{"id":36775,"date":"2019-10-31T22:13:44","date_gmt":"2019-10-31T19:13:44","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimost-v-libreoffice-pozvolyayushhaya-vypolnit-kod-pri-otkrytii-vredonosnyh-dokumentov\/"},"modified":"2019-10-31T22:13:44","modified_gmt":"2019-10-31T19:13:44","slug":"uyazvimost-v-libreoffice-pozvolyayushhaya-vypolnit-kod-pri-otkrytii-vredonosnyh-dokumentov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-libreoffice-pozvolyayushhaya-vypolnit-kod-pri-otkrytii-vredonosnyh-dokumentov","title":{"rendered":"Zranitelnost v LibreOffice umo\u017e\u0148uj\u00edc\u00ed spu\u0161t\u011bn\u00ed k\u00f3du p\u0159i otev\u0159en\u00ed \u0161kodliv\u00fdch dokument\u016f","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V kancel\u00e1\u0159sk\u00e9m bal\u00edku LibreOffice byla odhalena<\/a><\/noindex> zranitelnost (CVE-2019-9848<\/a><\/noindex>), kterou lze vyu\u017e\u00edt k proveden\u00ed libovoln\u00e9ho k\u00f3du p\u0159i otev\u00edr\u00e1n\u00ed dokument\u016f p\u0159ipraven\u00fdch \u00fato\u010dn\u00edkem. <\/p>\n

Zranitelnost je zp\u016fsobena t\u00edm, \u017ee komponenta LibreLogo, ur\u010den\u00e1 k u\u010den\u00ed programov\u00e1n\u00ed a vlo\u017een\u00ed vektorov\u00fdch v\u00fdkres\u016f, p\u0159ekl\u00e1d\u00e1 sv\u00e9 operace do k\u00f3du v jazyce Python. T\u00edm, \u017ee m\u00e1 mo\u017enost prov\u00e1d\u011bt p\u0159\u00edkazy LibreLogo, m\u016f\u017ee \u00fato\u010dn\u00edk dos\u00e1hnout spu\u0161t\u011bn\u00ed libovoln\u00e9ho k\u00f3du v jazyce Python v kontextu aktu\u00e1ln\u00edho u\u017eivatelsk\u00e9ho sezen\u00ed, vyu\u017e\u00edvaj\u00edc\u00ed p\u0159\u00edkaz «run» poskytovan\u00fd v LibreLogo. Z Pythonu pomoc\u00ed funkce system() lze naopak volat libovoln\u00e9 syst\u00e9mov\u00e9 p\u0159\u00edkazy.<\/p>\n

LibreLogo je voliteln\u00e1 komponenta, ale v LibreOffice jsou ve v\u00fdchoz\u00edm nastaven\u00ed navr\u017eeny makra, kter\u00e1 umo\u017e\u0148uj\u00ed vyvol\u00e1n\u00ed LibreLogo a nevy\u017eaduj\u00ed p\u0159i sv\u00e9m proveden\u00ed potvrzen\u00ed souhlasu s proveden\u00edm operace a nezobrazuj\u00ed varov\u00e1n\u00ed, i kdy\u017e je aktivov\u00e1n re\u017eim maxim\u00e1ln\u00ed ochrany makra (v\u00fdb\u011br \u00farovn\u011b «Very High»).
\nPro \u00fatok lze p\u0159i\u0159adit takov\u00e9 makro k obslu\u017en\u00e9 rutin\u011b ud\u00e1losti, kter\u00e1 se spou\u0161t\u00ed nap\u0159\u00edklad p\u0159i najet\u00ed kurzoru my\u0161i na ur\u010ditou oblast nebo aktivaci vstupn\u00edho fokusu na dokumentu (ud\u00e1lost onFocus). Nakonec lze p\u0159i otev\u0159en\u00ed dokumentu p\u0159ipraven\u00e9ho \u00fato\u010dn\u00edkem dos\u00e1hnout skryt\u00e9ho proveden\u00ed Python k\u00f3du, ani\u017e by si toho u\u017eivatel v\u0161iml. Nap\u0159\u00edklad v p\u0159edveden\u00e9m p\u0159\u00edkladu exploitu se p\u0159i otev\u0159en\u00ed dokumentu bez varov\u00e1n\u00ed spust\u00ed syst\u00e9mov\u00fd kalkul\u00e1tor.
\n

\"Zranitelnost<\/center><\/p>\n

Zranitelnost byla ti\u0161e opravena v aktualizaci LibreOffice 6.2.5, vydan\u00e9 1. \u010dervence, ale jak se uk\u00e1zalo, probl\u00e9m nebyl zcela vy\u0159e\u0161en (bylo blokov\u00e1no pouze vol\u00e1n\u00ed LibreLogo z makra) a n\u011bkter\u00e9 dal\u0161\u00ed vektory pro prov\u00e1d\u011bn\u00ed \u00fatok\u016f z\u016fst\u00e1vaj\u00ed neopraveny.<\/a><\/noindex> Krom\u011b toho probl\u00e9m nen\u00ed vy\u0159e\u0161en ve verzi 6.1.6, doporu\u010dovan\u00e9 pro firemn\u00ed u\u017eivatele. \u00dapln\u00e9 odstran\u011bn\u00ed zranitelnosti je pl\u00e1nov\u00e1no ve verzi LibreOffice 6.3, kter\u00e1 se o\u010dek\u00e1v\u00e1 p\u0159\u00ed\u0161t\u00ed t\u00fdden. Do vyd\u00e1n\u00ed pln\u00e9ho aktualizace se u\u017eivatel\u016fm doporu\u010duje v\u00fdslovn\u011b deaktivovat komponent LibreLogo, kter\u00fd je ve v\u00fdchoz\u00edm nastaven\u00ed dostupn\u00fd v mnoha balen\u00edch. \u010c\u00e1ste\u010dn\u00e9 odstran\u011bn\u00ed zranitelnosti bylo provedeno v Debian<\/a><\/noindex>, Fedora<\/a><\/noindex>, SUSE\/openSUSE<\/a><\/noindex> a Ubuntu<\/a><\/noindex>.<\/p>\n

<\/a><\/noindex><\/p>\n

Zdroj: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043e\u0444\u0438\u0441\u043d\u043e\u043c \u043f\u0430\u043a\u0435\u0442\u0435 LibreOffice \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2019-9848), \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u043e\u0432, \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u043c. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u0442\u0435\u043c, \u0447\u0442\u043e \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442 LibreLogo, \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u044b\u0439 \u0434\u043b\u044f \u043e\u0431\u0443\u0447\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044e \u0438 \u0432\u0441\u0442\u0430\u0432\u043a\u0438 \u0432\u0435\u043a\u0442\u043e\u0440\u043d\u044b\u0445 \u0440\u0438\u0441\u0443\u043d\u043a\u043e\u0432, \u0442\u0440\u0430\u043d\u0441\u043b\u0438\u0440\u0443\u0435\u0442 \u0441\u0432\u043e\u0438 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u0432 \u043a\u043e\u0434 \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 Python. \u0418\u043c\u0435\u044f \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0438 LibreLogo \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043b\u044e\u0431\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 Python […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":27546,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-36775","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranitelnost v LibreOffice umo\u017e\u0148uj\u00edc\u00ed vykon\u00e1n\u00ed k\u00f3du p\u0159i otev\u00edr\u00e1n\u00ed \u0161kodliv\u00fdch dokument\u016f | ProHoster","description":"V kancel\u00e1\u0159sk\u00e9m bal\u00edku LibreOffice byla zji\u0161t\u011bna zranitelnost.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-libreoffice-pozvolyayushhaya-vypolnit-kod-pri-otkrytii-vredonosnyh-dokumentov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 LibreOffice, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u043e\u0432 | ProHoster","og:description":"\u0412 \u043e\u0444\u0438\u0441\u043d\u043e\u043c \u043f\u0430\u043a\u0435\u0442\u0435 LibreOffice \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-libreoffice-pozvolyayushhaya-vypolnit-kod-pri-otkrytii-vredonosnyh-dokumentov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:13:44+00:00","article:modified_time":"2019-10-31T19:13:44+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"36775","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 04:48:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:39:22","updated":"2026-01-22 04:48:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/36775","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=36775"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/36775\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/27546"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=36775"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=36775"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=36775"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}