{"id":53889,"date":"2019-12-12T00:00:00","date_gmt":"2019-12-11T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/uyazvimost-v-ld-so-openbsd"},"modified":"2020-02-18T14:01:50","modified_gmt":"2020-02-18T11:01:50","slug":"uyazvimost-v-ld-so-openbsd","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-ld-so-openbsd","title":{"rendered":"Vulnerabilitate \u00een ld.so OpenBSD","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00cenc\u0103rc\u0103tor dinamic ld.so<\/a><\/noindex>, parte a OpenBSD, \u00een anumite condi\u021bii poate SUID\/SGID<\/a><\/noindex>-aplica\u021bia las\u0103 variabila de mediu LD_LIBRARY_PATH \u0219i astfel permite \u00eenc\u0103rcarea codului ter\u021b \u00een contextul procesului care ruleaz\u0103 cu privilegii crescute. Pachetele cu remedieri pentru vulnerabilitate sunt disponibile pentru versiunile 6.5<\/a><\/noindex> \u0219i 6.6<\/a><\/noindex>. Patch-uri binare (syspatch<\/a><\/noindex>) pentru platformele amd64, i386 \u0219i arm64 sunt deja \u00een produc\u021bie \u0219i ar trebui s\u0103 fie disponibile pentru desc\u0103rcare la momentul public\u0103rii acestei \u0219tiri.<\/p>\n

Esenta problemei: \u00een timpul func\u021bion\u0103rii, ld.so extrage mai \u00eent\u00e2i valoarea variabilei LD_LIBRARY_PATH din mediu, folosind func\u021bia _dl_split_path() pentru a o transforma \u00eentr-un array de stringuri - c\u0103i c\u0103tre directoare. Dac\u0103 ulterior se constat\u0103 c\u0103 procesul curent a fost lansat de o aplica\u021bie SUID\/SGID, array-ul creat \u0219i, practic, variabila LD_LIBRARY_PATH sunt \u0219terse. \u00cen acela\u0219i timp, dac\u0103 \u00een timpul func\u021bion\u0103rii _dl_split_path() se confrunt\u0103 cu o lips\u0103 de memorie (ceea ce este greu din cauza limit\u0103rii explicite a dimensiunii variabilelor de mediu la 256 de kilobyte, dar teoretic posibil), variabila _dl_libpath va primi valoarea NULL, iar verificarea ulterioar\u0103 a valorii acestei variabile va determina s\u0103 se sar\u0103 apelul _dl_unsetenv(\"LD_LIBRARY_PATH\").<\/p>\n

Vulnerabilitatea a fost g\u0103sit\u0103 de speciali\u0219tii Qualys<\/a><\/noindex>, precum \u0219i c\u00e2teva probleme dezv\u0103luite anterior.<\/a><\/noindex> Cercet\u0103torii \u00een securitate care au identificat vulnerabilitatea au remarcat rapiditatea cu care a fost rezolvat\u0103 problema: patch-ul a fost preg\u0103tit \u0219i actualiz\u0103rile au fost emise \u00een termen de trei ore de la primirea notific\u0103rii de c\u0103tre proiectul OpenBSD.<\/p>\n

Complement: Problemei i-a fost atribuit num\u0103rul CVE-2019-19726<\/a><\/noindex>. Un anun\u021b oficial a fost f\u0103cut pe lista de discu\u021bii oss-security, inclusiv un prototip de exploit care func\u021bioneaz\u0103 \u00een OpenBSD 6.6, 6.5, 6.2 \u0219i 6.1 pe arhitecturile<\/a><\/noindex>amd64 \u0219i i386 (exploitul poate fi adaptat \u0219i pentru alte arhitecturi).
\nProblema este exploatabil\u0103 \u00een instalarea implicit\u0103 \u0219i permite unui utilizator local f\u0103r\u0103 privilegii s\u0103 execute cod cu drepturi de root prin substituirea bibliotecii la rularea utilitarelor suid chpass sau passwd. Pentru a crea condi\u021biile necesare exploat\u0103rii, se utilizeaz\u0103 limitarea memoriei RLIMIT_DATA prin setrlimit.
\n \u00cenc\u0103rc\u0103torul dinamic ld.so, parte a OpenBSD, \u00een anumite condi\u021bii poate<\/p>\n

<\/a><\/noindex><\/p>\n

Sursa: opennet.ro<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0414\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a ld.so, \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0439 \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 OpenBSD, \u043f\u0440\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u043c\u043e\u0436\u0435\u0442 \u0434\u043b\u044f SUID\/SGID-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u043e\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u0443\u044e \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f LD_LIBRARY_PATH \u0438 \u0442\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0439 \u043a\u043e\u0434 \u0432 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u0441 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u043d\u044b\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438. \u041f\u0430\u0442\u0447\u0438 \u0441 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u0434\u043b\u044f \u0440\u0435\u043b\u0438\u0437\u043e\u0432 6.5 \u0438 6.6. \u0411\u0438\u043d\u0430\u0440\u043d\u044b\u0435 \u043f\u0430\u0442\u0447\u0438 (syspatch) \u0434\u043b\u044f \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c amd64, i386 \u0438 arm64 \u0443\u0436\u0435 \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u044b \u0432 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0441\u0442\u0432\u043e \u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-53889","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitate \u00een ld.so OpenBSD | ProHoster","description":"\ud83e\udd47Vulnerabilitate \u00een ld.so OpenBSD | ProHoster","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-ld-so-openbsd","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 ld.so OpenBSD | ProHoster","og:description":"\u0414\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a ld.so, \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0439 \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 OpenBSD, \u043f\u0440\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u043c\u043e\u0436\u0435\u0442 \u0434\u043b\u044f","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-ld-so-openbsd","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-11T21:00:00+00:00","article:modified_time":"2020-02-18T11:01:50+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"53889","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 09:10:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:16:27","updated":"2026-01-24 09:10:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/53889","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=53889"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/53889\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=53889"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=53889"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=53889"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}