{"id":54354,"date":"2019-12-24T00:00:00","date_gmt":"2019-12-23T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/uyazvimost-v-sqlite-pozvolyayushhaya-udalyonno-atakovat-chrome-cherez-websql"},"modified":"2020-02-18T14:02:21","modified_gmt":"2020-02-18T11:02:21","slug":"uyazvimost-v-sqlite-pozvolyayushhaya-udalyonno-atakovat-chrome-cherez-websql","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimost-v-sqlite-pozvolyayushhaya-udalyonno-atakovat-chrome-cherez-websql","title":{"rendered":"S\u00e5rbarhed i SQLite, der muligg\u00f8r fjernangreb p\u00e5 Chrome via WebSQL","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Sikkerhedsforskere fra det kinesiske firma Tencent bogen \"ITIL Foundation. ITIL 4 Edition\". Dens opgave er at forklare n\u00f8glebegreberne og l\u00e6gge grundlaget for efterf\u00f8lgende studier af avancerede programmer.<\/a><\/noindex> den nye variant af s\u00e5rbarheden Magellan<\/a><\/noindex> (CVE-2019-13734<\/a><\/noindex>), der muligg\u00f8r eksekvering af kode ved behandling af specifikt formaterede SQL-konstruktioner i SQLite. En lignende s\u00e5rbarhed blev offentliggjort<\/a><\/noindex> opdaget af de samme forskere for et \u00e5r siden. S\u00e5rbarheden er bem\u00e6rkelsesv\u00e6rdig, da den tillader fjernangreb p\u00e5 Chrome-browseren og giver mulighed for kontrol over brugersystemet ved at \u00e5bne web-sider, der kontrolleres af angriberen. <\/p>\n

Angrebet p\u00e5 Chrome\/Chromium udf\u00f8res via WebSQL API'en, hvis h\u00e5ndterer er baseret p\u00e5 SQLite-kode. Angreb p\u00e5 andre applikationer er kun mulige, hvis de tillader SQL-konstruktioner at blive sendt til SQLite udefra, f.eks. ved at bruge SQLite som datainterchange-format. Firefox er ikke s\u00e5rbar, da Mozilla har afvist<\/a><\/noindex> implementeringen af WebSQL til fordel<\/a><\/noindex> API IndexedDB. <\/p>\n

Google har l\u00f8st problemet i versionen Chrome 79<\/a><\/noindex>. Problemet blev rettet<\/a><\/noindex> 17. november, og i kodebasen for Chromium \u2014 21. november<\/a><\/noindex>.
\nProblemet findes i koden<\/a><\/noindex> for fuldteksts\u00f8gning FTS3 og gennem manipulation af skyggetabeller (shadow tables, en speciel type virtuelle tabeller med skrivefunktioner) kan f\u00f8re til beskadigelse af indekset og buffer overflow. Detaljeret information om udnyttelsesteknikken vil blive offentliggjort om 90 dage.<\/p>\n

Den nye version af SQLite med rettelsen er endnu ikke dannet<\/a><\/noindex> (forventes<\/a><\/noindex> 31. december). Som en midlertidig beskyttelsesmetode kan man fra SQLite 3.26.0 anvende SQLITE_DBCONFIG_DEFENSIVE tilstand, som forhindrer skrivning til skyggetabeller og anbefales ved behandling af eksterne SQL-foresp\u00f8rgsler i SQLite. I distributionerne forbliver s\u00e5rbarheden i SQLite-biblioteket uoprettet i Debian<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, RHEL<\/a><\/noindex>, openSUSE\/SUSE<\/a><\/noindex>, Arch Linux<\/a><\/noindex>, Fedora<\/a><\/noindex>, FreeBSD<\/a><\/noindex>. Chromium er allerede blevet opdateret i alle distributioner og er ikke s\u00e5rbart, men problemet kan p\u00e5virke forskellige tredjeparts-browser og applikationer, der bruger Chromium-motoren, samt Android-applikationer baseret p\u00e5 Webview.<\/p>\n

Derudover er der ogs\u00e5 identificeret 4 mindre farlige problemer i SQLite (CVE-2019-13750<\/a><\/noindex>, CVE-2019-13751<\/a><\/noindex>, CVE-2019-13752<\/a><\/noindex>, CVE-2019-13753<\/a><\/noindex>), der kan f\u00f8re til informationsl\u00e6kager og omg\u00e5else af begr\u00e6nsninger (kan bruges som medvirkende faktorer til angreb p\u00e5 Chrome). De n\u00e6vnte problemer er blevet l\u00f8st i koden for SQLite den 13. december. Samlet set har problemerne gjort det muligt for forskere at udvikle et fungerende exploit, der muligg\u00f8r k\u00f8rsel af kode i konteksten af processe Chromium, der er ansvarlig for rendering.<\/p>\n

<\/a><\/noindex><\/p>\n

Kilde: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Tencent \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 Magellan (CVE-2019-13734), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0432 \u0421\u0423\u0411\u0414 SQLite \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 SQL-\u043a\u043e\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0439. \u041f\u043e\u0445\u043e\u0436\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0431\u044b\u043b\u0430 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430 \u0442\u0435\u043c\u0438 \u0436\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 \u0433\u043e\u0434 \u043d\u0430\u0437\u0430\u0434. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u0430 \u0442\u0435\u043c, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u0442\u044c \u0431\u0440\u0430\u0443\u0437\u0435\u0440 Chrome \u0438 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u043d\u0430\u0434 \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u043f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438 \u043f\u043e\u0434\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u043d\u044b\u0445 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 web-\u0441\u0442\u0440\u0430\u043d\u0438\u0446. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-54354","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47S\u00e5rbarhed i SQLite, der muligg\u00f8r fjernangreb p\u00e5 Chrome via WebSQL | ProHoster","description":"Sikkerhedsforskere fra det kinesiske firma Tencent har pr\u00e6senteret en ny variant af s\u00e5rbarheden","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimost-v-sqlite-pozvolyayushhaya-udalyonno-atakovat-chrome-cherez-websql","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 SQLite, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u0442\u044c Chrome \u0447\u0435\u0440\u0435\u0437 WebSQL | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Tencent \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimost-v-sqlite-pozvolyayushhaya-udalyonno-atakovat-chrome-cherez-websql","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-23T21:00:00+00:00","article:modified_time":"2020-02-18T11:02:21+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"54354","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 11:02:28","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:07:25","updated":"2026-01-24 11:02:28","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/54354","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=54354"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/54354\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=54354"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=54354"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=54354"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}