Munguva pfupi yapfuura nhau dzakabvarura izvo yakaratidza kunetseka kwakanyanya (iyo yakatove yakanyorwa seCVE-2021-3781) muGhostscript (seti yemidziyo yekugadzirisa, kushandura uye kugadzira zvinyorwa muPostScript uye mafomati ePDF) izvo inobvumira kuita kodhi yekumanikidza kana uchigadzirisa rakarongeka faira.
Pakutanga, Emil Lerner akataura kuti paive nedambudziko uye ndiye zvakare akataura nezve kushushikana muna Nyamavhuvhu 25kana kumusangano wekupedzisira weSaint Petersburg ZeroNights X .
Heano masiraidhi kubva kuhurukuro yangu paZeroNights X! A 0-zuva reGhostScript 9.50, RCE inoshandisa cheni ye ImageMagick neyakagadzika masisitimu kubva kuUbuntu repos uye akati wandei bug bounty nyaya mukati https://t.co/7JHotVa5DQ
- Emil Lerner (@emil_lerner) August 25, 2021
Musi waSeptember 5, chiitiko chinoshanda chakaonekwa yeruzhinji domain iyo inobvumidza kurwisa Ubuntu 20.04 masisitimu nekutamisa iyo webhu script inomhanya pane server ichishandisa php-imagemagick package, yakanyatsogadzirwa gwaro rakatakurwa pasi pechirevo chemufananidzo.
Tine mhinduro mukuyedza izvozvi.
Sezvo izvi zvisirizvo zvave zvichitenderera kubva munaKurume uye zviri pachena kuruzhinji kubva muna Nyamavhuvhu 25 (zvakanyanya kuburitswa zvine mutsindo!), Ini ndinofarira kutumira gadziriso pachena tichangopedza kuyedza nekudzokorora.
Kunyangwe kune rimwe divi, zvinotaurwa zvakare kuti maererano nedhata rekutanga, kushandisa kwakadai kwakashandiswa kubva munaKurume uye zvakaziviswa kuti inogona kurwisa masisitimu anomhanya GhostScript 9.50, asi zvakaziviswa kuti kusagadzikana kwaenderera mberi mune dzese dzinotevera shanduro dzeGhostScript, kusanganisira Git yekuvandudza vhezheni 9.55.
Kugadziriswa kwakazogadziriswa munaGunyana 8 uye mushure mekuongororwa kwevezera rakagamuchirwa muGhostScript repository munaGunyana 9th.
Sezvandambotaura kare, sezvo kushandisa kwacho kuri "musango" kweinenge mwedzi mitanhatu, ini ndatoendesa chigamba kunzvimbo yedu yeruzhinji; kuchengeta chigamba chakavanzika mune ino mamiriro kwakaratidzika kunge kusingabatsiri.
Ini ndichaita kuti iyi bhagi ruzhinji ndisati ndavhara bhizinesi (UK) neChishanu, zvakare, kunze kwekunge paine zvikonzero zvine simba uye zvinomanikidza kuti usadaro (iwe uchiri kugona kubatanidza nazvo, uchiita kuti ruzhinji rukasachinja iyo URL).
Dambudziko iri rinokonzerwa nekugona kudarika iyo yoga nzira "-dSAFER" nekuda kwekusakwanira kusimbiswa kwePostScript yedhizaini paramende "% pombi%", iyo yaibvumidza kuita yekumanikidza girafu mirairo.
Semuenzaniso, kumhanyisa chinongedzo chinoshandiswa pane gwaro, iwe unongoda kudoma tambo "(% pombi% / tmp / & id) (w) faira" kana "(% pombi% / tmp /; id) (r) faira ».
Sechiyeuchidzo, kushomeka kweGhostscript kwakanyanya, nekuti pasuru iyi inoshandiswa mune akawanda mashandisirwo inozivikanwa mukugadzirisa PostScript uye mafomati ePDF. Semuenzaniso, Ghostscript inodaidzwa kana ichigadzira zvigunwe pa desktop, kana uchinongedzera data kumashure, uye kana uchishandura mifananidzo. Nekurwisa kwakabudirira, muzviitiko zvakawanda, zvakaringana kurodha pasi faira rekushandisa kana kutarisa dhairekitori naro mumaneja wefaira unotsigira kuratidzwa kwezvigunwe zvigunwe, semuenzaniso muNautilus.
Kudzvinyirirwa muGhostscript inogona zvakare kushandiswa kuburikidza nevatariri vemifananidzo zvichibva pane iyo ImageMagick uye GraphicsMagick mapakeji, ichipfuura iyo JPEG kana PNG faira, iyo ine PostScript kodhi pachinzvimbo chemufananidzo (iyi faira ichagadziriswa mu Ghostscript, nekuti iyo MIME mhando inozivikanwa neizvo zvirimo, uye pasina zvichienderana nekuwedzera).
Sekushandira kudzivirira kubva pakushandisa kusagadzikana kuburikidza ne otomatiki thumbnail jenareta muGNOME uye ImageMagick, zvinokurudzirwa kudzima evince-thumbnailer kufona mu /usr/share/thumbnailers/evince.thumbnailer uye kudzima kupihwa kwePS, EPS, PDF uye mafomati eXPS mu ImageMagick,
Finalmente Izvo zvinotaurwa kuti mukugovera kwakawanda dambudziko harisati ragadziriswa (chimiro chekuburitswa kwesarudzo chinogona kuonekwa pamapeji e Debian, Ubuntu, Fedora, suse, RHEL, Arch Linux, FreeBSD, NetBSD).
Izvo zvinotaurwa zvakare kuti kuburitswa kweGhostScript nekubviswa kwekushushikana kwakarongerwa kuburitswa kupera kwemwedzi. Kana iwe uchida kuziva zvakawanda nezvazvo, iwe unogona kutarisa izvo zvinyorwa mu inotevera chinongedzo.