{"id":112583,"date":"2023-12-30T09:10:13","date_gmt":"2023-12-30T07:10:13","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-gnu-inetutils-2-5-s-ustraneniem-uyazvimosti-v-suid-prilozheniyah"},"modified":"2023-12-30T09:10:13","modified_gmt":"2023-12-30T07:10:13","slug":"vypusk-gnu-inetutils-2-5-s-ustraneniem-uyazvimosti-v-suid-prilozheniyah","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/vypusk-gnu-inetutils-2-5-s-ustraneniem-uyazvimosti-v-suid-prilozheniyah","title":{"rendered":"Publikimi i GNU inetutils 2.5 me riparimin e dob\u00ebsis\u00eb n\u00eb aplikacionet suid","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Pas 14 muajsh zhvillimi, \u00ebsht\u00eb formuar l\u00ebshimi i paket\u00ebs GNU inetutils 2.5 me nj\u00eb koleksion programesh rrjeti, shumica e t\u00eb cilave jan\u00eb transferuar nga sistemet BSD. N\u00eb ve\u00e7anti, p\u00ebrfshihen inetd dhe syslogd, serverat dhe klient\u00ebt p\u00ebr ftp, telnet, rsh, rlogin, tftp dhe talk, si dhe utilitetet tipike si ping, ping6, traceroute, whois, hostname, dnsdomainname, ifconfig, logger etj. <\/p>\n
N\u00eb versionin e ri \u00ebsht\u00eb eliminuar nj\u00eb dob\u00ebsi (CVE-2023-40303) n\u00eb programet e sundimit ftpd, rcp, rlogin, rsh, rshd dhe uucpd, e shkaktuar nga mungesa e kontrollit t\u00eb vlerave q\u00eb kthehen nga funksionet setuid(), setgid(), seteuid() dhe setguid(). Dob\u00ebsia mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb krijuar kushte kur thirrja e set*id() nuk do t\u00eb \u00e7oj\u00eb n\u00eb humbjen e privilegjeve dhe aplikacioni do t\u00eb vazhdoj\u00eb t\u00eb punoj\u00eb me privilegje t\u00eb rritura dhe do t\u00eb kryej\u00eb operacione fillimisht t\u00eb parashikuara p\u00ebr t'u kryer me t\u00eb drejtat e nj\u00eb p\u00ebrdoruesi pa privilegje. P\u00ebr shembull, proceset ftpd, uucpd dhe rshd, q\u00eb nisen me t\u00eb drejtat root, n\u00eb rast t\u00eb d\u00ebshtimit n\u00eb thirrjen e set*id() do t\u00eb vazhdojn\u00eb t\u00eb p\u00ebrdorin t\u00eb drejtat root pas nisjes s\u00eb seancave t\u00eb p\u00ebrdoruesve. <\/p>\n
P\u00ebrve\u00e7 rregullimit t\u00eb dob\u00ebsive dhe gabimeve t\u00eb vogla n\u00eb versionin e ri, utilitarit ping6 i \u00ebsht\u00eb shtuar mb\u00ebshtetje p\u00ebr mesazhet ICMPv6 me informacion mbi paaft\u00ebsin\u00eb p\u00ebr t\u00eb arritur hostin e synuar (\"destination unreachable\", RFC 4443). <\/p>\n