{"id":105610,"date":"2022-11-17T15:36:49","date_gmt":"2022-11-17T13:36:49","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/kriticheskie-uyazvimosti-v-netatalk-privodyashhie-k-udalyonnomu-vypolneniyu-koda"},"modified":"2022-11-17T15:36:49","modified_gmt":"2022-11-17T13:36:49","slug":"kriticheskie-uyazvimosti-v-netatalk-privodyashhie-k-udalyonnomu-vypolneniyu-koda","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/kriticheskie-uyazvimosti-v-netatalk-privodyashhie-k-udalyonnomu-vypolneniyu-koda","title":{"rendered":"Vulnerabilitete kritike n\u00eb Netatalk, q\u00eb \u00e7ojn\u00eb n\u00eb ekzekutimin e kodit n\u00eb distanc\u00eb","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
N\u00eb Netatalk, serveri me realizimin e protokolleve rrjet\u00ebsore AppleTalk dhe Apple Filing Protocol (AFP), jan\u00eb identifikuar gjasht\u00eb vulnerabilitete q\u00eb mund t\u00eb eksplatohen nga distanca, duke lejuar ekzekutimin e kodit n\u00ebn privilegjet e root p\u00ebrmes d\u00ebrgimit t\u00eb paketimeve t\u00eb strukturuara n\u00eb m\u00ebnyr\u00eb specifike. Netatalk p\u00ebrdoret nga shum\u00eb prodhues t\u00eb pajisjeve t\u00eb ruajtjes s\u00eb t\u00eb dh\u00ebnave (NAS) p\u00ebr t\u00eb siguruar shk\u00ebmbimin e skedar\u00ebve dhe p\u00ebr t\u00eb organizuar qasje n\u00eb printera nga kompjuter\u00ebt Apple, p\u00ebr shembull, \u00ebsht\u00eb p\u00ebrdorur n\u00eb pajisjet Western Digital (problemi \u00ebsht\u00eb zgjidhur duke hequr Netatalk nga firmuerat WD). Netatalk gjithashtu \u00ebsht\u00eb p\u00ebrfshir\u00eb n\u00eb shum\u00eb distribucione, p\u00ebrfshir\u00eb OpenWRT (hequr q\u00eb nga dega OpenWrt 22.03), Debian, Ubuntu, SUSE, Fedora dhe FreeBSD, por nuk p\u00ebrdoret si parazgjedhje. Problemet jan\u00eb eliminuar n\u00eb versionin Netatalk 3.1.13. <\/p>\n
Problemet e identifikuara: <\/p>\n
\n
CVE-2022-0194 \u2014 mungesimi i pasakt\u00eb i kontrollit t\u00eb madh\u00ebsis\u00eb s\u00eb t\u00eb dh\u00ebnave t\u00eb jashtme n\u00eb funksionin ad_addcomment(), para se t\u00eb kopjohen n\u00eb nj\u00eb tampon t\u00eb fiksuar. Kjo dob\u00ebsi lejon nj\u00eb sulmues t\u00eb larg\u00ebt, pa nevoj\u00ebn e autentikimit, t\u00eb arrij\u00eb t\u00eb ekzekutoj\u00eb kodin e tij me t\u00eb drejtat root.\n
CVE-2022-23121 \u2014 p\u00ebrpunimi i gabuar i gabimeve n\u00eb funksionin parse_entries(), i shkaktuar gjat\u00eb analiz\u00ebs s\u00eb regjistrimeve AppleDouble. Kjo dob\u00ebsi lejon nj\u00eb sulmues t\u00eb larg\u00ebt, pa nevoj\u00ebn e autentikimit, t\u00eb arrij\u00eb t\u00eb ekzekutoj\u00eb kodin e tij me t\u00eb drejtat root.\n
CVE-2022-23122 \u2014 mungesa e kontrollit t\u00eb sakt\u00eb t\u00eb madh\u00ebsis\u00eb s\u00eb t\u00eb dh\u00ebnave t\u00eb jashtme n\u00eb funksionin setfilparams(), para se ato t\u00eb kopjohen n\u00eb nj\u00eb tampon t\u00eb fiksuar. Kjo dob\u00ebsi lejon nj\u00eb sulmues t\u00eb larg\u00ebt, pa nevoj\u00ebn e autentikimit, t\u00eb arrij\u00eb t\u00eb ekzekutoj\u00eb kodin e tij me t\u00eb drejtat root.\n
CVE-2022-23124 \u2014 mungesa e kontrollit t\u00eb sakt\u00eb t\u00eb t\u00eb dh\u00ebnave t\u00eb hyrjes n\u00eb metod\u00ebn get_finderinfo(), q\u00eb \u00e7on n\u00eb leximin nga nj\u00eb zon\u00eb jasht\u00eb tamponit t\u00eb ndar\u00eb. Kjo dob\u00ebsi lejon nj\u00eb sulmues t\u00eb larg\u00ebt, pa nevoj\u00ebn e autentikimit, t\u00eb arrij\u00eb informacion nga memoria e procesit. N\u00eb kombinim me dob\u00ebsi t\u00eb tjera, \u00e7\u00ebshtja mund t\u00eb p\u00ebrdoret gjithashtu p\u00ebr t\u00eb ekzekutuar kod me t\u00eb drejtat root.\n
CVE-2022-23125 \u2014 mungesa e kontrollit t\u00eb madh\u00ebsis\u00eb gjat\u00eb analiz\u00ebs s\u00eb elementit \u00ablen\u00bb n\u00eb funksionin copyapplfile(), para se t\u00eb kopjohen t\u00eb dh\u00ebnat n\u00eb nj\u00eb tampon t\u00eb fiksuar. Kjo dob\u00ebsi lejon nj\u00eb sulmues t\u00eb larg\u00ebt, pa nevoj\u00ebn e autentikimit, t\u00eb arrij\u00eb t\u00eb ekzekutoj\u00eb kodin e tij me t\u00eb drejtat root.\n
CVE-2022-23123 \u2014 mungesa e kontrollit t\u00eb t\u00eb dh\u00ebnave q\u00eb vijn\u00eb nga jasht\u00eb n\u00eb metod\u00ebn getdirparams(), q\u00eb \u00e7on n\u00eb leximin nga nj\u00eb zon\u00eb jasht\u00eb tamponit t\u00eb ndar\u00eb. Kjo dob\u00ebsi lejon nj\u00eb sulmues t\u00eb larg\u00ebt, pa nevoj\u00ebn e autentikimit, t\u00eb arrij\u00eb informacion nga memoria e procesit. <\/ul>\n