{"id":54354,"date":"2019-12-24T00:00:00","date_gmt":"2019-12-23T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/uyazvimost-v-sqlite-pozvolyayushhaya-udalyonno-atakovat-chrome-cherez-websql"},"modified":"2020-02-18T14:02:21","modified_gmt":"2020-02-18T11:02:21","slug":"uyazvimost-v-sqlite-pozvolyayushhaya-udalyonno-atakovat-chrome-cherez-websql","status":"publish","type":"post","link":"https:\/\/prohoster.info\/az\/blog\/news\/uyazvimost-v-sqlite-pozvolyayushhaya-udalyonno-atakovat-chrome-cherez-websql","title":{"rendered":"SQLite-d\u0259 bir z\u0259iflik, WebSQL vasit\u0259sil\u0259 Chrome-a uzaqdan h\u00fccum etm\u0259y\u0259 imkan verir","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

T\u0259hl\u00fck\u0259sizlik t\u0259dqiqat\u00e7\u0131lar\u0131 \u00c7in \u015firk\u0259ti Tencent-d\u0259n t\u0259qdim etdil\u0259r<\/a><\/noindex> yeni z\u0259iflik variant\u0131 Magellan<\/a><\/noindex> (CVE-2019-13734<\/a><\/noindex>), m\u00fcvafiq \u015f\u0259kild\u0259 formala\u015fd\u0131r\u0131lm\u0131\u015f SQL strukturlar\u0131n\u0131 i\u015fl\u0259y\u0259rk\u0259n SQLite DBM-d\u0259 kod icras\u0131n\u0131 t\u0259min etm\u0259y\u0259 imkan tan\u0131y\u0131r. Eyni z\u0259ifliyin tam olaraq<\/a><\/noindex> h\u0259min t\u0259dqiqat\u00e7\u0131lar t\u0259r\u0259find\u0259n bir il \u0259vv\u0259l a\u015fkar edilm\u0259si diqq\u0259t\u0259layiqdir. Z\u0259iflik, istifad\u0259\u00e7inin sistemi \u00fcz\u0259rind\u0259 kontrol \u0259ld\u0259 etm\u0259k \u00fc\u00e7\u00fcn z\u0259r\u0259rverici t\u0259r\u0259find\u0259n idar\u0259 olunan web s\u0259hif\u0259l\u0259rini a\u00e7ark\u0259n Chrome brauzerini uzaqdan h\u00fccuma m\u0259ruz qoyma imkan\u0131 tan\u0131y\u0131r. <\/p>\n

Chrome\/Chromium \u00fcz\u0259rind\u0259 h\u00fccum, SQLite koduna \u0259saslanan WebSQL API vasit\u0259sil\u0259 h\u0259yata ke\u00e7irilir. Ba\u015fqa proqramlara h\u00fccum, yaln\u0131z xaricd\u0259n g\u0259l\u0259n SQL strukturlar\u0131n\u0131 SQLite-a \u00f6t\u00fcrm\u0259y\u0259 imkan ver\u0259n proqramlarda m\u00fcmk\u00fcnd\u00fcr, m\u0259s\u0259l\u0259n, SQLite-dan m\u0259lumat m\u00fcbadil\u0259si format\u0131 kimi istifad\u0259 olunursa. Mozilla \u015firk\u0259ti Firefox-u h\u00fccuma qar\u015f\u0131 m\u00fcdafi\u0259 edib, \u00e7\u00fcnki WebSQL-un h\u0259yata ke\u00e7irilm\u0259sind\u0259n imtina etdi<\/a><\/noindex> faydalanaraq IndexedDB API.<\/a><\/noindex> Google problemi aradan qald\u0131r\u0131b <\/p>\n

s\u0259hif\u0259sind\u0259. SQLite kod bazas\u0131nda problem Chrome 79<\/a><\/noindex>noyabr\u0131n 17-d\u0259 a\u015fkar edilmi\u015fdir, Chromium kod bazas\u0131nda is\u0259 d\u00fcz\u0259ldildi<\/a><\/noindex> 17 noyabr, lakin Chromium kod bazas\u0131nda \u2014 Problem FTS3 tam m\u0259tni axtar\u0131\u015f m\u00fch\u0259rrikind\u0259 m\u00f6vcuddur v\u0259 k\u00f6lg\u0259 c\u0259dv\u0259ll\u0259rind\u0259n (shadow tables, yazma imkan\u0131 olan x\u00fcsusi n\u00f6v virtual c\u0259dv\u0259ll\u0259r) istifad\u0259 ed\u0259r\u0259k indeksin partlamas\u0131na v\u0259 bufer a\u015f\u0131m\u0131na g\u0259tirib \u00e7\u0131xara bil\u0259r. \u0130stismar texnikas\u0131 haqq\u0131nda \u0259trafl\u0131 m\u0259lumat 90 g\u00fcnd\u0259n sonra d\u0259rc olunacaq.<\/a><\/noindex>.
\nSQLite il\u0259 ba\u011fl\u0131 yeni versiya h\u0259l\u0259 daha da<\/a><\/noindex> haz\u0131rlanmay\u0131b<\/p>\n

(dekabr\u0131n 31-d\u0259). SQLite 3.26.0 versiyas\u0131ndan ba\u015flayaraq, xarici SQL sor\u011fular\u0131 il\u0259 i\u015fl\u0259n\u0259rk\u0259n k\u00f6lg\u0259 c\u0259dv\u0259ll\u0259rin\u0259 yazma\u011f\u0131 qada\u011fan ed\u0259n SQLITE_DBCONFIG_DEFENSIVE rejimind\u0259n istifad\u0259 edil\u0259 bil\u0259r. Paylamalarda z\u0259iflik SQLite kitabxanas\u0131nda h\u0259l\u0259 d\u0259 d\u00fcz\u0259ldilm\u0259mi\u015fdir openSUSE\/SUSE<\/a><\/noindex> (g\u00f6zl\u0259nilir<\/a><\/noindex> . Chromium b\u00fct\u00fcn paylamalarda art\u0131q yenil\u0259nmi\u015fdir v\u0259 z\u0259ifliy\u0259 qar\u015f\u0131 dayan\u0131ql\u0131d\u0131r, lakin problem, Chromium m\u00fch\u0259rrikind\u0259n istifad\u0259 ed\u0259n m\u00fcxt\u0259lif \u00fc\u00e7\u00fcnc\u00fc t\u0259r\u0259f brauzerl\u0259ri v\u0259 t\u0259tbiql\u0259r, el\u0259c\u0259 d\u0259 Webview-\u0259 \u0259saslanan Android t\u0259tbiql\u0259rini d\u0259 \u0259hat\u0259 ed\u0259 bil\u0259r. Debian<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, RHEL<\/a><\/noindex>, Bundan \u0259lav\u0259, SQLite-da 4 daha az t\u0259hl\u00fck\u0259li problem a\u015fkar edilmi\u015fdir (<\/a><\/noindex>, Arch Linux<\/a><\/noindex>, Fedora<\/a><\/noindex>, FreeBSD<\/a><\/noindex>CVE-2019-13750<\/p>\n

CVE-2019-13751CVE-2019-13752<\/a><\/noindex>, CVE-2019-13753<\/a><\/noindex>, ), bunlar m\u0259lumat s\u0131zmas\u0131na v\u0259 m\u0259hdudiyy\u0259tl\u0259ri a\u015fma\u011fa s\u0259b\u0259b ola bil\u0259r (Chrome-a h\u00fccum \u00fc\u00e7\u00fcn \u0259lav\u0259 amil kimi istifad\u0259 edil\u0259 bil\u0259r). Veril\u0259n probleml\u0259r 13 dekabrda SQLite kodunda d\u00fcz\u0259ldilmi\u015fdir. \u00dcmumilikd\u0259, bu probleml\u0259r t\u0259dqiqat\u00e7\u0131lara Chromium prosesind\u0259 kod icra etm\u0259k \u00fc\u00e7\u00fcn i\u015fl\u0259y\u0259n bir istismar haz\u0131rlama\u011fa imkan yaratm\u0131\u015fd\u0131r.<\/a><\/noindex>, Y\u00fcng\u00fcl antiX 19.1 paylamas\u0131n\u0131n burax\u0131l\u0131\u015f\u0131<\/a><\/noindex>T\u0259hl\u00fck\u0259sizlik t\u0259dqiqat\u00e7\u0131lar\u0131 \u00c7in \u015firk\u0259ti Tencent-d\u0259n yeni z\u0259iflik variant\u0131n\u0131 t\u0259qdim etdil\u0259r<\/p>\n

<\/a><\/noindex><\/p>\n

M\u0259nb\u0259: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Tencent \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 Magellan (CVE-2019-13734), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0432 \u0421\u0423\u0411\u0414 SQLite \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 SQL-\u043a\u043e\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0439. \u041f\u043e\u0445\u043e\u0436\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0431\u044b\u043b\u0430 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430 \u0442\u0435\u043c\u0438 \u0436\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 \u0433\u043e\u0434 \u043d\u0430\u0437\u0430\u0434. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u0430 \u0442\u0435\u043c, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u0442\u044c \u0431\u0440\u0430\u0443\u0437\u0435\u0440 Chrome \u0438 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u043d\u0430\u0434 \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u043f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438 \u043f\u043e\u0434\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u043d\u044b\u0445 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 web-\u0441\u0442\u0440\u0430\u043d\u0438\u0446. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-54354","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47SQLite-d\u0259 z\u0259iflik, Chrome-u WebSQL vasit\u0259sil\u0259 uzaqdan h\u00fccuma m\u0259ruz qoyma\u011fa imkan tan\u0131y\u0131r | ProHoster","description":"\ud83e\udd47SQLite-d\u0259 z\u0259iflik, Chrome-u WebSQL vasit\u0259sil\u0259 uzaqdan h\u00fccuma m\u0259ruz qoyma\u011fa imkan tan\u0131y\u0131r | ProHoster","canonical_url":"https:\/\/prohoster.info\/az\/blog\/news\/uyazvimost-v-sqlite-pozvolyayushhaya-udalyonno-atakovat-chrome-cherez-websql","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"az_AZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 SQLite, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u0442\u044c Chrome \u0447\u0435\u0440\u0435\u0437 WebSQL | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Tencent \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438","og:url":"https:\/\/prohoster.info\/az\/blog\/news\/uyazvimost-v-sqlite-pozvolyayushhaya-udalyonno-atakovat-chrome-cherez-websql","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-23T21:00:00+00:00","article:modified_time":"2020-02-18T11:02:21+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"54354","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 11:02:28","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:07:25","updated":"2026-01-24 11:02:28","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/posts\/54354","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/comments?post=54354"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/posts\/54354\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/media?parent=54354"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/categories?post=54354"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/az\/wp-json\/wp\/v2\/tags?post=54354"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}