{"id":84053,"date":"2020-06-05T01:42:08","date_gmt":"2020-06-04T23:42:08","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/opasnye-uyazvimosti-v-qemu-node-js-grafana-i-android"},"modified":"2020-06-05T01:42:08","modified_gmt":"2020-06-04T23:42:08","slug":"opasnye-uyazvimosti-v-qemu-node-js-grafana-i-android","status":"publish","type":"post","link":"https:\/\/prohoster.info\/es\/blog\/news\/opasnye-uyazvimosti-v-qemu-node-js-grafana-i-android","title":{"rendered":"Vulnerabilidades peligrosas en QEMU, Node.js, Grafana y Android","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Vulnerabilidades recientemente descubiertas:<\/p>\n<ul>\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.openwall.com\/lists\/oss-security\/2020\/06\/03\/6\">Vulnerabilidad<\/a><\/noindex> (<noindex><a rel=\"nofollow\" href=\"https:\/\/security-tracker.debian.org\/tracker\/CVE-2020-13765\">CVE-2020-13765<\/a><\/noindex>) en QEMU, que puede llevar potencialmente a la ejecuci\u00f3n de c\u00f3digo con los derechos del proceso QEMU en el sistema host al cargar en un sistema hu\u00e9sped una imagen de n\u00facleo especialmente dise\u00f1ada. El problema es causado por un desbordamiento de b\u00fafer en el c\u00f3digo que copia el contenido de la ROM durante la etapa de arranque del sistema y se manifiesta al cargar contenido de una imagen de n\u00facleo de 32 bits en memoria. La correcci\u00f3n est\u00e1 disponible solo en forma de <noindex><a rel=\"nofollow\" href=\"https:\/\/git.qemu.org\/?p=qemu.git;a=commitdiff;h=e423455c4f23a1a828901c78fe6d03b7dde79319\">parche<\/a><\/noindex>.\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/nodejs.org\/en\/blog\/vulnerability\/june-2020-security-releases\/\">Cuatro vulnerabilidades<\/a><\/noindex> en Node.js. Las vulnerabilidades <noindex><a rel=\"nofollow\" href=\"https:\/\/nodejs.org\/en\/blog\/release\/v14.4.0\/\">han sido solucionadas<\/a><\/noindex> en las versiones 14.4.0, 10.21.0 y 12.18.0.\n<ul>\n<li class=\"l\"> CVE-2020-8172 \u2014 permite sortear la verificaci\u00f3n del certificado del host al reutilizar una sesi\u00f3n TLS.\n<li class=\"l\"> CVE-2020-8174 \u2014 potencialmente permite la ejecuci\u00f3n de c\u00f3digo en el sistema debido a un desbordamiento de b\u00fafer en las funciones napi_get_value_string_*(), que ocurre en ciertas llamadas. <noindex><a rel=\"nofollow\" href=\"https:\/\/www.npmjs.com\/package\/node-addon-api\">N-API<\/a><\/noindex> (API de C para escribir complementos nativos).\n<li class=\"l\"> CVE-2020-10531 \u2014 desbordamiento de enteros en ICU (Componentes Internacionales para Unicode) para C\/C++, que puede llevar a un desbordamiento de b\u00fafer al usar la funci\u00f3n UnicodeString::doAppend().\n<li class=\"l\"> CVE-2020-11080 \u2014 permite realizar una denegaci\u00f3n de servicio (100% de carga en la CPU) mediante la transmisi\u00f3n de grandes tramas \u201cSETTINGS\u201d al conectarse por HTTP\/2.\n<\/ul>\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.openwall.com\/lists\/oss-security\/2020\/06\/03\/4\">Vulnerabilidad<\/a><\/noindex> en la plataforma de visualizaci\u00f3n interactiva de m\u00e9tricas Grafana, utilizada para crear gr\u00e1ficos de monitoreo visual basado en varias fuentes de datos. Un error en el c\u00f3digo de gesti\u00f3n de avatares permite, sin pasar por la autenticaci\u00f3n, iniciar el env\u00edo de una solicitud HTTP desde Grafana a cualquier URL y ver el resultado de esa solicitud. Esta caracter\u00edstica puede ser utilizada, por ejemplo, para explorar la red interna de las empresas que utilizan Grafana. El problema <noindex><a rel=\"nofollow\" href=\"https:\/\/grafana.com\/blog\/2020\/06\/03\/grafana-6.7.4-and-7.0.2-released-with-important-security-fix\/\">se solucion\u00f3<\/a><\/noindex> en las versiones<br \/>\nGrafana 6.7.4 y 7.0.2. Como soluci\u00f3n de protecci\u00f3n, se recomienda limitar el acceso a la URL \u201c\/avatar\/*\u201d en el servidor con Grafana.<\/p>\n<li class=\"l\">  <noindex><a rel=\"nofollow\" href=\"https:\/\/source.android.com\/security\/bulletin\/2020-06-01\">Publicado<\/a><\/noindex> Conjunto de correcciones de seguridad de junio para Android, que aborda 34 vulnerabilidades. Cuatro problemas se han clasificado como cr\u00edticos: dos vulnerabilidades (CVE-2019-14073, CVE-2019-14080) en componentes patentados de Qualcomm y dos vulnerabilidades en el sistema que permiten ejecutar c\u00f3digo al procesar datos externos especialmente dise\u00f1ados (CVE-2020-0117 \u2014 desbordamiento de enteros. <noindex><a rel=\"nofollow\" href=\"https:\/\/android.googlesource.com\/platform\/system\/bt\/+\/1570b62c88d7c5b9c6bfe43da8cc16ea30d3e8df\">en el stack de Bluetooth,<\/a><\/noindex> CVE-2020-8597 \u2014 desbordamiento de EAP en pppd <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=52498\">CVE-2020-8597 \u2014 desbordamiento de EAP en pppd.<\/a><\/noindex>).\n<\/ul>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Fuente: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=53085\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-13765) \u0432 QEMU, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 QEMU \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 \u0445\u043e\u0441\u0442-\u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043f\u0440\u0438 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0435 \u0432 \u0433\u043e\u0441\u0442\u0435\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043e\u0431\u0440\u0430\u0437\u0430 \u044f\u0434\u0440\u0430. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u043a\u043e\u0434\u0435 \u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u041f\u0417\u0423 \u043d\u0430 \u044d\u0442\u0430\u043f\u0435 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0438 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u0440\u0438 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0435 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e 32-\u0440\u0430\u0437\u0440\u044f\u0434\u043d\u043e\u0433\u043e \u043e\u0431\u0440\u0430\u0437\u0430 \u044f\u0434\u0440\u0430 \u0432 \u043f\u0430\u043c\u044f\u0442\u044c. \u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-84053","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/es\/blog\/news\/opasnye-uyazvimosti-v-qemu-node-js-grafana-i-android\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"es_ES\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041e\u043f\u0430\u0441\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 QEMU, Node.js, Grafana \u0438 Android | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/es\/blog\/news\/opasnye-uyazvimosti-v-qemu-node-js-grafana-i-android\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-06-04T23:42:08+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-06-04T23:42:08+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilidades cr\u00edticas en QEMU, Node.js, Grafana y Android | ProHoster","description":"\ud83e\udd47Vulnerabilidades cr\u00edticas en QEMU, Node.js, Grafana y Android | ProHoster","canonical_url":"https:\/\/prohoster.info\/es\/blog\/news\/opasnye-uyazvimosti-v-qemu-node-js-grafana-i-android","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"es_ES","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u043f\u0430\u0441\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 QEMU, Node.js, Grafana \u0438 Android | ProHoster","og:description":"\u041d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (","og:url":"https:\/\/prohoster.info\/es\/blog\/news\/opasnye-uyazvimosti-v-qemu-node-js-grafana-i-android","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-04T23:42:08+00:00","article:modified_time":"2020-06-04T23:42:08+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"84053","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 15:05:33","updated":"2022-09-28 11:57:16","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts\/84053","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/comments?post=84053"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts\/84053\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/media?parent=84053"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/categories?post=84053"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/tags?post=84053"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}