{"id":112583,"date":"2023-12-30T09:10:13","date_gmt":"2023-12-30T07:10:13","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-gnu-inetutils-2-5-s-ustraneniem-uyazvimosti-v-suid-prilozheniyah"},"modified":"2023-12-30T09:10:13","modified_gmt":"2023-12-30T07:10:13","slug":"vypusk-gnu-inetutils-2-5-s-ustraneniem-uyazvimosti-v-suid-prilozheniyah","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/vypusk-gnu-inetutils-2-5-s-ustraneniem-uyazvimosti-v-suid-prilozheniyah","title":{"rendered":"L\u00ebshimi i GNU inetutils 2.5 me eliminimin e dob\u00ebsis\u00eb n\u00eb aplikacionet suid","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Pas 14 muajsh zhvillimi, \u00ebsht\u00eb formuar l\u00ebshimi i paket\u00ebs GNU inetutils 2.5 me nj\u00eb koleksion programesh rrjetesh, shumica e t\u00eb cilave jan\u00eb transferuar nga sistemet BSD. N\u00eb ve\u00e7anti, p\u00ebrfshihen inetd dhe syslogd, server\u00eb dhe klient\u00eb p\u00ebr ftp, telnet, rsh, rlogin, tftp dhe talk, si dhe utilitare t\u00eb zakonshme, si ping, ping6, traceroute, whois, hostname, dnsdomainname, ifconfig, logger etj. <\/p>\n
N\u00eb versionin e ri \u00ebsht\u00eb \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 nj\u00eb vulnerabilitet (CVE-2023-40303) n\u00eb programet suid ftpd, rcp, rlogin, rsh, rshd dhe uucpd, e shkaktuar nga mungesa e kontrollit t\u00eb vlerave t\u00eb kthyera nga funksionet setuid(), setgid(), seteuid() dhe setguid(). Vulnerabiliteti mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb krijuar kushte ku thirrja set*id() nuk do t\u00eb \u00e7oj\u00eb n\u00eb rikthimin e privilegjeve dhe aplikacioni vazhdon t\u00eb punoj\u00eb me privilegje t\u00eb rritura dhe t\u00eb kryej\u00eb operacione q\u00eb n\u00eb fillim ishin planifikuar p\u00ebr t\u00eb punuar me t\u00eb drejtat e p\u00ebrdoruesit t\u00eb pa privilegjuar. P\u00ebr shembull, proceset ftpd, uucpd dhe rshd, q\u00eb fillojn\u00eb me t\u00eb drejtat root, n\u00eb rast d\u00ebshtimi gjat\u00eb thirrjes set*id() do t\u00eb vazhdojn\u00eb t\u00eb p\u00ebrdorin t\u00eb drejtat root pas fillimit t\u00eb sesioneve t\u00eb p\u00ebrdoruesve. <\/p>\n