{"id":101354,"date":"2021-09-21T10:22:45","date_gmt":"2021-09-21T08:22:45","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-openoffice-pozvolyayushhaya-vypolnit-kod-pri-otkrytii-fajla"},"modified":"2021-09-21T10:22:45","modified_gmt":"2021-09-21T08:22:45","slug":"uyazvimost-v-openoffice-pozvolyayushhaya-vypolnit-kod-pri-otkrytii-fajla","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-openoffice-pozvolyayushhaya-vypolnit-kod-pri-otkrytii-fajla","title":{"rendered":"Vulnerabilita v OpenOffice umo\u017e\u0148uj\u00edc\u00ed vykon\u00e1n\u00ed k\u00f3du p\u0159i otev\u0159en\u00ed souboru","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V kancel\u00e1\u0159sk\u00e9m bal\u00edku Apache OpenOffice byla zji\u0161t\u011bna zranitelnost (CVE-2021-33035), kter\u00e1 umo\u017e\u0148uje prov\u00e9st k\u00f3d p\u0159i otev\u0159en\u00ed speci\u00e1ln\u011b upraven\u00e9ho souboru ve form\u00e1tu DBF. V\u00fdzkumn\u00edk, kter\u00fd probl\u00e9m odhalil, varoval p\u0159ed vytvo\u0159en\u00edm funk\u010dn\u00edho exploit pro platformu Windows. Oprava zranitelnosti je zat\u00edm dostupn\u00e1 pouze ve form\u011b patch v repozit\u00e1\u0159i projektu, kter\u00fd byl sou\u010d\u00e1st\u00ed testovac\u00edch sestaven\u00ed OpenOffice 4.1.11. Aktualizace pro stabiln\u00ed v\u011btev zat\u00edm nebyla vytvo\u0159ena. <\/p>\n

Probl\u00e9m je zp\u016fsoben t\u00edm, \u017ee p\u0159i alokaci pam\u011bti OpenOffice spol\u00e9hal na hodnoty fieldLength a fieldType v hlavi\u010dce soubor\u016f DBF, ani\u017e by kontroloval shodu skute\u010dn\u00e9ho typu dat v pol\u00edch. K proveden\u00ed \u00fatoku lze uv\u00e9st typ INTEGER v hodnot\u011b fieldType, ale um\u00edstit data v\u011bt\u0161\u00ed velikosti a uv\u00e9st hodnotu fieldLength, kter\u00e1 neodpov\u00edd\u00e1 velikosti dat s typem INTEGER, co\u017e povede k tomu, \u017ee zbytek dat z pole bude zaps\u00e1n mimo vyhrazen\u00fd buffer. V d\u016fsledku kontrolovan\u00e9ho p\u0159ete\u010den\u00ed bufferu se v\u00fdzkumn\u00edkovi poda\u0159ilo p\u0159epsat n\u00e1vratov\u00fd ukazatel z funkce a pomoc\u00ed technik orientovan\u00e9ho n\u00e1vratu (ROP \u2013 Return-Oriented Programming) dos\u00e1hnout vykon\u00e1n\u00ed sv\u00e9ho k\u00f3du. <\/p>\n

P\u0159i pou\u017eit\u00ed techniky ROP se \u00fato\u010dn\u00edk nesna\u017e\u00ed um\u00edstit sv\u016fj k\u00f3d do pam\u011bti, ale operuje s ji\u017e existuj\u00edc\u00edmi kusy strojov\u00fdch instrukc\u00ed ve na\u010dten\u00fdch knihovn\u00e1ch, kter\u00e9 kon\u010d\u00ed pokynem k n\u00e1vratu \u0159\u00edzen\u00ed (obvykle se jedn\u00e1 o konce knihovn\u00edch funkc\u00ed). Pr\u00e1ce exploitu se redukuje na sestaven\u00ed \u0159et\u011bzce vol\u00e1n\u00ed podobn\u00fdch blok\u016f (\"gadget\u016f\") pro z\u00edsk\u00e1n\u00ed po\u017eadovan\u00e9 funk\u010dnosti. Jako gadgety v exploitu pro OpenOffice byl pou\u017eit k\u00f3d z knihovny libxml2 pou\u017e\u00edvan\u00e9 v OpenOffice, kter\u00e1 se na rozd\u00edl od samotn\u00e9ho OpenOffice uk\u00e1zala b\u00fdt zkompilov\u00e1na bez ochrann\u00fdch mechanism\u016f DEP (Data Execution Prevention) a ASLR (Address Space Layout Randomization). <\/p>\n

V\u00fdvoj\u00e1\u0159i OpenOffice byli o probl\u00e9mu informov\u00e1ni 4. kv\u011btna, po \u010dem\u017e bylo na 30. srpna napl\u00e1nov\u00e1no ve\u0159ejn\u00e9 odhalen\u00ed informac\u00ed o zranitelnosti. Jeliko\u017e k pl\u00e1novan\u00e9mu term\u00ednu nebyla aktualizace stabiln\u00ed v\u011btve vytvo\u0159ena, v\u00fdzkumn\u00edk posunul odhalen\u00ed detail\u016f na 18. z\u00e1\u0159\u00ed, ale v\u00fdvoj\u00e1\u0159i OpenOffice nestihli vytvo\u0159it verzi 4.1.11 ani k tomuto term\u00ednu. Je pozoruhodn\u00e9, \u017ee b\u011bhem stejn\u00e9ho v\u00fdzkumu byla odhalena podobn\u00e1 zranitelnost v k\u00f3du pro podporu form\u00e1tu DBF v Microsoft Office Access (CVE-2021\u201338646), podrobnosti o kter\u00e9 budou zve\u0159ejn\u011bny pozd\u011bji. V LibreOffice nebyly nalezeny \u017e\u00e1dn\u00e9 probl\u00e9my.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043e\u0444\u0438\u0441\u043d\u043e\u043c \u043f\u0430\u043a\u0435\u0442\u0435 Apache OpenOffice \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-33035), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 DBF. \u0412\u044b\u044f\u0432\u0438\u0432\u0448\u0438\u0439 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b \u043e \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0438 \u0440\u0430\u0431\u043e\u0447\u0435\u0433\u043e \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430 \u0434\u043b\u044f \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Windows. \u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u043a\u0430 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0444\u043e\u0440\u043c\u0435 \u043f\u0430\u0442\u0447\u0430 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432\u043e\u0448\u0451\u043b \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 \u0442\u0435\u0441\u0442\u043e\u0432\u044b\u0445 \u0441\u0431\u043e\u0440\u043e\u043a OpenOffice 4.1.11. \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 \u043f\u043e\u043a\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101354","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranitelnost v OpenOffice, kter\u00e1 umo\u017e\u0148uje prov\u00e9st k\u00f3d p\u0159i otev\u0159en\u00ed souboru | ProHoster","description":"V kancel\u00e1\u0159sk\u00e9m bal\u00edku Apache OpenOffice byla odhalena zranitelnost (CVE-2021-33035), kter\u00e1 umo\u017e\u0148uje proveden\u00ed k\u00f3du p\u0159i otev\u0159en\u00ed speci\u00e1ln\u011b upraven\u00e9ho souboru ve form\u00e1tu DBF.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-openoffice-pozvolyayushhaya-vypolnit-kod-pri-otkrytii-fajla","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 OpenOffice, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438 \u0444\u0430\u0439\u043b\u0430 | ProHoster","og:description":"\u0412 \u043e\u0444\u0438\u0441\u043d\u043e\u043c \u043f\u0430\u043a\u0435\u0442\u0435 Apache OpenOffice \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-33035), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 DBF.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-openoffice-pozvolyayushhaya-vypolnit-kod-pri-otkrytii-fajla","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-09-21T08:22:45+00:00","article:modified_time":"2021-09-21T08:22:45+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101354","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-09-21 08:27:59","updated":"2022-10-03 20:50:17","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/101354","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=101354"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/101354\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=101354"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=101354"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=101354"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}