{"id":105528,"date":"2022-11-12T15:36:44","date_gmt":"2022-11-12T13:36:44","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-xterm-privodyashhaya-k-vypolneniyu-koda-pri-obrabotke-opredelyonnyh-strok"},"modified":"2022-11-12T15:36:44","modified_gmt":"2022-11-12T13:36:44","slug":"uyazvimost-v-xterm-privodyashhaya-k-vypolneniyu-koda-pri-obrabotke-opredelyonnyh-strok","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-xterm-privodyashhaya-k-vypolneniyu-koda-pri-obrabotke-opredelyonnyh-strok","title":{"rendered":"Nj\u00eb dob\u00ebsi n\u00eb xterm, q\u00eb \u00e7on n\u00eb ekzekutimin e kodit gjat\u00eb p\u00ebrpunimit t\u00eb disa vargjeve","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
N\u00eb emulatorin e terminalit xterm \u00ebsht\u00eb zbuluar nj\u00eb dob\u00ebsi (CVE-2022-45063), e cila lejon ekzekutimin e komandave shell gjat\u00eb p\u00ebrpunimit n\u00eb terminal t\u00eb disa sekuencave t\u00eb escapes t\u00eb caktuara. P\u00ebr sulmin, mjafton n\u00eb rastin m\u00eb t\u00eb thjesht\u00eb t\u00eb shfaqet n\u00eb ekran p\u00ebrmbajtja e nj\u00eb skedari t\u00eb formatuar n\u00eb m\u00ebnyr\u00eb t\u00eb ve\u00e7ant\u00eb, p\u00ebr shembull, me ndihm\u00ebn e utilitarit cat, ose t\u00eb ngjitet nj\u00eb varg nga tabela e kopjimit. printf «\e]50;i\$(touch \/tmp\/hack-like-its-1999)\a\e]50;?\a» > cve-2022-45063 cat cve-2022-45063 <\/p>\n
Problemi shkaktohet nga nj\u00eb gabim gjat\u00eb p\u00ebrpunimit t\u00eb sekuenc\u00ebs s\u00eb escapes me kodin 50, e cila p\u00ebrdoret p\u00ebr t\u00eb vendosur ose marr\u00eb parametra t\u00eb fontit. N\u00ebse fonti i k\u00ebrkuar nuk ekziston, operacioni kthen emrin e fontit t\u00eb caktuar n\u00eb k\u00ebrkes\u00eb. Simbolet kontrolluese nuk mund t\u00eb futen drejtp\u00ebrdrejt n\u00eb emrin, por vargu q\u00eb kthehet mund t\u00eb p\u00ebrfundoj\u00eb me sekuenc\u00ebn «^G», e cila n\u00eb zsh, kur \u00ebsht\u00eb aktivizuar m\u00ebnyra e redaktimit t\u00eb vargjeve n\u00eb stilin vi, \u00e7on n\u00eb ekzekutimin e operacionit t\u00eb shfaqjes, q\u00eb mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb nisur komanda pa shtypur qart\u00eb tastin Enter. <\/p>\n
P\u00ebr t\u00eb exploit t\u00eb suksessh\u00ebm t\u00eb dob\u00ebsis\u00eb, p\u00ebrdoruesi duhet t\u00eb p\u00ebrdor\u00eb shell-in Zsh me redaktorin e komandave t\u00eb kaluar n\u00eb m\u00ebnyr\u00ebn «vi» (vi-cmd-mode), i cili zakonisht nuk p\u00ebrdoret si parazgjedhje n\u00eb distribucione. Problemi gjithashtu nuk shfaqet kur jan\u00eb vendosur n\u00eb xterm parametrat allowWindowOps=false ose allowFontOps=false. P\u00ebr shembull, parametrin allowFontOps=false e p\u00ebrdorin OpenBSD, Debian, dhe RHEL, por nuk aplikohet si parazgjedhje n\u00eb Arch Linux. <\/p>\n
Sipas list\u00ebs s\u00eb ndryshimeve dhe deklarat\u00ebs s\u00eb k\u00ebrkuesit q\u00eb e zbuloi problemin, dob\u00ebsia \u00ebsht\u00eb eliminuar n\u00eb l\u00ebshimin e xterm 375, por sipas burimeve t\u00eb tjera, ajo vazhdon t\u00eb shfaqet n\u00eb xterm 375 nga Arch Linux. Mund t\u00eb ndiqni publikimin e rregullimeve nga distribucionet n\u00eb k\u00ebto faqe: Debian, RHEL, Fedora, SUSE, Ubuntu, Arch Linux, OpenBSD, FreeBSD, NetBSD. \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"