem prin S\/Key sau YubiKey (care, \u00een mod implicit, nu sunt activate). Apartenen\u021ba la grupul \u201eauth\u201d, la care se poate accesa prin exploatarea vulnerabilit\u0103\u021bii men\u021bionate anterior \u00een xlock, permite scrierea de fi\u0219iere \u00een directoarele \/etc\/skey \u0219i \/var\/db\/yubikey. De exemplu, atacatorul poate ad\u0103uga un nou fi\u0219ier \/etc\/skey\/root pentru generarea de chei unice pentru autentificarea ca utilizator root prin S\/Key.<\/li>\n<li class=\"l\"> CVE-2019-19519 \u2014 posibilitatea de a cre\u0219te limitele resurselor prin manipularea utilitarului su. Atunci c\u00e2nd se specific\u0103 op\u021biunea \u201e-L\u201d, care implic\u0103 repetarea ciclic\u0103 a \u00eencerc\u0103rilor de autentificare \u00een cazul e\u0219ecului, clasa utilizatorului este stabilit\u0103 o singur\u0103 dat\u0103 \u0219i nu este resetat\u0103 la urm\u0103toarele \u00eencerc\u0103ri. Atacatorul poate executa \u201esu -l -L\u201d \u0219i, \u00een prima \u00eencercare, poate introduce un alt nume de utilizator cu o clas\u0103 diferit\u0103, dar \u00een a doua \u00eencercare s\u0103 se autentifice cu succes ca sine. \u00cen aceast\u0103 situa\u021bie, utilizatorului \u00eei vor fi stabilite limitele corespunz\u0103toare clasei utilizatorului specificat la prima \u00eencercare (de exemplu, num\u0103rul maxim de procese sau dimensiunea memoriei pentru proces). Metoda func\u021bioneaz\u0103 doar pentru \u00eemprumutarea limitelor de la utilizatori neprivilegia\u021bi, deoarece pentru utilizatorul root este necesar\u0103 apartenen\u021ba la grupa wheel).<\/li>\n<\/ul>\n<p>apari\u021bia <noindex><a rel=\"nofollow\" href=\"http:\/\/undeadly.org\/cgi?action=article;sid=20191202105849\">implementarea<\/a><\/noindex> \u00een OpenBSD a fost introdus un nou method de verificare a validit\u0103\u021bii apelurilor de sistem, complic\u00e2nd suplimentar exploatarea vulnerabilit\u0103\u021bilor. Metoda permite executarea apelurilor de sistem doar dac\u0103 acestea sunt invocate din zone de memorie \u00eenregistrate anterior. Pentru a marca zonele de memorie <noindex><a rel=\"nofollow\" href=\"https:\/\/marc.info\/?l=openbsd-cvs&amp;m=157500930922882&amp;w=2\">sub licen\u021ba MIT. Instrumentul utilizeaz\u0103 metode de \u00eenv\u0103\u021bare automat\u0103, \u00eempreun\u0103 cu analiza static\u0103 \u0219i dinamic\u0103 a codului JavaScript. Se afirm\u0103 c\u0103 utilizarea \u00eenv\u0103\u021b\u0103rii automate a permis \u00eembun\u0103t\u0103\u021birea semnificativ\u0103 a preciziei \u00een identificarea codului pentru identificarea ascuns\u0103 \u0219i a identificat cu 26% mai multe scripturi problematice<\/a><\/noindex> nou apel de sistem <noindex><a rel=\"nofollow\" href=\"https:\/\/man.openbsd.org\/msyscall\">msyscall()<\/a><\/noindex>.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=51979\">opennet.ro<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0447\u0435\u0442\u044b\u0440\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 OpenBSD, \u043e\u0434\u043d\u0430 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043a \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u043c \u0441\u0435\u0442\u0435\u0432\u044b\u043c \u0441\u0435\u0440\u0432\u0438\u0441\u0430\u043c, \u0430 \u0442\u0440\u0438 \u043e\u0441\u0442\u0430\u043b\u044c\u043d\u044b\u0435 \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u0412 \u043e\u0442\u0447\u0451\u0442\u0435 Qualys \u043e\u0442\u043c\u0435\u0447\u0435\u043d\u0430 \u0431\u044b\u0441\u0442\u0440\u0430\u044f \u0440\u0435\u0430\u043a\u0446\u0438\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 OpenBSD &#8212; \u0432\u0441\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0431\u044b\u043b\u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0432 OpenBSD 6.5 \u0438 OpenBSD 6.6 \u0432 \u0442\u0435\u0447\u0435\u043d\u0438\u0435 40 \u0447\u0430\u0441\u043e\u0432 \u043f\u043e\u0441\u043b\u0435 \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u043e\u0433\u043e \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u044f. \u0423\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0430\u044f [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-53580","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0447\u0435\u0442\u044b\u0440\u0435\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-openbsd-pozvolyayushhie-povysit-privilegii-i-obojti-autentifikatsiyu-v-smtpd-ldapd-i-radiusd\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 OpenBSD, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0438 \u043e\u0431\u043e\u0439\u0442\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0432 smtpd, ldapd \u0438 radiusd | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0447\u0435\u0442\u044b\u0440\u0435\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-openbsd-pozvolyayushhie-povysit-privilegii-i-obojti-autentifikatsiyu-v-smtpd-ldapd-i-radiusd\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-12-04T21:00:00+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2021-02-01T09:40:32+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilit\u0103\u021bi \u00een OpenBSD, care permit cre\u0219terea privilegiilor \u0219i ocolirea autentific\u0103rii \u00een smtpd, ldapd \u0219i radiusd | ProHoster","description":"Compania Qualys a identificat patru","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-openbsd-pozvolyayushhie-povysit-privilegii-i-obojti-autentifikatsiyu-v-smtpd-ldapd-i-radiusd","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 OpenBSD, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0438 \u043e\u0431\u043e\u0439\u0442\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0432 smtpd, ldapd \u0438 radiusd | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0447\u0435\u0442\u044b\u0440\u0435","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-openbsd-pozvolyayushhie-povysit-privilegii-i-obojti-autentifikatsiyu-v-smtpd-ldapd-i-radiusd","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-04T21:00:00+00:00","article:modified_time":"2021-02-01T09:40:32+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"53580","title":null,"description":"","keywords":"","keyphrases":null,"primary_term":null,"canonical_url":"","og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 07:57:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:22:50","updated":"2026-01-24 07:57:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/53580","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=53580"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/53580\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=53580"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=53580"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=53580"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}