正文

bareos bareos 在移除最后引用时对内存的释放不恰当（内存泄露）

admin
admin V管理员 /0 评论 /17 阅读
0416
此篇文章发布距今已超过1128天，您需要注意文章的内容或图片是否可用！

CVE编号

CVE-2022-24756

利用情况

暂无

补丁情况

N/A

披露时间

2022-03-15
漏洞描述
Bareos is open source software for backup, archiving, and recovery of data for operating systems. When Bareos Director >= 18.2 but prior to 21.1.0, 20.0.6, and 19.2.12 is built and configured for PAM authentication, a failed PAM authentication will leak a small amount of memory. An attacker that is able to use the PAM Console (i.e. by knowing the shared secret or via the WebUI) can flood the Director with failing login attempts which will eventually lead to an out-of-memory condition in which the Director will not work anymore. Bareos Director versions 21.1.0, 20.0.6 and 19.2.12 contain a Bugfix for this problem. Users who are unable to upgrade may disable PAM authentication as a workaround.
解决建议
建议您更新当前系统或软件至最新版，完成漏洞的修复。
参考链接
https://github.com/bareos/bareos/pull/1115
https://github.com/bareos/bareos/pull/1119
https://github.com/bareos/bareos/pull/1121
https://github.com/bareos/bareos/security/advisories/GHSA-jh55-4wgw-xc9j
https://huntr.dev/bounties/480121f2-bc3c-427e-986e-5acffb1606c5/
受影响软件情况
# 类型 厂商 产品 版本 影响面
1
运行在以下环境
应用 bareos bareos * From
(including)
18.2 		Up to
(excluding)
19.2.12
运行在以下环境
应用 bareos bareos * From
(including)
20.0.0 		Up to
(excluding)
20.0.6
运行在以下环境
应用 bareos bareos * From
(including)
21.0.0 		Up to
(excluding)
21.1.0
CVSS3评分 7.5
  • 攻击路径 网络
  • 攻击复杂度 低
  • 权限要求 无
  • 影响范围 未更改
  • 用户交互 无
  • 可用性 高
  • 保密性 无
  • 完整性 无
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-ID 漏洞类型 CWE-401 在移除最后引用时对内存的释放不恰当（内存泄露）