{"id":124670,"date":"2025-05-13T03:05:07","date_gmt":"2025-05-13T01:05:07","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-gnu-screen-pozvolyayushhaya-vypolnit-kod-s-pravami-root"},"modified":"2025-05-13T03:05:07","modified_gmt":"2025-05-13T01:05:07","slug":"uyazvimost-v-gnu-screen-pozvolyayushhaya-vypolnit-kod-s-pravami-root","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-gnu-screen-pozvolyayushhaya-vypolnit-kod-s-pravami-root","title":{"rendered":"Vulnerabiliteti n\u00eb GNU screen, q\u00eb lejon ekzekutimin e kodit me t\u00eb drejta root","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
N\u00eb menaxherin e dritares konsol\u00eb (multiplexer t\u00eb terminaleve) GNU screen, i cili ofron nj\u00eb nd\u00ebrfaqe shum\u00eb-feneshe n\u00eb konsol\u00eb, jan\u00eb zbuluar 5 vulnerabilitete. Problemi m\u00eb i rreziksh\u00ebm (CVE-2025-23395) lejon marrjen e t\u00eb drejtave root n\u00eb sistem. Rregullimi \u00ebsht\u00eb p\u00ebrfshir\u00eb n\u00eb versionin e sot\u00ebm t\u00eb screen 5.0.1. <\/p>\n
Vulnerabiliteti CVE-2025-23395 manifestohet vet\u00ebm n\u00eb deg\u00ebn screen 5.0.0, e cila ofrohet n\u00eb Fedora Linux, Arch Linux, NetBSD, OpenBSD dhe Alpine. N\u00eb Debian, Ubuntu, RHEL (EPEL 9), Gentoo, FreeBSD, SUSE\/openSUSE dhe OpenWrt, vijon t\u00eb ofrohet dega screen 4.x. Shfryt\u00ebzimi i vulnerabilitetit \u00ebsht\u00eb i mundur n\u00eb sistemet q\u00eb instalojn\u00eb skedarin ekzekutiv screen me flamurin setuid root, si n\u00eb Arch Linux dhe NetBSD. N\u00eb Fedora, utilita instalohet me flamurin setgid p\u00ebr t\u00eb marr\u00eb t\u00eb drejtat e grupit screen, e cila lejon vendosjen e soket\u00ebve n\u00eb katalogun sistematik \/run\/screen, gj\u00eb q\u00eb kufizon mund\u00ebsit\u00eb e sulmeve t\u00eb refuzimit t\u00eb sh\u00ebrbimit. <\/p>\n
Vulnerabiliteti shkaktohet nga fakti se, kur startohet me t\u00eb drejtat root, funksioni logfile_reopen() ekzekutohet para se t\u00eb bien t\u00eb drejtat, por p\u00ebrpunon t\u00eb dh\u00ebnat n\u00eb kontekstin e katalog\u00ebve t\u00eb p\u00ebrdoruesit pa privilegje q\u00eb ka nisur screen. E ve\u00e7ant\u00eb \u00ebsht\u00eb se hapja fillestare e logut b\u00ebhet me rregullimin e sakt\u00eb t\u00eb privilegjeve, por kur hapet p\u00ebrs\u00ebri skedari i logut, rregullimi i privilegjeve nuk b\u00ebhet. <\/p>\n
P\u00ebrmes manipulimeve me aktivizimin e m\u00ebnyr\u00ebs s\u00eb regjistrimit t\u00eb sesioneve, p\u00ebrdoruesi mund t\u00eb arrij\u00eb t\u00eb shkruaj\u00eb t\u00eb dh\u00ebna n\u00eb nj\u00eb sked\u00eb me t\u00eb drejta root, nd\u00ebrkoh\u00eb q\u00eb skeda mund t\u00eb ruhet n\u00eb katalogun e sht\u00ebpis\u00eb s\u00eb p\u00ebrdoruesit. Sulmi p\u00ebrfshin fshirjen e sked\u00ebs s\u00eb krijuar me logun dhe z\u00ebvend\u00ebsimin e saj me nj\u00eb lidhje simbolike q\u00eb tregon n\u00eb ndonj\u00eb sked\u00eb tjet\u00ebr n\u00eb sistem. N\u00ebse skeda ekziston tashm\u00eb, t\u00eb dh\u00ebnat nga p\u00ebrmbajtja e ekranit n\u00eb sesionin e screen do t\u00eb shtohen atje pa ndryshuar pronarin. N\u00ebse skeda nuk ekziston, ajo do t\u00eb krijohet me t\u00eb drejta 0644, pronari do t\u00eb jet\u00eb root dhe grupi do t\u00eb jet\u00eb si ai i p\u00ebrdoruesit aktual. <\/p>\n
Algoritmi i sulmit, q\u00eb krijon sked\u00ebn \/etc\/profile.d\/exploit.sh me komand\u00ebn \u00abchown $USER \/root\u00bb: <\/p>\n
\n
Krijimi i nj\u00eb sesioni screen me aktivizimin e regjistrimit $ screen -Logfile $HOME\/screen.log\n
Shtypja e kombinimit t\u00eb \u00e7el\u00ebsave Ctrl-a-H p\u00ebr t\u00eb aktivizuar logun.\n
Fshirja e skedarit t\u00eb logut dhe z\u00ebvend\u00ebsimi i tij me nj\u00eb lidhje simbolike, e cila do t\u00eb \u00e7oj\u00eb n\u00eb krijimin e skedarit \/etc\/profile.d\/exploit.sh $ rm $HOME\/screen.log; ln -s \/etc\/profile.d\/exploit.sh $HOME\/screen.log\n
Kthimi n\u00eb sesionin e screen dhe shfaqja n\u00eb ekran e t\u00eb dh\u00ebnave q\u00eb do t\u00eb regjistrohen n\u00eb sked\u00ebn e logut. $ echo -e \u00ab\nchown $USER \/root;\u00bb\n
Pasi q\u00eb root-i i v\u00ebrtet\u00eb t\u00eb lidhet me sistemin, do t\u00eb ekzekutohet skripti \/etc\/profile.d\/exploit.sh, i cili do t\u00eb ndryshoj\u00eb pronarin p\u00ebr katalogun \/root. $ ls -lhd \/root drwxr-x\u2014 5 user root 4.0K Dec 30 2020 .\n
N\u00eb m\u00ebnyr\u00eb t\u00eb ngjashme, mund t\u00eb krijoni skedar\u00eb konfigurimi sudo ose t\u00eb shtoni komanda n\u00eb fund t\u00eb skenareve sistemike. <\/ul>\n
Vulnerabilitete m\u00eb pak t\u00eb rrezikshme n\u00eb screen: <\/p>\n
\n
CVE-2025-46802 \u2014 kapja e pajisjes TTY n\u00eb sesionet multi-p\u00ebrdorues (p\u00ebrdoruesi mund t\u00eb arrij\u00eb t\u00eb vendos\u00eb p\u00ebr pajisjen \/dev\/pts\/1 t\u00eb drejtat crw-rw-rw-). Problemi shfaqet n\u00eb deg\u00ebt screen 4.x dhe 5.x.\n
CVE-2025-46803 \u2014 vendosja si parazgjedhje e t\u00eb drejtave 0622 p\u00ebr pajisjen PTY, duke lejuar t\u00eb shkruajn\u00eb \u00e7do p\u00ebrdorues. Problemi shfaqet vet\u00ebm n\u00eb deg\u00ebn screen 5.0.\n
CVE-2025-46804 \u2014 rrjedhja e informacionit p\u00ebr pranin\u00eb e skedave dhe katalog\u00ebve n\u00eb katalog\u00eb t\u00eb mbyllur (kur p\u00ebrcaktohet katalogu p\u00ebr socket-at, duke p\u00ebrdorur variabl\u00ebn ambientale SCREENDIR, utilita jep mesazhe t\u00eb ndryshme gabimi, duke lejuar t\u00eb kuptohet pranin\u00eb e skedave dhe katalog\u00ebve me k\u00ebt\u00eb em\u00ebr). Problemi shfaqet n\u00eb deg\u00ebt screen 4.x dhe 5.x.\n
CVE-2025-46805 \u2014 gjendja e gar\u00ebs gjat\u00eb d\u00ebrgimit t\u00eb sinjaleve SIGCONT dhe SIGHUP, q\u00eb \u00e7on n\u00eb munges\u00eb sh\u00ebrbimi. Problemi shfaqet n\u00eb deg\u00ebt screen 4.x dhe 5.x.\n
P\u00ebrdorimi i pap\u00ebrshtatsh\u00ebm i funksionit strncpy (k\u00ebmbimi i strcpy me strncpy pa marr\u00eb parasysh ndryshimin n\u00eb trajtimin e simboleve null \u00ab\u00bb), q\u00eb \u00e7on n\u00eb mbyllje t\u00eb gabuar gjat\u00eb ekzekutimit t\u00eb komandave t\u00eb strukturuara posa\u00e7\u00ebrisht. Problemi shfaqet vet\u00ebm n\u00eb deg\u00ebn screen 5.0. <\/ul>\n
Vulnerabilitetet jan\u00eb zbuluar gjat\u00eb auditi t\u00eb kodit burimor t\u00eb GNU screen, i kryer nga ekipi p\u00ebrgjegj\u00ebs p\u00ebr sigurin\u00eb e shp\u00ebrndarjes SUSE Linux. Informacionin mbi vulnerabilitetin iu d\u00ebrgua zhvilluesve t\u00eb screen m\u00eb 7 shkurt, por gjat\u00eb 90 dit\u00ebve t\u00eb dh\u00ebna ata nuk arrit\u00ebn t\u00eb p\u00ebrgatitin rregullime p\u00ebr t\u00eb gjitha vulnerabilitetet dhe punonj\u00ebsit e SUSE duhej t\u00eb p\u00ebrgatitnin disa patches vet\u00eb. Sipas mendimit t\u00eb hulumtuesve q\u00eb kryen auditin, zhvilluesit aktual\u00eb t\u00eb GNU screen nuk jan\u00eb mjaft t\u00eb njohur me kodin e projektit dhe nuk jan\u00eb n\u00eb gjendje t\u00eb zgjidhin plot\u00ebsisht problemet e identifikuara t\u00eb siguris\u00eb. \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"