{"id":71318,"date":"2020-02-25T07:34:19","date_gmt":"2020-02-25T04:34:19","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimosti-v-opensmtpd-pozvolyayushhie-udalyonno-i-lokalno-poluchit-prava-root"},"modified":"2020-03-03T16:10:53","modified_gmt":"2020-03-03T13:10:53","slug":"uyazvimosti-v-opensmtpd-pozvolyayushhie-udalyonno-i-lokalno-poluchit-prava-root","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimosti-v-opensmtpd-pozvolyayushhie-udalyonno-i-lokalno-poluchit-prava-root","title":{"rendered":"Shfryt\u00ebzimet n\u00eb OpenSMTPD, t\u00eb cilat lejojn\u00eb aksesin e plot\u00eb root n\u00eb m\u00ebnyr\u00eb t\u00eb larg\u00ebt dhe lokale","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Kompania Qualys <noindex><a rel=\"nofollow\" href=\"https:\/\/www.openwall.com\/lists\/oss-security\/2020\/02\/24\/5\">ka identifikuar<\/a><\/noindex> nj\u00eb tjet\u00ebr dob\u00ebsi kritike t\u00eb larg\u00ebt (CVE-2020-8794) n\u00eb serverin e post\u00ebs <noindex><a rel=\"nofollow\" href=\"https:\/\/opensmtpd.org\/\">, shum\u00ebpjes\u00ebshi i terminalit tekstual (analog i GNU screen)<\/a><\/noindex>, e zhvilluar nga projekti OpenBSD. Ashtu si\u00e7 u zbulua n\u00eb fund t\u00eb janarit <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=52267\">vulnerabiliteti<\/a><\/noindex>, problemi i ri mund\u00ebson ekzekutimin e komandave t\u00eb rast\u00ebsishme shell n\u00eb server me t\u00eb drejtat e p\u00ebrdoruesit root. Dob\u00ebsia <noindex><a rel=\"nofollow\" href=\"https:\/\/www.mail-archive.com\/misc@opensmtpd.org\/msg04888.html\">i eliminuar<\/a><\/noindex> n\u00eb publikimin <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/OpenSMTPD\/OpenSMTPD\/releases\">OpenSMTPD 6.6.4p1<\/a><\/noindex>. <\/p>\n<p>Problemi shkaktohet nga nj\u00eb gabim n\u00eb kodin q\u00eb menaxhon d\u00ebrgimin e post\u00ebs n\u00eb nj\u00eb server t\u00eb larg\u00ebt (jo n\u00eb kodin q\u00eb p\u00ebrpunon lidhjet e ardhshme). Sulmi \u00ebsht\u00eb i mundur si nga ana e klientit, ashtu edhe nga ana e serverit. Nga ana e klientit, sulmi \u00ebsht\u00eb i mundur n\u00eb konfigurimin e OpenSMTPD me default, n\u00eb t\u00eb cilin OpenSMTPD pranon k\u00ebrkesat vet\u00ebm n\u00eb nd\u00ebrfaqen e brendshme t\u00eb rrjetit (localhost) dhe d\u00ebrgon mesazhe postare n\u00eb servera t\u00eb jasht\u00ebm. P\u00ebr t\u00eb shfryt\u00ebzuar dob\u00ebsin\u00eb, mjafton q\u00eb gjat\u00eb d\u00ebrgimit t\u00eb nj\u00eb letre, OpenSMTPD t\u00eb vendos\u00eb nj\u00eb sesion me nj\u00eb server t\u00eb post\u00ebs t\u00eb kontrolluar nga sulmuesi, ose q\u00eb sulmuesi t\u00eb mund t\u00eb nd\u00ebrhyj\u00eb n\u00eb lidhjen e klientit (MITM ose redirektim gjat\u00eb sulmeve p\u00ebrmes DNS ose BGP).<\/p>\n<p>P\u00ebr t\u00eb sulmuar nga ana e serverit, \u00ebsht\u00eb e nevojshme q\u00eb OpenSMTPD t\u00eb jet\u00eb i konfiguruar p\u00ebr t\u00eb pranuar k\u00ebrkesa t\u00eb jashtme t\u00eb rrjetit nga servera t\u00eb tjer\u00eb t\u00eb post\u00ebs ose t\u00eb sh\u00ebrbej\u00eb sh\u00ebrbime t\u00eb jashtme q\u00eb lejojn\u00eb d\u00ebrgimin e nj\u00eb k\u00ebrkese p\u00ebr email t\u00eb rast\u00ebsish\u00ebm (p.sh. forma t\u00eb konfirmimit t\u00eb adres\u00ebs n\u00eb website). P\u00ebr shembull, nj\u00eb sulmues mund t\u00eb lidhet me serverin OpenSMTPD dhe t\u00eb d\u00ebrgoj\u00eb nj\u00eb let\u00ebr t\u00eb pap\u00ebrshtatshme (p\u00ebr nj\u00eb p\u00ebrdorues q\u00eb nuk ekziston), e cila do t\u00eb shoq\u00ebrohet me nj\u00eb mesazh gabimi (bounce) q\u00eb kthehet n\u00eb serverin e sulmuesit. Sulmuesi mund t\u00eb shfryt\u00ebzoj\u00eb dob\u00ebsin\u00eb n\u00eb momentin kur OpenSMTPD lidhet p\u00ebr t\u00eb d\u00ebrguar nj\u00eb njoftim n\u00eb serverin e sulmuesit. Komandat shell t\u00eb infiluara gjat\u00eb sulmit vendosen n\u00eb nj\u00eb skedar q\u00eb ekzekutohet me t\u00eb drejtat e root n\u00eb rindizjen e OpenSMTPD, k\u00ebshtu q\u00eb sulmuesi p\u00ebr t\u00eb p\u00ebrfunduar sulmin duhet t\u00eb pres\u00eb rindizjen e OpenSMTPD ose t\u00eb nxis\u00eb d\u00ebshtimin e tij.<\/p>\n<p>\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 mta_io() \u0432 \u043a\u043e\u0434\u0435 \u0434\u043b\u044f \u0440\u0430\u0437\u0431\u043e\u0440\u0430 \u043c\u043d\u043e\u0433\u043e\u0441\u0442\u0440\u043e\u0447\u043d\u043e\u0433\u043e \u043e\u0442\u0432\u0435\u0442\u0430, \u0432\u043e\u0437\u0432\u0440\u0430\u0449\u0430\u0435\u043c\u043e\u0433\u043e \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u044b\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u043c \u043f\u043e\u0441\u043b\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, &#171;250-ENHANCEDSTATUSCODES&#187; \u0438 &#171;250 HELP&#187;). \u0412 OpenSMTPD \u0440\u0430\u0441\u0441\u0447\u0438\u0442\u0430\u043d\u043e, \u0447\u0442\u043e \u043f\u0435\u0440\u0432\u0430\u044f \u0441\u0442\u0440\u043e\u043a\u0430 \u0432\u043a\u043b\u044e\u0447\u0430\u0435\u0442 \u0442\u0440\u0451\u0445\u0437\u043d\u0430\u0447\u043d\u043e\u0435 \u0447\u0438\u0441\u043b\u043e \u0438 \u0442\u0435\u043a\u0441\u0442, \u0440\u0430\u0437\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u0435 \u0441\u0438\u043c\u0432\u043e\u043b\u043e\u043c &#171;-&#171;, \u0430 \u0432\u0442\u043e\u0440\u0430\u044f \u0441\u0442\u0440\u043e\u043a\u0430  \u0442\u0440\u0451\u0445\u0437\u043d\u0430\u0447\u043d\u043e\u0435 \u0447\u0438\u0441\u043b\u043e \u0438 \u0442\u0435\u043a\u0441\u0442, \u0440\u0430\u0437\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u0435 \u043f\u0440\u043e\u0431\u0435\u043b\u043e\u043c. \u0415\u0441\u043b\u0438 \u0432\u043e \u0432\u0442\u043e\u0440\u043e\u0439 \u0441\u0442\u0440\u043e\u043a\u0435 \u043f\u043e\u0441\u043b\u0435 \u0442\u0440\u0451\u0445\u0437\u043d\u0430\u0447\u043d\u043e\u0433\u043e \u0447\u0438\u0441\u043b\u0430 \u043d\u0435 \u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u043f\u0440\u043e\u0431\u0435\u043b \u0438 \u0442\u0435\u043a\u0441\u0442, \u0443\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044c, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0439 \u0434\u043b\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0442\u0435\u043a\u0441\u0442\u0430, \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043d\u0430 \u0431\u0430\u0439\u0442, \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0439 \u0437\u0430 \u0441\u0438\u043c\u0432\u043e\u043b\u043e\u043c &#8216;&#92;0&#8217;  \u0438 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442\u0441\u044f \u043f\u043e\u043f\u044b\u0442\u043a\u0430 \u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432 \u0431\u0443\u0444\u0435\u0440 \u0434\u0430\u043d\u043d\u044b\u0445, \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0445 \u043f\u043e\u0441\u043b\u0435 \u043a\u043e\u043d\u0446\u0430 \u0441\u0442\u0440\u043e\u043a\u0438.<\/p>\n<p>Me k\u00ebrkes\u00ebn e projektit OpenBSD, publikimi i detajeve p\u00ebr shfryt\u00ebzimin e dob\u00ebsis\u00eb \u00ebsht\u00eb shtyr\u00eb deri m\u00eb 26 shkurt, p\u00ebr t'u dh\u00ebn\u00eb p\u00ebrdoruesve mund\u00ebsin\u00eb p\u00ebr t\u00eb p\u00ebrdit\u00ebsuar sistemet e tyre. Problemi \u00ebsht\u00eb i pranish\u00ebm n\u00eb baz\u00ebn e kodit q\u00eb nga dhjetori 2015, por shfryt\u00ebzimi deri n\u00eb ekzekutimin e kodit me t\u00eb drejtat e root \u00ebsht\u00eb i mundur q\u00eb nga maji 2018. K\u00ebrkuesit kan\u00eb p\u00ebrgatitur nj\u00eb prototip funksional t\u00eb shfryt\u00ebzimit, i cili \u00ebsht\u00eb testuar me sukses n\u00eb nd\u00ebrtimet e OpenSMTPD p\u00ebr OpenBSD 6.6, OpenBSD 5.9, Debian 10, Debian 11 (testing) dhe Fedora 31. <\/p>\n<p>N\u00eb OpenSMTPD gjithashtu <noindex><a rel=\"nofollow\" href=\"https:\/\/www.openwall.com\/lists\/oss-security\/2020\/02\/24\/4\">u identifikua<\/a><\/noindex> nj\u00eb tjet\u00ebr dob\u00ebsi (CVE-2020-8793), e cila lejon nj\u00eb p\u00ebrdorues lokal t\u00eb lexoj\u00eb rreshtin e par\u00eb t\u00eb \u00e7do skedari n\u00eb sistem. P\u00ebr shembull, mund t\u00eb lexoni rreshtin e par\u00eb \/etc\/master.passwd, ku \u00ebsht\u00eb vendosur hash-i i fjal\u00ebkalimit t\u00eb p\u00ebrdoruesit root. Dob\u00ebsia gjithashtu lejon t\u00eb lexoni t\u00eb gjith\u00eb p\u00ebrmbajtjen e nj\u00eb skedari q\u00eb i p\u00ebrket nj\u00eb p\u00ebrdoruesi tjet\u00ebr, n\u00ebse ky skedar ndodhet n\u00eb t\u00eb nj\u00ebjt\u00ebn sisteme me katalogun \/var\/spool\/smtpd\/. Problemi nuk \u00ebsht\u00eb i shfryt\u00ebzuesh\u00ebm n\u00eb shum\u00eb distribucione Linux, ku vlera \/proc\/sys\/fs\/protected_hardlinks \u00ebsht\u00eb vendosur n\u00eb 1. <\/p>\n<p>Problemi \u00ebsht\u00eb rezultat i eliminimit t\u00eb paplot\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=43090\">problemeve<\/a><\/noindex>, \u043e\u0437\u0432\u0443\u0447\u0435\u043d\u043d\u044b\u0445 \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u0430\u0443\u0434\u0438\u0442\u0430, \u043f\u0440\u043e\u0432\u0435\u0434\u0451\u043d\u043d\u043e\u0433\u043e Qualys \u0432 2015 \u0433\u043e\u0434\u0443. \u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043c\u043e\u0436\u0435\u0442 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u0433\u0440\u0443\u043f\u043f\u044b &#171;_smtpq&#187;, \u0432\u044b\u0441\u0442\u0430\u0432\u0438\u0432 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u0443\u044e &#171;PATH=.&#187; \u0438 \u0440\u0430\u0437\u043c\u0435\u0441\u0442\u0438\u0432 \u0432 \u0442\u0435\u043a\u0443\u0449\u0435\u043c \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 \u0441\u043a\u0440\u0438\u043f\u0442 \u0441 \u0438\u043c\u0435\u043d\u0435\u043c makemap (\u0443\u0442\u0438\u043b\u0438\u0442\u0430 smtpctl \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442  makemap \u0431\u0435\u0437 \u044f\u0432\u043d\u043e\u0433\u043e \u0443\u043a\u0430\u0437\u0430\u043d\u0438\u044f \u043f\u0443\u0442\u0438). \u041f\u043e\u043b\u0443\u0447\u0438\u0432 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0433\u0440\u0443\u043f\u043f\u0435 &#171;_smtpq&#187; \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u0437\u0430\u0442\u0435\u043c \u043c\u043e\u0436\u0435\u0442 \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0433\u043e\u043d\u043a\u0438 (\u0441\u043e\u0437\u0434\u0430\u0442\u044c \u0431\u043e\u043b\u044c\u0448\u043e\u0439 \u0444\u0430\u0439\u043b \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 offline \u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0441\u0438\u0433\u043d\u0430\u043b SIGSTOP) \u0438, \u0434\u043e \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438, \u043f\u043e\u0434\u043c\u0435\u043d\u0438\u0442\u044c \u0444\u0430\u0439\u043b \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 offline  \u043d\u0430 \u0436\u0451\u0441\u0442\u043a\u0443\u044e \u0441\u0438\u043c\u0432\u043e\u043b\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0441\u0441\u044b\u043b\u043a\u0443, \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u044e\u0449\u0443\u044e \u043d\u0430 \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u0444\u0430\u0439\u043b, \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u043d\u0443\u0436\u043d\u043e \u043f\u0440\u043e\u0447\u0438\u0442\u0430\u0442\u044c.<\/p>\n<p>\u00cbsht\u00eb e r\u00ebnd\u00ebsishme t\u00eb theksohet se n\u00eb Fedora 31 dob\u00ebsia lejon menj\u00ebher\u00eb marrjen e privilegjeve t\u00eb grupit root, pasi procesi smtpctl \u00ebsht\u00eb i pajisur me flamurin setgid root, n\u00eb vend t\u00eb setgid smtpq. Pasi t\u00eb ket\u00eb akses n\u00eb grupin root, mund t\u00eb ri-shkruaj\u00eb p\u00ebrmbajtjen e \/var\/lib\/sss\/mc\/passwd dhe t\u00eb fitoj\u00eb qasje t\u00eb plot\u00eb root n\u00eb sistem.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Burimi: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=52423\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0435\u0449\u0451 \u043e\u0434\u043d\u0443 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u0443\u044e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-8794) \u0432 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 OpenSMTPD, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u043e\u043c \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c OpenBSD. \u041a\u0430\u043a \u0438 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u0430\u044f \u0432 \u043a\u043e\u043d\u0446\u0435 \u044f\u043d\u0432\u0430\u0440\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043d\u043e\u0432\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0434\u0430\u0451\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b shell \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f root. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0435 OpenSMTPD 6.6.4p1. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043e\u0448\u0438\u0431\u043a\u043e\u0439 \u0432 \u043a\u043e\u0434\u0435, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u044e\u0449\u0435\u043c \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0443 \u043f\u043e\u0447\u0442\u044b \u043d\u0430 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u044b\u0439 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u0439 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-71318","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 4.9.10 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0435\u0449\u0451 \u043e\u0434\u043d\u0443 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u0443\u044e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-8794) \u0432 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 OpenSMTPD, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u043e\u043c \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c OpenBSD. \u041a\u0430\u043a \u0438 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u0430\u044f \u0432 \u043a\u043e\u043d\u0446\u0435 \u044f\u043d\u0432\u0430\u0440\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043d\u043e\u0432\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0434\u0430\u0451\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b shell \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f root. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0435 OpenSMTPD 6.6.4p1. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043e\u0448\u0438\u0431\u043a\u043e\u0439 \u0432 \u043a\u043e\u0434\u0435, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u044e\u0449\u0435\u043c \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0443 \u043f\u043e\u0447\u0442\u044b \u043d\u0430 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u044b\u0439 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u0439\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimosti-v-opensmtpd-pozvolyayushhie-udalyonno-i-lokalno-poluchit-prava-root\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 4.9.10\" \/>\n\t\t<meta property=\"og:locale\" content=\"sq_AL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 OpenSMTPD, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0438 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0435\u0449\u0451 \u043e\u0434\u043d\u0443 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u0443\u044e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-8794) \u0432 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 OpenSMTPD, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u043e\u043c \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c OpenBSD. \u041a\u0430\u043a \u0438 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u0430\u044f \u0432 \u043a\u043e\u043d\u0446\u0435 \u044f\u043d\u0432\u0430\u0440\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043d\u043e\u0432\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0434\u0430\u0451\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b shell \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f root. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0435 OpenSMTPD 6.6.4p1. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043e\u0448\u0438\u0431\u043a\u043e\u0439 \u0432 \u043a\u043e\u0434\u0435, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u044e\u0449\u0435\u043c \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0443 \u043f\u043e\u0447\u0442\u044b \u043d\u0430 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u044b\u0439 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u0439\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimosti-v-opensmtpd-pozvolyayushhie-udalyonno-i-lokalno-poluchit-prava-root\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-02-25T04:34:19+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-03-03T13:10:53+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Dob\u00ebsit\u00eb n\u00eb OpenSMTPD, q\u00eb lejojn\u00eb marrjen e t\u00eb drejtave root n\u00eb distanc\u00eb dhe lokal | ProHoster","description":"Kompania Qualys zbuloi nj\u00eb tjet\u00ebr dob\u00ebsi kritike t\u00eb larg\u00ebt (CVE-2020-8794) n\u00eb serverin e post\u00ebs OpenSMTPD, zhvilluar nga projekti OpenBSD. Si dob\u00ebsia e zbuluar n\u00eb fund t\u00eb janarit, problemi i ri lejon ekzekutimin e komandave t\u00eb rast\u00ebsishme shell n\u00eb server me t\u00eb drejtat e p\u00ebrdoruesit root. Dob\u00ebsia \u00ebsht\u00eb rregulluar n\u00eb l\u00ebshimin OpenSMTPD 6.6.4p1. Problemi \u00ebsht\u00eb shkaktuar nga nj\u00eb gabim n\u00eb kodin q\u00eb ekzekuton d\u00ebrgimin e post\u00ebs n\u00eb nj\u00eb adres\u00eb t\u00eb larg\u00ebt.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimosti-v-opensmtpd-pozvolyayushhie-udalyonno-i-lokalno-poluchit-prava-root","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 OpenSMTPD, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0438 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0435\u0449\u0451 \u043e\u0434\u043d\u0443 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u0443\u044e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-8794) \u0432 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 OpenSMTPD, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u043e\u043c \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c OpenBSD. \u041a\u0430\u043a \u0438 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u0430\u044f \u0432 \u043a\u043e\u043d\u0446\u0435 \u044f\u043d\u0432\u0430\u0440\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043d\u043e\u0432\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0434\u0430\u0451\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b shell \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f root. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0435 OpenSMTPD 6.6.4p1. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043e\u0448\u0438\u0431\u043a\u043e\u0439 \u0432 \u043a\u043e\u0434\u0435, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u044e\u0449\u0435\u043c \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0443 \u043f\u043e\u0447\u0442\u044b \u043d\u0430 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u044b\u0439 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u0439","og:url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimosti-v-opensmtpd-pozvolyayushhie-udalyonno-i-lokalno-poluchit-prava-root","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-25T04:34:19+00:00","article:modified_time":"2020-03-03T13:10:53+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"71318","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:04:24","updated":"2022-09-28 08:07:40"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/71318","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=71318"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/71318\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=71318"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=71318"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=71318"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}