ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™ ืื™ืŸ ืกื•ื“ืึธ ืึทื– ืึทืœืึทื•ื– ืคึผืจื™ื•ื•ื™ืœืขื’ื™ืข ืขืกืงืึทืœื™ืจื•ื ื’ ื•ื•ืขืŸ ื ื™ืฆืŸ ืกืคึผืขืฆื™ืคื™ืฉ ื›ึผืœืœื™ื

ืื™ืŸ ื“ื™ ื ื•ืฆืŸ ืกื•ื“ืึธ, ื’ืขื ื™ืฆื˜ ืฆื• ืึธืจื’ืึทื ื™ื–ื™ืจืŸ ื“ื™ ื“ื•ืจื›ืคื™ืจื•ื ื’ ืคื•ืŸ ืงืึทืžืึทื ื“ื– ืื•ื™ืฃ ื‘ื™ื›ืึทืฃ ืคื•ืŸ ืื ื“ืขืจืข ื ื™ืฆืขืจืก, ื™ื™ื“ืขื ืึทืคื™ื™ื“ ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™ (CVE-2019-14287), ื•ื•ืึธืก ืึทืœืึทื•ื– ืื™ืจ ืฆื• ื•ื™ืกืคื™ืจืŸ ืงืึทืžืึทื ื“ื– ืžื™ื˜ ื•ื•ืึธืจืฆืœ ืจืขื›ื˜, ืื•ื™ื‘ ืขืก ื–ืขื ืขืŸ ื›ึผืœืœื™ื ืื™ืŸ ื“ื™ ืกื•ื“ืึธืขืจืก ืกืขื˜ื˜ื™ื ื’ืก ืื™ืŸ ื•ื•ืึธืก ืื™ืŸ ื“ื™ ื‘ืึทื ื™ืฆืขืจ ืฉื™ื™ึทืŸ ื˜ืฉืขืง ืึธืคึผื˜ื™ื™ืœื•ื ื’ ื ืึธืš ื“ื™ ืึทืœืึทื•ื™ื ื’ ืงื™ื•ื•ืขืจื“ "ืึทืœืข" ืขืก ืื™ื– ืึท ื™ืงืกืคึผืœื™ืกืึทื˜ ืคืึทืจื•ื•ืขืจ ืฆื• ืœื•ื™ืคืŸ ืžื™ื˜ ื•ื•ืึธืจืฆืœ ืจืขื›ื˜ ("... (ืึทืœืข,! ื•ื•ืึธืจืฆืœ) ..." ). ื“ื™ ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™ ืงืขืŸ ื ื™ืฉื˜ ื“ืขืจืฉื™ื™ึทื ืขืŸ ืื™ืŸ ืคืขืœื™ืงื™ื™ึทื˜ ืงืึทื ืคื™ื’ื™ืขืจื™ื™ืฉืึทื ื– ืื™ืŸ ื“ื™ืกื˜ืจื™ื‘ื™ื•ืฉืึทื ื–.

ืื•ื™ื‘ ืกื•ื“ืึธืขืจืก ื”ืึธื‘ืŸ ื’ื™ืœื˜ื™ืง, ืึธื‘ืขืจ ื’ืึธืจ ื–ืขืœื˜ืŸ ืื™ืŸ ืคื™ืจ, ื›ึผืœืœื™ื ื•ื•ืึธืก ืœืึธื–ืŸ ื“ื™ ื“ื•ืจื›ืคื™ืจื•ื ื’ ืคื•ืŸ ืึท ื–ื™ื›ืขืจ ื‘ืึทืคึฟืขืœ ืื•ื ื˜ืขืจ ื“ื™ UID ืคื•ืŸ ืงื™ื™ืŸ ื‘ืึทื ื™ืฆืขืจ ืื ื“ืขืจืข ื•ื•ื™ ื•ื•ืึธืจืฆืœ, ืึท ืึทื˜ืึทืงืขืจ ื•ื•ืึธืก ื”ืื˜ ื“ื™ ืื•ื™ื˜ืึธืจื™ื˜ืขื˜ ืฆื• ื•ื™ืกืคื™ืจืŸ ื“ืขื ื‘ืึทืคึฟืขืœ ืงืขื ืขืŸ ื‘ื™ื™ืคึผืึทืก ื“ื™ ื’ืขื’ืจื™ื ื“ืขื˜ ืจื™ืกื˜ืจื™ืงืฉืึทืŸ ืื•ืŸ ื•ื™ืกืคื™ืจืŸ ื“ืขื ื‘ืึทืคึฟืขืœ ืžื™ื˜ ื•ื•ืึธืจืฆืœ ืจืขื›ื˜. ืฆื• ื‘ื™ื™ืคึผืึทืก ื“ื™ ื‘ืึทื’ืจืขื ืขืฆื•ื ื’, ื ืึธืจ ืคึผืจื•ื‘ื™ืจืŸ ืฆื• ื•ื™ืกืคื™ืจืŸ ื“ื™ ื‘ืึทืคึฟืขืœ ืกืคึผืขืกื™ืคื™ืขื“ ืื™ืŸ ื“ื™ ืกืขื˜ื˜ื™ื ื’ืก ืžื™ื˜ UID "-1" ืึธื“ืขืจ "4294967295", ื•ื•ืึธืก ื•ื•ืขื˜ ืคื™ืจืŸ ืฆื• ื–ื™ื™ืŸ ื“ื•ืจื›ืคื™ืจื•ื ื’ ืžื™ื˜ UID 0.

ืคึฟืึทืจ ื‘ื™ื™ึทืฉืคึผื™ืœ, ืื•ื™ื‘ ืขืก ืื™ื– ืึท ื”ืขืจืฉืŸ ืื™ืŸ ื“ื™ ืกืขื˜ื˜ื™ื ื’ืก ื•ื•ืึธืก ื’ื™ื˜ ืงื™ื™ืŸ ื‘ืึทื ื™ืฆืขืจ ื“ื™ ืจืขื›ื˜ ืฆื• ื•ื™ืกืคื™ืจืŸ ื“ืขื ืคึผืจืึธื’ืจืึทื /usr/bin/id ืื•ื ื˜ืขืจ ืงื™ื™ืŸ UID:

myhost ALL = (ืึทืœืข,! ื•ื•ืึธืจืฆืœ) /usr/bin/id

ืึธื“ืขืจ ืึทืŸ ืึธืคึผืฆื™ืข ื•ื•ืึธืก ืึทืœืึทื•ื– ื“ื•ืจื›ืคื™ืจื•ื ื’ ื‘ืœื•ื™ื– ืคึฟืึทืจ ืึท ืกืคึผืขืฆื™ืคื™ืฉ ื‘ืึทื ื™ืฆืขืจ ื‘ืึธื‘:

myhost bob = (ืึทืœืข,! ื•ื•ืึธืจืฆืœ) /ื•ืกืจ/ื‘ื™ืŸ/ื™ื“

ื“ืขืจ ื‘ืึทื ื™ืฆืขืจ ืงืขื ืขืŸ ื•ื™ืกืคื™ืจืŸ "sudo -u '#-1' ืฉื™ื™ึทืŸ" ืื•ืŸ ื“ื™ /usr/bin/id ื ื•ืฆืŸ ื•ื•ืขื˜ ื–ื™ื™ืŸ ืœืึธื ื˜ืฉื˜ ื•ื•ื™ ื•ื•ืึธืจืฆืœ, ื˜ืจืึธืฅ ื“ืขื ื™ืงืกืคึผืœื™ืกืึทื˜ ืคืึทืจื•ื•ืขืจ ืื™ืŸ ื“ื™ ืกืขื˜ื˜ื™ื ื’ืก. ื“ืขืจ ืคึผืจืึธื‘ืœืขื ืื™ื– ื’ืขืคึฟื™ืจื˜ ื“ื•ืจืš ืึธื•ื•ื•ืขืจืœื•ืงื™ื ื’ ื“ื™ ืกืคึผืขืฆื™ืขืœ ื•ื•ืึทืœื•ืขืก "-1" ืึธื“ืขืจ "4294967295", ื•ื•ืึธืก ื˜ืึธืŸ ื ื™ื˜ ืคื™ืจืŸ ืฆื• ืึท ืขื ื“ืขืจื•ื ื’ ืื™ืŸ UID, ืึธื‘ืขืจ ื–ื™ื ื˜ ืกื•ื“ืึธ ื–ื™ืš ืื™ื– ืฉื•ื™ืŸ ืคืœื™ืกื ื“ื™ืง ื•ื•ื™ ื•ื•ืึธืจืฆืœ, ืึธืŸ ื˜ืฉืึทื ื’ื™ื ื’ ื“ื™ UID, ื“ื™ ืฆื™ืœ ื‘ืึทืคึฟืขืœ ืื™ื– ืื•ื™ืš ืœืึธื ื˜ืฉื˜ ืžื™ื˜ ื•ื•ืึธืจืฆืœ ืจืขื›ื˜.

ืื™ืŸ SUSE ืื•ืŸ openSUSE ื“ื™ืกื˜ืจื™ื‘ื™ื•ืฉืึทื ื–, ืึธืŸ ืกืคึผืขืฆื™ืคื™ืฆื™ืจืŸ "NOPASSWD" ืื™ืŸ ื“ื™ ื”ืขืจืฉืŸ, ืขืก ืื™ื– ืึท ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™ ื ื™ื˜ ืขืงืกืคึผืœื•ื™ื˜ืึทื‘ืึทืœ, ื–ื™ื ื˜ ืื™ืŸ ืกื•ื“ืึธืขืจืก ื“ื™ "ื“ื™ืคืึธืœืฅ ื˜ืึทืจื’ืขื˜ืคึผื•ื•" ืžืึธื“ืข ืื™ื– ืขื ื™ื™ื‘ืึทืœื“ ื“ื•ืจืš ืคืขืœื™ืงื™ื™ึทื˜, ื•ื•ืึธืก ื˜ืฉืขืงืก ื“ื™ UID ืงืขื’ืŸ ื“ื™ ืคึผืึทืจืึธืœ ื“ืึทื˜ืึทื‘ื™ื™ืก ืื•ืŸ ืคึผืจืึทืžืคึผืก ืื™ืจ ืึทืจื™ื™ึทืŸ ื“ื™ ืฆื™ืœ ื‘ืึทื ื™ืฆืขืจ ืก ืคึผืึทืจืึธืœ. ืคึฟืึทืจ ืึทื–ืึท ืกื™ืกื˜ืขืžืขืŸ, ืึท ื‘ืึทืคืึทืœืŸ ืงืขื ืขืŸ ื–ื™ื™ืŸ ื“ื•ืจื›ื’ืขืงืึธื›ื˜ ื‘ืœื•ื™ื– ืื•ื™ื‘ ืขืก ื–ืขื ืขืŸ ื›ึผืœืœื™ื ืคื•ืŸ ื“ื™ ืคืึธืจืขื:

myhost ALL = (ืึทืœืข,! ื•ื•ืึธืจืฆืœ) NOPASSWD: /usr/bin/id

ืึทืจื•ื™ืกื’ืขื‘ืŸ ืคืึทืจืคืขืกื˜ื™ืงื˜ ืื™ืŸ ืžืขืœื“ื•ื ื’ ืกื•ื“ืึธ 1.8.28. ื“ื™ ืคืึทืจืจื™ื›ื˜ืŸ ืื™ื– ืื•ื™ืš ื‘ื ื™ืžืฆื ืื™ืŸ ื“ื™ ืคืึธืจืขื ืœืึทื˜ืข. ืื™ืŸ ืคืึทืจืฉืคึผืจื™ื™ื˜ื•ื ื’ ืงื™ืฅ, ื“ื™ ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™ ืื™ื– ืฉื•ื™ืŸ ืคืึทืจืคืขืกื˜ื™ืงื˜ ืื™ืŸ ื“ืขื‘ื™ืึทืŸ, ืึทืจื˜ืฉ ืœื™ื ื•ืงืก, SUSE/openSUSE, ื•ื‘ื•ื ื˜ื•, Gentoo ะธ FreeBSD. ืื™ืŸ ื“ืขืจ ืฆื™ื™ื˜ ืคื•ืŸ ืฉืจื™ื™ื‘ืŸ, ื“ื™ ืคึผืจืึธื‘ืœืขื ื‘ืœื™ื™ื‘ื˜ ืึทื ืคื™ืงืกื˜ ืื™ืŸ rhel ะธ ืคืขื“ืึธืจืึท. ื“ื™ ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™ ืื™ื– ื™ื™ื“ืขื ืึทืคื™ื™ื“ ื“ื•ืจืš ื–ื™ื›ืขืจื”ื™ื™ื˜ ืจื™ืกืขืจื˜ืฉืขืจื– ืคื•ืŸ ืขืคึผืœ.

ืžืงื•ืจ: opennet.ru

ืœื™ื™ื’ืŸ ืึท ื‘ืึทืžืขืจืงื•ื ื’