Mune iyo package , iyo inopa maturusi ekutarisira kure server, backdoor (), inowanikwa muchirongwa chepamutemo chinovaka, kuburikidza neSourceforge uye panzvimbo huru. Iyo yekumashure yaivepo mukuvaka kubva 1.882 kusvika 1.921 inosanganisirwa (pakanga pasina kodhi ine backdoor mugit repository) uye yakabvumira zvehumbimbiki gomba mirairo kuti iurayiwe kure pasina humbowo pane system ine midzi kodzero.
Nekuda kwekurwiswa, zvakakwana kuve neyakavhurika network chiteshi neWebmin uye kumisa basa rekuchinja mapassword echinyakare muwebhu interface (inogoneswa nekusarudzika mukuvaka 1.890, asi yakaremara mune dzimwe shanduro). Dambudziko Π² 1.930. Sechiyero chechinguvana chekuvhara backdoor, ingo bvisa iyo "passwd_mode =" kuseta kubva pa /etc/webmin/miniserv.conf configuration file. Yakagadzirirwa kuongororwa .
Dambudziko raivepo mune password_change.cgi script, umo yekutarisa yekare password yakapinda muwebhu fomu iyo unix_crypt basa, iyo password yakagamuchirwa kubva kumushandisi inopfuudzwa pasina kupukunyuka akakosha mavara. Mune git repository basa iri yakaputirwa neCrypt :: UnixCrypt module uye haina njodzi, asi iyo kodhi archive yakapihwa paSourceforge webhusaiti inofona kodhi inowana zvakananga /etc/mumvuri, asi inoita izvi uchishandisa goko rekuvaka. Kuti urwise, ingo tsanangura chiratidzo "|" mumunda nepassword yekare. uye iyo inotevera kodhi mushure mekunge ichaitwa ine midzi kodzero pane server.
By Vagadziri veWebmin, iyo kodhi yakaipa yakaiswa semhedzisiro yezvivakwa zvepurojekiti iri kukanganisa. Tsanangudzo haisati yapihwa, saka hazvisi pachena kuti kubira kwacho kwaigumira pakutora kutonga kweiyo Sourceforge account kana kukanganisa zvimwe zvinhu zveWebmin kusimudzira uye kuvaka zvivakwa. Iyo yakaipa kodhi yave iripo mudura kubva munaKurume 2018. Dambudziko racho rakakanganisawo . Parizvino, zvese zvekurodha zvinyorwa zvinovakwazve kubva kuGit.
Source: opennet.ru