{"id":106435,"date":"2023-01-21T12:48:20","date_gmt":"2023-01-21T10:48:20","guid":{"rendered":"https:\/\/prohoster.info\/?p=106435"},"modified":"2023-01-24T13:53:14","modified_gmt":"2023-01-24T11:53:14","slug":"uyazvimost-v-libxpm-privodyashhaya-k-vypolneniyu-koda","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimost-v-libxpm-privodyashhaya-k-vypolneniyu-koda","title":{"rendered":"Vulnerabiliteti n\u00eb libXpm q\u00eb \u00e7on n\u00eb ekzekutimin e kodit","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
\u00cbsht\u00eb publikuar nj\u00eb version korrektues i bibliotek\u00ebs libXpm 3.5.15, e zhvilluar nga projekti X.Org dhe e p\u00ebrdorur p\u00ebr p\u00ebrpunimin e skedar\u00ebve n\u00eb formatin XPM. N\u00eb versionin e ri jan\u00eb rregulluar tri vulnerabilitete, dy prej t\u00eb cilave (CVE-2022-46285, CVE-2022-44617) shkaktojn\u00eb ngecje gjat\u00eb p\u00ebrpunimit t\u00eb skedar\u00ebve t\u00eb projektuar posa\u00e7\u00ebrisht XPM. Vulnerabiliteti i tret\u00eb (CVE-2022-4883) lejon ekzekutimin e komandave t\u00eb rast\u00ebsishme gjat\u00eb ekzekutimit t\u00eb aplikacioneve q\u00eb p\u00ebrdorin libXpm. Gjat\u00eb ekzekutimit t\u00eb proceseve privilegjuar t\u00eb lidhura me libXpm, p\u00ebr shembull, programe me flag suid root, vulnerabiliteti ofron mund\u00ebsin\u00eb p\u00ebr t\u00eb rritur privilegjet. <\/p>\n
\u00c7do dob\u00ebsi shkaktohet nga ve\u00e7orit\u00eb e funksionimit t\u00eb libXpm me skedar\u00ebt e kompresuar XPM \u2014 gjat\u00eb p\u00ebrpunimit t\u00eb skedar\u00ebve XPM.Z ose XPM.gz, biblioteka, p\u00ebrmes thirrjes execlp(), nis utilitetet e jashtme t\u00eb dekompresimit (uncompress ose gunzip), rruga e t\u00eb cilave llogaritet n\u00eb baz\u00eb t\u00eb variabl\u00ebs mjedisore PATH. Sulmi konsiston n\u00eb vendosjen e skedar\u00ebve t\u00eb ekzekutuesh\u00ebm uncompress ose gunzip n\u00eb nj\u00eb katalog t\u00eb aksesuesh\u00ebm nga p\u00ebrdoruesi, i pranish\u00ebm n\u00eb list\u00ebn e PATH, q\u00eb do t\u00eb ekzekutohen n\u00eb rast se fillohet aplikacioni q\u00eb p\u00ebrdor libXpm. <\/p>\n
Dob\u00ebsia \u00ebsht\u00eb eliminuar duke z\u00ebvend\u00ebsuar thirrjen execlp me execl duke p\u00ebrdorur rrug\u00eb absolute p\u00ebr utilitetet. P\u00ebr m\u00eb tep\u00ebr, \u00ebsht\u00eb shtuar opsioni i nd\u00ebrtimit \u00ab\u2014disable-open-zfile\u00bb q\u00eb lejon \u00e7aktivizimin e p\u00ebrpunimit t\u00eb skedar\u00ebve t\u00eb kompresuar dhe thirrjes s\u00eb utiliteteve t\u00eb jashtme p\u00ebr dekompresim. \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"