Ukuvuselelwa kwephakheji ye-antivirus yamahhala i-ClamAV 0.102.4

Kwakhiwe ukukhululwa kwephakheji ye-antivirus yamahhala I-ClamAV 0.102.4, lapho kuqedwa khona ezintathu ubuthakathaka:

• I-CVE-2020-3350 - kuvumela umhlaseli wasendaweni ongenamalungelo angahlela ukususwa noma ukuhanjiswa kwamafayela ngokungafanele ohlelweni; isibonelo, ungasusa /etc/passwd ngaphandle kokuba nezimvume ezidingekayo. Ukuba sengozini kubangelwa isimo somjaho esenzeka lapho kuskenwa amafayela anonya futhi sivumela umsebenzisi onokufinyelela kwegobolondo kusistimu ukuthi athathele indawo uhla lwemibhalo oluqondiwe ukuze luskenwe ngesixhumanisi esingokomfanekiso esikhomba indlela ehlukile.

  Isibonelo, umhlaseli angakha uhla lwemibhalo “/ikhaya/umsebenzisi/ukuxhaphaza/” futhi alayishe ifayela elinesiginesha yegciwane lokuhlola kulo, aqambe leli fayela ngokuthi “passwd”. Ngemva kokusebenzisa uhlelo lokuskena igciwane, kodwa ngaphambi kokususa ifayela eliyinkinga, ungakwazi esikhundleni sohla lwemibhalo "ukuxhaphaza" ngesixhumanisi esingokomfanekiso esikhomba kuhla lwemibhalo "/ njll", okuzokwenza ukuthi i-antivirus isuse ifayela /etc/passwd. Ubungozi buvela kuphela uma usebenzisa i-clamscan, i-clamdscan ne-clamonacc enenketho ethi "--move" noma "--remove".

• I-CVE-2020-3327, i-CVE-2020-3481 isengozini kumamojula wokuhlaziya izingobo zomlando kumafomethi we-ARJ ne-EGG, okuvumela ukwenqatshwa kwenkonzo ngokudluliswa kwezingobo zomlando eziklanywe ngokukhethekile, ukucutshungulwa kwazo okuzoholela ekuphahlazekeni kwenqubo yokuskena. .

Source: opennet.ru