{"id":31611,"date":"2019-10-31T21:42:10","date_gmt":"2019-10-31T18:42:10","guid":{"rendered":"https:\/\/prohoster.info\/blog\/microsoft-otkazalas-ispravlyat-uyazvimost-nulevogo-dnya-v-nbsp-internet-explorer\/"},"modified":"2019-10-31T21:42:10","modified_gmt":"2019-10-31T18:42:10","slug":"microsoft-otkazalas-ispravlyat-uyazvimost-nulevogo-dnya-v-nbsp-internet-explorer","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/microsoft-otkazalas-ispravlyat-uyazvimost-nulevogo-dnya-v-nbsp-internet-explorer","title":{"rendered":"Microsoft odm\u00edtla opravit zranitelnost nult\u00e9ho dne v Internet Explorer","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V p\u00e1tek 12. dubna specialista na informa\u010dn\u00ed bezpe\u010dnost John Page publikoval informace o neopraven\u00e9 zranitelnosti v aktu\u00e1ln\u00ed verzi Internet Exploreru a tak\u00e9 demonstroval jej\u00ed vyu\u017eit\u00ed. Tato zranitelnost m\u016f\u017ee potenci\u00e1ln\u011b umo\u017enit \u00fato\u010dn\u00edkovi z\u00edskat obsah m\u00edstn\u00edch soubor\u016f u\u017eivatel\u016f syst\u00e9m\u016f Windows, a to obch\u00e1zen\u00edm bezpe\u010dnostn\u00edch opat\u0159en\u00ed prohl\u00ed\u017ee\u010de.<\/p>\n

\"Microsoft<\/p>\n

Zranitelnost spo\u010d\u00edv\u00e1 v tom, jak Internet Explorer zpracov\u00e1v\u00e1 soubory ve form\u00e1tu MHTML, kter\u00e9 obvykle maj\u00ed p\u0159\u00edponu .mht nebo .mhtml. Tento form\u00e1t je v Internet Exploreru pou\u017e\u00edv\u00e1n ve v\u00fdchoz\u00edm nastaven\u00ed pro ukl\u00e1d\u00e1n\u00ed webov\u00fdch str\u00e1nek a umo\u017e\u0148uje ulo\u017eit ve\u0161ker\u00fd obsah str\u00e1nky v\u010detn\u011b ve\u0161ker\u00e9ho multimedi\u00e1ln\u00edho obsahu jako jedin\u00fd soubor. V sou\u010dasnosti v\u011bt\u0161ina modern\u00edch prohl\u00ed\u017ee\u010d\u016f ji\u017e neukl\u00e1d\u00e1 webov\u00e9 str\u00e1nky ve form\u00e1tu MHT a pou\u017e\u00edv\u00e1 k tomu standardn\u00ed form\u00e1t pro web \u2014 HTML, i kdy\u017e st\u00e1le podporuj\u00ed zpracov\u00e1n\u00ed soubor\u016f v tomto form\u00e1tu a mohou jej pou\u017e\u00edvat pro ukl\u00e1d\u00e1n\u00ed p\u0159i odpov\u00eddaj\u00edc\u00edch nastaven\u00edch nebo pomoc\u00ed roz\u0161\u00ed\u0159en\u00ed.<\/p>\n

Zranitelnost, kterou John objevil, spad\u00e1 do kategorie XXE (XML eXternal Entity) zranitelnost\u00ed a spo\u010d\u00edv\u00e1 v nespr\u00e1vn\u00e9 konfiguraci zpracovatele XML k\u00f3du v Internet Exploreru. \u201eTato zranitelnost umo\u017e\u0148uje vzd\u00e1len\u00e9mu \u00fato\u010dn\u00edkovi p\u0159\u00edstup k m\u00edstn\u00edm soubor\u016fm u\u017eivatele a nap\u0159\u00edklad extrahovat informace o verzi nainstalovan\u00e9ho softwaru v syst\u00e9mu,\u201c \u0159\u00edk\u00e1 Page. \u201eTak nap\u0159\u00edklad dotaz na ‘c:Python27NEWS.txt’ vr\u00e1t\u00ed verzi tohoto programu (v tomto p\u0159\u00edpad\u011b interpretu Pythonu).\"<\/p>\n

<\/center><\/p>\n

Jeliko\u017e jsou v syst\u00e9mu Windows v\u0161echny soubory MHT ve v\u00fdchoz\u00edm nastaven\u00ed otev\u00edr\u00e1ny v Internet Exploreru, vyu\u017eit\u00ed t\u00e9to zranitelnosti je trivi\u00e1ln\u00ed \u00fakol, proto\u017ee u\u017eivateli sta\u010d\u00ed dvakr\u00e1t kliknout na nebezpe\u010dn\u00fd soubor, kter\u00fd obdr\u017eel e-mailem, na soci\u00e1ln\u00edch s\u00edt\u00edch nebo v messengeru.<\/p>\n

\"Microsoft<\/p>\n

\u201eObvykle p\u0159i vytv\u00e1\u0159en\u00ed instance objektu ActiveX, jako je Microsoft.XMLHTTP, obdr\u017e\u00ed u\u017eivatel varov\u00e1n\u00ed zabezpe\u010den\u00ed v Internet Exploreru, kter\u00e9 vy\u017eaduje potvrzen\u00ed pro aktivaci zablokovan\u00e9ho obsahu,\u201c vysv\u011btluje v\u00fdzkumn\u00edk. \u201eNicm\u00e9n\u011b p\u0159i otev\u0159en\u00ed p\u0159edem p\u0159ipraven\u00e9ho souboru .mht pomoc\u00ed speci\u00e1ln\u011b uspo\u0159\u00e1dan\u00fdch zna\u010dek u\u017eivatel nedostane varov\u00e1n\u00ed o potenci\u00e1ln\u011b nebezpe\u010dn\u00e9m obsahu.\u201c<\/p>\n

Podle Pejd\u017ee \u00fasp\u011b\u0161n\u011b otestoval zranitelnost v aktu\u00e1ln\u00ed verzi prohl\u00ed\u017ee\u010de Internet Explorer 11 se v\u0161emi posledn\u00edmi bezpe\u010dnostn\u00edmi aktualizacemi v syst\u00e9mech Windows 7, Windows 10 a Windows Server 2012 R2.<\/p>\n

Pravd\u011bpodobn\u011b jedin\u00e9 dobr\u00e9 zpr\u00e1vy o zve\u0159ejn\u011bn\u00ed t\u00e9to zranitelnosti pro ve\u0159ejnost je, \u017ee kdysi dominantn\u00ed pod\u00edl na trhu Internet Exploreru se v sou\u010dasnosti sn\u00ed\u017eil na pouh\u00fdch 7,34 %, podle NetMarketShare. Ale proto\u017ee Windows pou\u017e\u00edv\u00e1 Internet Explorer jako v\u00fdchoz\u00ed aplikaci pro otev\u00edr\u00e1n\u00ed soubor\u016f MHT, u\u017eivatel\u00e9 nemus\u00ed m\u00edt IE nastaven\u00fd jako v\u00fdchoz\u00ed prohl\u00ed\u017ee\u010d a i p\u0159esto jsou zraniteln\u00ed, pokud je IE st\u00e1le p\u0159\u00edtomno v jejich syst\u00e9mech, a nev\u011bnuj\u00ed pozornost form\u00e1tu stahovan\u00fdch soubor\u016f z internetu.<\/p>\n

Je\u0161t\u011b 27. b\u0159ezna informoval John spole\u010dnost Microsoft o t\u00e9to zranitelnosti v jejich prohl\u00ed\u017ee\u010di, ale 10. dubna obdr\u017eel od spole\u010dnosti odpov\u011b\u010f, ve kter\u00e9 uvedli, \u017ee nepova\u017euj\u00ed tento probl\u00e9m za kriticky d\u016fle\u017eit\u00fd.<\/p>\n

\u201eOprava bude vyd\u00e1na pouze s dal\u0161\u00ed verz\u00ed produktu,\u201c uv\u00e1d\u00ed se v dopise od Microsoftu. \u201eV sou\u010dasnosti nepl\u00e1nujeme vydat \u0159e\u0161en\u00ed pro tento probl\u00e9m.\u201c<\/p>\n

Po jednozna\u010dn\u00e9 reakci Microsoftu v\u00fdzkumn\u00edk zve\u0159ejnil podrobnosti o zranitelnosti nult\u00e9ho dne na sv\u00e9m webu, stejn\u011b jako demonstra\u010dn\u00ed k\u00f3d a video na YouTube.<\/p>\n<\/p>\n

\r\n \"P\u0159ehr\u00e1t\r\n
<\/div>\r\n <\/div><\/center><\/center><\/p>\n

A\u010dkoliv realizace t\u00e9to zranitelnosti nen\u00ed tak snadn\u00e1 a vy\u017eaduje n\u011bjak\u00fdm zp\u016fsobem donutit u\u017eivatele spustit nezn\u00e1m\u00fd soubor ve form\u00e1tu MHT, tuto zranitelnost nelze br\u00e1t na lehkou v\u00e1hu, i p\u0159es absenci reakce ze strany Microsoftu. Skupiny hacker\u016f ji\u017e d\u0159\u00edve vyu\u017e\u00edvaly soubory MHT k phishingu a \u0161\u00ed\u0159en\u00ed malware, nic nep\u0159ek\u00e1\u017e\u00ed tomu, aby se t\u00edmto zab\u00fdvaly i nyn\u00ed. <\/p>\n

Aby se vyhnuli t\u00e9to a mnoha podobn\u00fdm zranitelnostem, sta\u010d\u00ed v\u011bnovat pozornost p\u0159\u00edpon\u00e1m soubor\u016f, kter\u00e9 stahujete z internetu, a zkontrolovat je antivirem nebo na str\u00e1nk\u00e1ch VirusTotal. Pro dal\u0161\u00ed opatrnost jednodu\u0161e nastavte pro soubory .mht nebo .mhtml jako v\u00fdchoz\u00ed aplikaci sv\u016fj obl\u00edben\u00fd prohl\u00ed\u017ee\u010d, kter\u00fd nen\u00ed Internet Explorer. Nap\u0159\u00edklad ve Windows 10 se to snadno prov\u00e1d\u00ed v nab\u00eddce 'V\u00fdb\u011br v\u00fdchoz\u00edch aplikac\u00ed pro typy soubor\u016f'.<\/p>\n

\"Microsoft<\/p>\n

<\/p>\n

<\/center><\/p>\n

\t\t\t\t


\n\t\t\t\t\t\t\t\t<\/center>
\n
Zdroj: 3dnews.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043f\u044f\u0442\u043d\u0438\u0446\u0443 12 \u0430\u043f\u0440\u0435\u043b\u044f \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442 \u043f\u043e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0414\u0436\u043e\u043d \u041f\u0435\u0439\u0434\u0436 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u043d\u0435\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438 Internet Explorer, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043b \u0435\u0451 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044e. \u0414\u0430\u043d\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0441\u0438\u0441\u0442\u0435\u043c Windows, \u043c\u0438\u043d\u0443\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u0432 \u0442\u043e\u043c, \u043a\u0430\u043a Internet Explorer \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u0442 \u0444\u0430\u0439\u043b\u044b \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 MHTML, \u043a\u0430\u043a \u043f\u0440\u0430\u0432\u0438\u043b\u043e, \u0438\u043c\u0435\u044e\u0449\u0438\u0445 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":23533,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-31611","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Microsoft odm\u00edtl opravit zranitelnost nult\u00e9ho dne v Internet Explorer | ProHoster","description":"V p\u00e1tek 12. dubna zve\u0159ejnil odborn\u00edk na kybernetickou bezpe\u010dnost John Page informace o neopraven\u00e9 zranitelnosti v aktu\u00e1ln\u00ed verzi Internet Explorer a tak\u00e9 demonstroval jej\u00ed vyu\u017eit\u00ed.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/microsoft-otkazalas-ispravlyat-uyazvimost-nulevogo-dnya-v-nbsp-internet-explorer","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Microsoft \u043e\u0442\u043a\u0430\u0437\u0430\u043b\u0430\u0441\u044c \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f \u0432 Internet Explorer | ProHoster","og:description":"\u0412 \u043f\u044f\u0442\u043d\u0438\u0446\u0443 12 \u0430\u043f\u0440\u0435\u043b\u044f \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442 \u043f\u043e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0414\u0436\u043e\u043d \u041f\u0435\u0439\u0434\u0436 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u043d\u0435\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438 Internet Explorer, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043b \u0435\u0451 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044e.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/microsoft-otkazalas-ispravlyat-uyazvimost-nulevogo-dnya-v-nbsp-internet-explorer","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:42:10+00:00","article:modified_time":"2019-10-31T18:42:10+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31611","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 06:59:22","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:14:43","updated":"2026-01-21 06:59:22","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/31611","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=31611"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/31611\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/23533"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=31611"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=31611"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=31611"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}