{"id":123909,"date":"2025-05-01T15:05:06","date_gmt":"2025-05-01T13:05:06","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-sisteme-iniczializaczii-finit-pozvolyayushhaya-vojti-v-sistemu-bez-parolya"},"modified":"2025-05-01T15:05:06","modified_gmt":"2025-05-01T13:05:06","slug":"uyazvimost-v-sisteme-iniczializaczii-finit-pozvolyayushhaya-vojti-v-sistemu-bez-parolya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimost-v-sisteme-iniczializaczii-finit-pozvolyayushhaya-vojti-v-sistemu-bez-parolya","title":{"rendered":"Vulnerabilitet n\u00eb sistemin e inicializimit finit, q\u00eb lejon hyrjen n\u00eb sistem pa fjal\u00ebkalim","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
N\u00eb sistemin e inicializimit finit \u00ebsht\u00eb identifikuar nj\u00eb dob\u00ebsi (CVE-2025-29906), e cila lejon hyrjen n\u00eb sistem si cilindo p\u00ebrdorues pa verifikimin e fjal\u00ebkalimit. Ekspozimi i k\u00ebsaj dob\u00ebsie realizohet p\u00ebrmes manipulimit me ftes\u00ebn e hyrjes (login) dhe k\u00ebrkon akses n\u00eb konsol\u00eb. Dob\u00ebsia shfaqet q\u00eb nga versioni 3.0 (t\u00eb tetorin 2017) dhe \u00ebsht\u00eb rregulluar n\u00eb versionin finit 4.11. M\u00eb pas \u00ebsht\u00eb formuar versioni 4.12, n\u00eb t\u00eb cilin \u00ebsht\u00eb eliminuar mbipopullimi i tamponit n\u00eb plugin-in urandom, q\u00eb nuk ishte sh\u00ebnuar si dob\u00ebsi. <\/p>\n
Vulnerabiliteti preket implementimin e programit getty, i cili shfaq nj\u00eb ftes\u00eb hyr\u00ebse n\u00eb terminal dhe nis procesin \/bin\/login p\u00ebr autentifikimin e p\u00ebrdoruesit. Vulnerabiliteti shkaktohet nga mungesa e ndarjes s\u00eb argumenteve t\u00eb komand\u00ebs gjat\u00eb nisjes s\u00eb \/bin\/login, q\u00eb lejonte t\u00eb specifikohej opsioni «-f» n\u00eb emrin e p\u00ebrdoruesit, duke \u00e7aktivizuar verifikimin e fjal\u00ebkalimit (p\u00ebr shembull, mund t\u00eb shkruhej «-f root» n\u00eb vend t\u00eb «root»). Problemi \u00ebsht\u00eb zgjidhur duke shtuar argumentin «—» para fush\u00ebs me emrin e p\u00ebrdoruesit: — execl(_PATH_LOGIN, _PATH_LOGIN, «-p», name, NULL); + execl(_PATH_LOGIN, _PATH_LOGIN, «-p», «—«, name, NULL); <\/p>\n
Si nj\u00eb m\u00ebnyr\u00eb p\u00ebr t\u00eb bllokuar dob\u00ebsin\u00eb rekomandohet t\u00eb p\u00ebrdoret nj\u00eb implementim i jasht\u00ebm i procesit getty n\u00eb finit, p\u00ebr shembull, agetty. N\u00eb shp\u00ebrndarjet Debian 12, Ubuntu, Parrot, Raspbian dhe Trisquel, paketat me finit ende mbeten pa nj\u00eb korrektim t\u00eb dob\u00ebsis\u00eb. <\/p>\n
Sistemi i inicializimit Finit (Fast init) po zhvillohet si nj\u00eb alternativ\u00eb e thjesht\u00eb ndaj SysV init dhe systemd, dhe ka marr\u00eb popullaritet n\u00eb sistemet e inkorporuara. Projekti bazohet n\u00eb teknologjit\u00eb e sistemit t\u00eb inicializimit fastinit, t\u00eb p\u00ebrdorura n\u00eb firmware-n e laptop\u00ebve EeePC dhe \u00ebsht\u00eb e njohur p\u00ebr procesin e saj shum\u00eb t\u00eb shpejt\u00eb t\u00eb ngarkimit. Finit mb\u00ebshtet nivelet e ekzekutimit (runlevel) n\u00eb stilin e SysV init, ri-ngarkimin automatik t\u00eb sh\u00ebrbimeve n\u00eb rast d\u00ebshtimi, ekzekutimin e trajtuesve nj\u00eb her\u00eb, nisjen e sh\u00ebrbimeve duke marr\u00eb parasysh var\u00ebsit\u00eb dhe kushtet e rastit, lidhjen e trajtuesve t\u00eb tjer\u00eb p\u00ebr t\u00eb nisur p\u00ebrpara ose pas ekzekutimit t\u00eb sh\u00ebrbimit, zgjerimin e funksionalitetit p\u00ebrmes plug-ins, dhe konfigurimin e kufizimeve p\u00ebrmes Cgroups v2. \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"