{"id":40697,"date":"2020-02-03T14:36:04","date_gmt":"2020-02-03T11:36:04","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/obnovlenie-openwrt-19-07-1-s-ustraneniem-uyazvimosti-dopuskayushhej-podmenu-paketov"},"modified":"2020-02-03T14:36:04","modified_gmt":"2020-02-03T11:36:04","slug":"obnovlenie-openwrt-19-07-1-s-ustraneniem-uyazvimosti-dopuskayushhej-podmenu-paketov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/obnovlenie-openwrt-19-07-1-s-ustraneniem-uyazvimosti-dopuskayushhej-podmenu-paketov","title":{"rendered":"Opdatering af OpenWrt 19.07.1 med rettelse af en s\u00e5rbarhed, der tillader pakkeudveksling","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Korrigerende udgivelser af OpenWrt-distributionen er blevet offentliggjort 18.06.7<\/a><\/noindex> og 19.07.1<\/a><\/noindex>, som fjerner farlig s\u00e5rbarhed<\/a><\/noindex> (CVE-2020-7982) i pakkeh\u00e5ndtereren opkg<\/a><\/noindex>, der muligg\u00f8r en MITM-angreb og \u00e6ndring af indholdet i den pakke, der downloades fra depotet. P\u00e5 grund af en fejl i kontrolsum-checks, kan en angriber skabe betingelser, under hvilke SHA-256 kontrolsummerne i den digitalt signeret pakkebeskrivelse vil blive ignoreret, hvilket giver mulighed for at omg\u00e5 integritetskontrolmekanismerne for de downloadede ipk-ressourcer.<\/p>\n

Problemet har v\u00e6ret synligt siden februar 2017, efter tilf\u00f8jelse<\/a><\/noindex> koden til at ignorere indledende mellemrum, der er foran kontrolsummen. P\u00e5 grund af en fejl ved springet over mellemrum blev pointeren ikke flyttet i strengen, og decoding-l\u00f8kken for den hexadecimale SHA-256 sekvens returnerede straks kontrolsummen med nul l\u00e6ngde. <\/p>\n

Da pakkeadministratoren opkg i OpenWrt k\u00f8rer med root-rettigheder, kan en angriber under en MITM-angreb diskret \u00e6ndre ipk-pakken, der downloades fra arkivet, under udf\u00f8relsen af brugernes kommando «opkg install», og dermed udf\u00f8re sin egen kode med root-rettigheder ved at tilf\u00f8je sine egne behandlerscripts til pakken, som kaldes ved installation. For at udnytte s\u00e5rbarheden skal angriberen ogs\u00e5 \u00e6ndre det korrekte og signerede indeks for pakkerne (for eksempel det, der leveres fra downloads.openwrt.org). St\u00f8rrelsen p\u00e5 den \u00e6ndrede pakke skal svare til den oprindelige st\u00f8rrelse, der er angivet i indekset.<\/p>\n

I situationer, hvor det er n\u00f8dvendigt at undg\u00e5 at opdatere hele firmware, kan man kun opdatere pakkeh\u00e5ndtereren opkg ved at udf\u00f8re f\u00f8lgende kommandoer:<\/p>\n

cd \/tmp
\n opkg update
\n opkg download opkg
\n zcat .\\\/opkg-lists\\\/openwrt_base | grep -A10 «Package: opkg» | grep SHA256sum
\n sha256sum .\/opkg_2020-01-25-c09fe209-1_*.ipk<\/p>\n

Derefter skal de viste kontrolsummer sammenlignes, og hvis de stemmer overens, skal man udf\u00f8re:<\/p>\n

opkg install .\/opkg_2020-01-25-c09fe209-1_*.ipk<\/p>\n

I de nye versioner er endnu en ASLR i programmer med setuid-flaget og bestemme adressefordelingen i de indl\u00e6ste biblioteker gennem manipulation af milj\u00f8variablen LD_PREFER_MAP_32BIT_EXEC.<\/a><\/noindex> i biblioteket libubox<\/a><\/noindex>, der kan f\u00f8re til buffer overflow ved behandling i funktionen blobmsg_format_json<\/a><\/noindex> specielt formaterede serialiserede bin\u00e6re data eller data i JSON-format. Biblioteket anvendes i komponenter som netifd, procd, ubus, rpcd og uhttpd, samt i pakken auc<\/a><\/noindex> (Attended sysUpgrade CLI). Bufferoverl\u00f8b opst\u00e5r ved overf\u00f8rsel af store numeriske attributter af typen «double» i blob-blokke. For at kontrollere, om systemet er s\u00e5rbart, kan du udf\u00f8re f\u00f8lgende kommando:<\/p>\n

$ ubus call luci getFeatures \
\n ‘{ «banik»: 00192200197600198000198100200400.1922 }’<\/p>\n

Ud over at udbedre s\u00e5rbarheder og rette de akkumulerede fejl i udgivelsen OpenWrt 19.07.1 er Linux-kernen (fra 4.14.162 til 4.14.167) ogs\u00e5 blevet opdateret, og der er l\u00f8st ydeevneproblemer ved brug af 5GHz-frekvenser, samt supporten for Ubiquiti Rocket M Titanium, Netgear WN2500RP v1,
\n Zyxel NSA325, Netgear WNR3500 V2, Archer C6 v2, Ubiquiti EdgeRouter-X, Archer C20 v4, Archer C50 v4, Archer MR200, TL-WA801ND v5, HiWiFi HC5962, Xiaomi Mi Router 3 Pro samt Netgear R6350.<\/p>\n

<\/a><\/noindex><\/p>\n

Kilde: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430 OpenWrt 18.06.7 \u0438 19.07.1, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u043e\u043f\u0430\u0441\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-7982) \u0432 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u043c \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0435 opkg, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0442\u044c MITM-\u0430\u0442\u0430\u043a\u0443 \u0438 \u043f\u043e\u0434\u043c\u0435\u043d\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u043c\u043e\u0433\u043e \u0438\u0437 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u0430. \u0418\u0437-\u0437\u0430 \u043e\u0448\u0438\u0431\u043a\u0438 \u0432 \u043a\u043e\u0434\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u043d\u044b\u0445 \u0441\u0443\u043c\u043c, \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043c\u043e\u0436\u0435\u0442 \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u0443\u0441\u043b\u043e\u0432\u0438\u044f, \u043f\u0440\u0438 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u043d\u044b\u0435 \u0441\u0443\u043c\u043c\u044b SHA-256, \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u0432 \u0437\u0430\u0432\u0435\u0440\u0435\u043d\u043d\u043e\u043c \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u044c\u044e \u0438\u043d\u0434\u0435\u043a\u0441\u0435 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0431\u0443\u0434\u0443\u0442 \u0438\u0433\u043d\u043e\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u044b, \u0447\u0442\u043e \u0434\u0430\u0451\u0442 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-40697","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47OpenWrt 19.07.1 opdatering med udbedring af s\u00e5rbarhed, der tillader manipulation af pakker | ProHoster","description":"Korrigerende udgivelser af OpenWrt 18.06.7-distriubutionen er blevet offentliggjort og","canonical_url":"https:\/\/prohoster.info\/da\/blog\/obnovlenie-openwrt-19-07-1-s-ustraneniem-uyazvimosti-dopuskayushhej-podmenu-paketov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 OpenWrt 19.07.1 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0435\u0439 \u043f\u043e\u0434\u043c\u0435\u043d\u0443 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430 OpenWrt 18.06.7 \u0438","og:url":"https:\/\/prohoster.info\/da\/blog\/obnovlenie-openwrt-19-07-1-s-ustraneniem-uyazvimosti-dopuskayushhej-podmenu-paketov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-03T11:36:04+00:00","article:modified_time":"2020-02-03T11:36:04+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"40697","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 00:32:41","updated":"2022-09-30 04:43:23","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/40697","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=40697"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/40697\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=40697"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=40697"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=40697"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}