Telegram Group & Telegram Channel
Forwarded from AIGC
本地权限提升漏洞影响 needrestart 工具

Qualys 安全公告指出,needrestart 工具中存在多个本地权限提升漏洞(LPE),这些漏洞允许任何非特权用户获得 root 权限。needrestart 是一个 Perl 工具,自 Ubuntu Server 21.04 版本起默认安装,用于检查系统或服务是否需要重启。

主要漏洞包括:
1. CVE-2024-48990 和 CVE-2024-48992:攻击者可以通过控制 PYTHONPATH 或 RUBYLIB 环境变量,诱使 needrestart 运行 Python 或 Ruby 解释器,从而执行任意代码。
2. CVE-2024-48991
:攻击者可以通过竞争条件,诱使 needrestart 运行攻击者伪造的 Python 解释器。
3. CVE-2024-10224 和 CVE-2024-11003
:攻击者可以通过控制文件名,诱使 needrestart 调用 Perl 的 ScanDeps 模块时执行任意 shell 命令。

这些漏洞自 needrestart 0.8 版本(2014年4月)引入解释器支持以来就已存在。目前,Qualys 不会公开其利用代码,但警告其他研究人员可能会在协调发布后不久公开有效的利用方法。

缓解措施:

建议在 needrestart 配置中禁用解释器扫描功能:
$nrconf{interpscan} = 0;


原文链接:
Qualys Security Advisory

标签:
#安全漏洞 #Ubuntu #needrestart #LPE

#AIGC



group-telegram.com/billchenla/19763
Create:
Last Update:

本地权限提升漏洞影响 needrestart 工具

Qualys 安全公告指出,needrestart 工具中存在多个本地权限提升漏洞(LPE),这些漏洞允许任何非特权用户获得 root 权限。needrestart 是一个 Perl 工具,自 Ubuntu Server 21.04 版本起默认安装,用于检查系统或服务是否需要重启。

主要漏洞包括:
1. CVE-2024-48990 和 CVE-2024-48992:攻击者可以通过控制 PYTHONPATH 或 RUBYLIB 环境变量,诱使 needrestart 运行 Python 或 Ruby 解释器,从而执行任意代码。
2. CVE-2024-48991
:攻击者可以通过竞争条件,诱使 needrestart 运行攻击者伪造的 Python 解释器。
3. CVE-2024-10224 和 CVE-2024-11003
:攻击者可以通过控制文件名,诱使 needrestart 调用 Perl 的 ScanDeps 模块时执行任意 shell 命令。

这些漏洞自 needrestart 0.8 版本(2014年4月)引入解释器支持以来就已存在。目前,Qualys 不会公开其利用代码,但警告其他研究人员可能会在协调发布后不久公开有效的利用方法。

缓解措施:

建议在 needrestart 配置中禁用解释器扫描功能:

$nrconf{interpscan} = 0;


原文链接:
Qualys Security Advisory

标签:
#安全漏洞 #Ubuntu #needrestart #LPE

#AIGC

BY 咕 Billchen 咕 |


Warning: Undefined variable $i in /var/www/group-telegram/post.php on line 260

Share with your friend now:
group-telegram.com/billchenla/19763

View MORE
Open in Telegram


Telegram | DID YOU KNOW?

Date: |

At the start of 2018, the company attempted to launch an Initial Coin Offering (ICO) which would enable it to enable payments (and earn the cash that comes from doing so). The initial signals were promising, especially given Telegram’s user base is already fairly crypto-savvy. It raised an initial tranche of cash – worth more than a billion dollars – to help develop the coin before opening sales to the public. Unfortunately, third-party sales of coins bought in those initial fundraising rounds raised the ire of the SEC, which brought the hammer down on the whole operation. In 2020, officials ordered Telegram to pay a fine of $18.5 million and hand back much of the cash that it had raised. "Like the bombing of the maternity ward in Mariupol," he said, "Even before it hits the news, you see the videos on the Telegram channels." And indeed, volatility has been a hallmark of the market environment so far in 2022, with the S&P 500 still down more than 10% for the year-to-date after first sliding into a correction last month. The CBOE Volatility Index, or VIX, has held at a lofty level of more than 30. Andrey, a Russian entrepreneur living in Brazil who, fearing retaliation, asked that NPR not use his last name, said Telegram has become one of the few places Russians can access independent news about the war. Official government accounts have also spread fake fact checks. An official Twitter account for the Russia diplomatic mission in Geneva shared a fake debunking video claiming without evidence that "Western and Ukrainian media are creating thousands of fake news on Russia every day." The video, which has amassed almost 30,000 views, offered a "how-to" spot misinformation.
from ua


Telegram 咕 Billchen 咕 |
FROM American