{"id":55016,"date":"2020-01-10T00:00:00","date_gmt":"2020-01-09T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/uyazvimost-v-e2fsck-proyavlyayushhayasya-pri-obrabotke-spetsialno-oformlennyh-katalogov"},"modified":"2020-02-18T14:03:05","modified_gmt":"2020-02-18T11:03:05","slug":"uyazvimost-v-e2fsck-proyavlyayushhayasya-pri-obrabotke-spetsialno-oformlennyh-katalogov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-e2fsck-proyavlyayushhayasya-pri-obrabotke-spetsialno-oformlennyh-katalogov","title":{"rendered":"Vulnerabilitet n\u00eb e2fsck, i shfaqur gjat\u00eb p\u00ebrpunimit t\u00eb katalog\u00ebve t\u00eb ve\u00e7anta","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

N\u00eb utilitarin e2fsck, i ofruar me paket\u00ebn e2fsprogs<\/a><\/noindex>, u zbulua<\/a><\/noindex> vulnerabiliteti<\/a><\/noindex> (CVE-2019-5188<\/a><\/noindex>), i cili lejon ekzekutimin e kodit nga sulmuesi gjat\u00eb kontrollit t\u00eb sistemit t\u00eb skedar\u00ebve q\u00eb p\u00ebrmban katalog\u00eb t\u00eb formatuar n\u00eb nj\u00eb m\u00ebnyr\u00eb specifike. Prania e k\u00ebsaj dob\u00ebsie \u00ebsht\u00eb konfirmuar n\u00eb versionet nga 1.43.3 deri n\u00eb 1.45.4. Dob\u00ebsia \u00ebsht\u00eb zhdukur n\u00eb p\u00ebrdit\u00ebsimin e2fsck 1.45.5<\/a><\/noindex>. N\u00eb shp\u00ebrndarjet e tjera problemi ende mbetet i pazgjidhur (Debian<\/a><\/noindex>, Arch Linux<\/a><\/noindex>, SUSE\/openSUSE<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, RHEL<\/a><\/noindex>).<\/p>\n

Dob\u00ebsia shkaktohet nga nj\u00eb gabim n\u00eb funksionin mutate_name() nga skedari rehash.c, i aplikuar gjat\u00eb rind\u00ebrtimit t\u00eb tabelave t\u00eb heshit t\u00eb lidhura me katalogun, q\u00eb sigurojn\u00eb p\u00ebrputhjen me katalogun e t\u00eb gjith\u00eb skedareve q\u00eb ndodhen n\u00eb t\u00eb. D\u00ebmtimi i struktur\u00ebs hash_entry t\u00eb lidhur me katalogun mund t\u00eb \u00e7oj\u00eb n\u00eb shkruajtjen e t\u00eb dh\u00ebnave nga sulmuesi jasht\u00eb buferit t\u00eb rezervuar. N\u00eb rastin e identifikimit n\u00eb tabel\u00ebn e heshit t\u00eb lidhjes me katalogun t\u00eb disa skedareve me t\u00eb nj\u00ebjtin em\u00ebr, utilitari e2fsck riem\u00ebron skedaret e p\u00ebrs\u00ebritura duke shtuar n\u00eb em\u00ebr ~0, ~1 dhe k\u00ebshtu me radh\u00eb. P\u00ebr ruajtjen e p\u00ebrkohshme t\u00eb emrit t\u00eb ri gjat\u00eb k\u00ebtij riem\u00ebrimi, n\u00eb grumbull rezervohen 256 byte. <\/p>\n

Madh\u00ebsia e t\u00eb dh\u00ebnave q\u00eb kopjohen p\u00ebrcaktohet nga shprehja «entry->name_len & 0xff», por vlera e entry->name_len ngarkohet nga struktura n\u00eb disk, e cila nuk llogaritet n\u00eb baz\u00eb t\u00eb madh\u00ebsis\u00eb reale t\u00eb emrit. N\u00ebse madh\u00ebsia \u00ebsht\u00eb zero, indeksi i array merr vler\u00ebn -1 dhe krijohen kushte p\u00ebr mbiprodhimin e numrave t\u00eb t\u00ebr\u00eb p\u00ebrmes posht\u00ebsis\u00eb s\u00eb tamponit (integer underflow) dhe shkrimit t\u00eb t\u00eb dh\u00ebnave t\u00eb tjera n\u00eb grack\u00eb me vler\u00ebn «~0». P\u00ebr sistemet 64-bit eksploitimi i k\u00ebtij dob\u00ebsie vler\u00ebsohet si e paimagjinueshme dhe k\u00ebrkonte munges\u00ebn e kufizimeve mbi madh\u00ebsin\u00eb e tamponit (ulimit -s unlimited). P\u00ebr sistemet 32-bit, eksploitimi konsiderohet i mundsh\u00ebm, por rezultati varet shum\u00eb nga m\u00ebnyra se si \u00ebsht\u00eb nd\u00ebrtuar skedari ekzekutues nga kompjilatori.<\/p>\n

P\u00ebr t\u00eb kryer nj\u00eb sulm, sulmuesi duhet t\u00eb d\u00ebmtoj\u00eb t\u00eb dh\u00ebnat n\u00eb nj\u00eb seksion me FS ext2, ext3 ose ext4. Duke qen\u00eb se kjo operacion k\u00ebrkon privilegje superp\u00ebrdoruesi, dob\u00ebsia paraqet nj\u00eb k\u00ebrc\u00ebnim kur utilitari e2fsck kontrollon disqet e jasht\u00ebm ose imazhet e FS t\u00eb marra nga jasht\u00eb.<\/p>\n

<\/a><\/noindex><\/p>\n

Burimi: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0443\u0442\u0438\u043b\u0438\u0442\u0435 e2fsck, \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0439 \u0432 \u0441\u043e\u0441\u0442\u0430\u0432\u0435 \u043f\u0430\u043a\u0435\u0442\u0430 e2fsprogs, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2019-5188), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430 \u043f\u0440\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0435\u0439 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0435 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0438. \u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u043e \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 \u0441 1.43.3 \u043f\u043e 1.45.4. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438 e2fsck 1.45.5. \u0412 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u043e\u043a\u0430 \u043e\u0441\u0442\u0430\u0451\u0442\u0441\u044f \u043d\u0435\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u043e\u0439 (Debian, Arch Linux, SUSE\/openSUSE, Ubuntu, RHEL). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u0437\u0432\u0430\u043d\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-55016","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Dob\u00ebsia n\u00eb e2fsck, e cila shfaqet gjat\u00eb p\u00ebrpunimit t\u00eb katalog\u00ebve t\u00eb formatuar n\u00eb m\u00ebnyr\u00eb specifike | ProHoster","description":"N\u00eb utilitarin e2fsck, i ofruar me paket\u00ebn e2fsprogs,","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-e2fsck-proyavlyayushhayasya-pri-obrabotke-spetsialno-oformlennyh-katalogov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 e2fsck, \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u044e\u0449\u0430\u044f\u0441\u044f \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u043e\u0432 | ProHoster","og:description":"\u0412 \u0443\u0442\u0438\u043b\u0438\u0442\u0435 e2fsck, \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0439 \u0432 \u0441\u043e\u0441\u0442\u0430\u0432\u0435 \u043f\u0430\u043a\u0435\u0442\u0430 e2fsprogs,","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-e2fsck-proyavlyayushhayasya-pri-obrabotke-spetsialno-oformlennyh-katalogov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-01-09T21:00:00+00:00","article:modified_time":"2020-02-18T11:03:05+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"55016","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 13:31:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:21:08","updated":"2026-01-24 13:31:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/55016","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=55016"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/55016\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=55016"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=55016"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=55016"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}