Kutshanje uPavel Cheremushkin dI-Kaspersky Lab yahlalutya ukuphunyezwa okungafaniyo kwenkqubo yokufikelela ekude ye-VNC (Ikhompyuter yeNethiwekhi eyiyo) kwaye ichonge ubungozi be-37 kubangelwa ziingxaki zememori.
Ukufunyanwa komngcipheko kusebenziso lwe-VNC inokuxhatshazwa kuphela ngumsebenzisi oqinisekisiweyo kunye nohlaselo lokuba semngciphekweni kwikhowudi yabathengi kunokwenzeka xa umsebenzisi eqhagamshela kwiseva elawulwa ngumhlaseli.
Kwibhlog yaseKaspersky, bagqabaza njaloEzi ngxaki zinokuthi zixhaswe ngale ndlela ilandelayo:
Izicelo ze-VNC zineenxalenye ezimbini: iseva efakwe kwikhompyuter umqhagamshelwa ngumqeshwa wakho ukude, kunye nomxhasi obalekela kwisixhobo abaqhagamshela kuso. Ukuba semngciphekweni kuxhaphake kakhulu kwicala leseva, ehlala ilula kancinci kwaye ke ineembungulu ezimbalwa. Nangona kunjalo, iingcali zethu ze-CERT zifumene iibhugi kumacala omabini ezicelo eziphantsi kophando, nangona kwiimeko ezininzi uhlaselo kumncedisi lungenakwenzeka ngaphandle kwesigunyaziso.
Malunga nokuba semngciphekweni
Uninzi lwezinto ezisengozini zafunyanwa kwiphakheji ye-UltraVNC, ifumaneka kuphela kwiqonga leWindows. Iyonke, kwi-UltraVNC Ukuchaphazeleka kwama-22 kuchongiwe. 13 ukuba semngciphekweni kungakhokelela ekuphunyezweni kwekhowudi kwinkqubo, i-5 inokuvuza umxholo weendawo zememori, kwaye i-4 inokukhokelela ekwaleni inkonzo.
Bonke obu buthathaka buconjululwe kuhlobo 1.2.3.0.
Ngelixa kwilayibrari evulekileyo yeLibVNC (LibVNCServer kunye neLibVNCClient), esetyenziswa kwiVirtualBox, Ukuchaphazeleka kwama-10 kuchongiwe. 5 ukuba semngciphekweni (i-CVE-2018-20020, i-CVE-2018-20019, i-CVE-2018-15127, i-CVE-2018-15126, i-CVE-2018-6307) zibangelwe kukugcwala kwebuffer kwaye zinokukhokelela ekuphunyezweni kwekhowudi. 3 ukuba semngciphekweni kunokubangela ukuvuza kolwazi; 2 ukwala inkonzo.
Abaphuhlisi sele bezilungisile zonke iingxakiUninzi lolungiso lubandakanyiwe kukhululo lweLibVNCServer 0.9.12, kodwa ukuza kuthi ga ngoku zonke izilungiso ziboniswa kuphela kwisebe eliyintloko kunye nohlaziyo olwenziwe lwasasazwa.
KwiTightVNC 1.3 (umnqamlezo weqonga lelifa elivavanyiweyo), njengoko inguqulelo 2.x yangoku yakhutshelwa iiWindows kuphela), Kwafunyanwa ubuthathaka be-4. Imicimbi emithathu (i-CVE-2019-15679, i-CVE-2019-15678, i-CVE-2019-8287) zibangelwa kukugcwala kwempazamo kwi-InitialiseRFBConnection, rfbServerCutText, kunye nemisebenzi yeHandleCoRREBBP kwaye inokukhokelela ekuphunyezweni kwekhowudi.
Ingxaki (I-CVE-2019-15680) kukhokelela ekwaleni inkonzo. Ngaphandle kwento yokuba abaphuhlisi beTightVNC bazisiwe ngemicimbi kunyaka ophelileyo, ukuba semngciphekweni kuhlala kungalunganga.
Kwiphakheji yeqonga lomnqamlezo I-TurboVNC (ifolokhwe yeTightVNC 1.3, esebenzisa ilayibrari ye-libjpeg-turbo), inye kuphela imeko yokuba sesichengeni (CVE-2019-15683), kodwa kuyingozi kwaye ukuba kukho ukuqinisekiswa okuqinisekisiweyo kwiseva kwenza ukuba kube lula ukulungiselela ukwenziwa kwekhowudi yakho, ukuze kuthi xa kuphuphuma ibuffer kunokwenzeka ukulawula ulwalathiso lokubuya. Ingxaki yalungiswa nge-23 ka-Agasti kwaye ayiveli kuhlobo lwangoku lwe-2.2.3.
Ukuba ufuna ukwazi ngakumbi ngayo ungajonga iinkcukacha kwisithuba sokuqala. Ikhonkco yile.
Ngokuhlaziywa kweephakeji kunokwenziwa ngale ndlela ilandelayo.
yeya
Ikhowudi yethala leencwadi bangayikhuphela kwindawo yabo yokugcina izinto kwiGitHub (ikhonkco yile). Ukukhuphela olona hlobo langoku ngoku unokuvula i-terminal kwaye uchwetheze oku kulandelayo:
wget https://github.com/LibVNC/libvncserver/archive/LibVNCServer-0.9.12.zip
Unzip nge:
unzip libvncserver-LibVNCServer-0.9.12
Ungena kulawulo nge:
cd libvncserver-LibVNCServer-0.9.12
Kwaye uyakha iphakheji nge:
mkdir build cd build cmake .. cmake --build .
I-TurboVNC
Ukuhlaziya le nguqulo intsha, khuphela nje ipakethe yenguqulo ezinzileyo, enokufumaneka kwi eli khonkco lilandelayo.
Yenza ukhuphelo lwepakeji, ngoku ungayifaka ngokulula ngokucofa kabini kuyo kwaye iziko lesoftware likhathalele ufakelo okanye banokuyenza ngomphathi wephakheji abawuthandayo okanye kwisiphelo.
Benza okokugqibela ngokuzibeka apho iphakheji ekhutshelweyo ikwisiphelo sabo kwaye kuyo kufuneka bathayiphe kuphela:
sudo dpkg -i turbovnc_2.2.3_amd64.deb