{"id":106435,"date":"2023-01-21T12:48:20","date_gmt":"2023-01-21T10:48:20","guid":{"rendered":"https:\/\/prohoster.info\/?p=106435"},"modified":"2023-01-24T13:53:14","modified_gmt":"2023-01-24T11:53:14","slug":"uyazvimost-v-libxpm-privodyashhaya-k-vypolneniyu-koda","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-v-libxpm-privodyashhaya-k-vypolneniyu-koda","title":{"rendered":"Zranite\u013enos\u0165 v libXpm, ktor\u00e1 vedie k vykon\u00e1vaniu k\u00f3du","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Bol vyda\u0165 opraven\u00fd vydanie kni\u017enice libXpm 3.5.15, vyvinutej projektom X.Org a pou\u017e\u00edvanou na spracovanie s\u00faborov vo form\u00e1te XPM. V novej verzii boli odstr\u00e1nen\u00e9 tri zranite\u013enosti, z ktor\u00fdch dve (CVE-2022-46285, CVE-2022-44617) sp\u00f4sobuj\u00fa zacyklenie pri spracovan\u00ed \u0161peci\u00e1lne upraven\u00fdch s\u00faborov XPM. Tretia zranite\u013enos\u0165 (CVE-2022-4883) umo\u017e\u0148uje spusti\u0165 \u013eubovo\u013en\u00e9 pr\u00edkazy pri vykon\u00e1van\u00ed aplik\u00e1ci\u00ed pou\u017e\u00edvaj\u00facich libXpm. Pri sp\u00fa\u0161\u0165an\u00ed procesov s privilegovan\u00fdmi pr\u00e1vami s\u00favisiacich s libXpm, ako s\u00fa programy s pr\u00edvlastkom suid root, zranite\u013enos\u0165 umo\u017e\u0148uje zv\u00fd\u0161i\u0165 svoje privil\u00e9gia. <\/p>\n

Zranite\u013enos\u0165 je sp\u00f4soben\u00e1 \u0161pecifikom \u010dinnosti libXpm so skomprimovan\u00fdmi s\u00fabormi XPM \u2014 pri spracovan\u00ed s\u00faborov XPM.Z alebo XPM.gz kni\u017enica pomocou volania execlp() sp\u00fa\u0161\u0165a extern\u00e9 rozbalovacie n\u00e1stroje (uncompress alebo gunzip), ktor\u00fdch cesta je vypo\u010d\u00edtan\u00e1 na z\u00e1klade premennej prostredia PATH. \u00datok spo\u010d\u00edva v umiestnen\u00ed vlastn\u00fdch spustite\u013en\u00fdch s\u00faborov uncompress alebo gunzip do prie\u010dinka, ktor\u00fd je pou\u017e\u00edvate\u013eovi pr\u00edstupn\u00fd a nach\u00e1dza sa v zozname PATH, tieto s\u00fabory bud\u00fa vykonan\u00e9 pri spusten\u00ed aplik\u00e1cie pou\u017e\u00edvaj\u00facej libXpm. <\/p>\n

Zranite\u013enos\u0165 bola odstr\u00e1nen\u00e1 nahraden\u00edm volania execlp na execl s pou\u017eit\u00edm absol\u00fatnych ciest k n\u00e1strojom. Navy\u0161e bola pridan\u00e1 mo\u017enos\u0165 zostavenia \u201e\u2014disable-open-zfile\u201c, ktor\u00e1 umo\u017e\u0148uje vypn\u00fa\u0165 spracovanie skomprimovan\u00fdch s\u00faborov a volanie extern\u00fdch n\u00e1strojov na rozbalenie.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0439 \u0432\u044b\u043f\u0443\u0441\u043a \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 libXpm 3.5.15, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u043e\u0439 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c X.Org \u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0439 \u0434\u043b\u044f \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0444\u0430\u0439\u043b\u043e\u0432 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 XPM. \u0412 \u043d\u043e\u0432\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0442\u0440\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0434\u0432\u0435 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 (CVE-2022-46285, CVE-2022-44617) \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0442 \u043a \u0437\u0430\u0446\u0438\u043a\u043b\u0438\u0432\u0430\u043d\u0438\u044e \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 XPM. \u0422\u0440\u0435\u0442\u044c\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-4883) \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u043f\u0440\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 libXpm. \u041f\u0440\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0435 \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441 libXpm \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-106435","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranite\u013enos\u0165 v libXpm, ktor\u00e1 vedie k vykon\u00e1vaniu k\u00f3du | ProHoster","description":"Bol vyda\u0165 opraven\u00fd vydanie kni\u017enice libXpm 3.5.15, vyvinutej projektom X.Org a pou\u017e\u00edvanou na spracovanie s\u00faborov vo form\u00e1te XPM.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-v-libxpm-privodyashhaya-k-vypolneniyu-koda","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 libXpm, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0439 \u0432\u044b\u043f\u0443\u0441\u043a \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 libXpm 3.5.15, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u043e\u0439 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c X.Org \u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0439 \u0434\u043b\u044f \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0444\u0430\u0439\u043b\u043e\u0432 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 XPM.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-v-libxpm-privodyashhaya-k-vypolneniyu-koda","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-01-21T10:48:20+00:00","article:modified_time":"2023-01-24T11:53:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/106435","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=106435"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/106435\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=106435"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=106435"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=106435"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}