{"id":101354,"date":"2021-09-21T10:22:45","date_gmt":"2021-09-21T08:22:45","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-openoffice-pozvolyayushhaya-vypolnit-kod-pri-otkrytii-fajla"},"modified":"2021-09-21T10:22:45","modified_gmt":"2021-09-21T08:22:45","slug":"uyazvimost-v-openoffice-pozvolyayushhaya-vypolnit-kod-pri-otkrytii-fajla","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-openoffice-pozvolyayushhaya-vypolnit-kod-pri-otkrytii-fajla","title":{"rendered":"OpenOffice'i haavatavus, mis v\u00f5imaldab koodi t\u00e4itmist faili avamisel.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Apache OpenOffice'i kontoripaketis on tuvastatud haavatavus (CVE-2021-33035), mis v\u00f5imaldab koodi k\u00e4ivitamist spetsiaalselt vormindatud DBF-faili avamisel. Probleemi avastanud teadlane teatas, et Windowsi platvormile on loodud t\u00f6\u00f6tav eksploit. Haavatavuse parandus on praegu saadaval ainult projekti hoidlas pat\u0161i vormis, mis on kaasatud OpenOffice 4.1.11 testversioonidesse. Stabiilse haru jaoks pole veel uuendusi v\u00e4lja antud. <\/p>\n

Probleem tekkis seet\u00f5ttu, et OpenOffice'i m\u00e4lu m\u00e4\u00e4ramisel tugines see failide DBF p\u00e4ise fieldLength ja fieldType v\u00e4\u00e4rtustele, mitte kontrollides samal ajal andmev\u00e4ljade tegelikku t\u00fc\u00fcpi. R\u00fcnnaku sooritamiseks on v\u00f5imalik m\u00e4\u00e4rata fieldType v\u00e4\u00e4rtuseks INTEGER, kuid paigutada andmed suuremas mahus ning m\u00e4\u00e4rata fieldLength v\u00e4\u00e4rtus, mis ei vasta INTEGER-t\u00fc\u00fcpi andmete suurusele, mis toob kaasa selle, et andmev\u00e4lja l\u00f5pp kirjutatakse m\u00e4\u00e4ratud puhvriv\u00e4ljast v\u00e4lja. Tulemusena suudeti kontrollitud puhver\u00fclekanne uurijal asendada tagasikutsumise suunaja funktsioonist ning kasutada tagasip\u00f6\u00f6rdl\u00e4henemise tehnikaid (ROP \u2014 Return-Oriented Programming), et k\u00e4ivitada oma kood. <\/p>\n

ROP-tehnika kasutamisel ei p\u00fc\u00fca r\u00fcndaja oma koodi m\u00e4lu paigutada, vaid opereerib juba laaditud raamatukogudes olemasolevate masinakeele k\u00e4skudega, mis l\u00f5pevad tagasituleku juhisega (tavaliselt on need raamatukogufunktsioonide l\u00f5ppude k\u00e4sklused). Exploidi t\u00f6\u00f6 on v\u00e4hendatud selliste plokkide (\"gadgetid\") kutseketi \u00fclesehituseks, et saavutada vajalikke funktsioone. OpenOffice'i exploidi gadgetid kasutasid koodi, mis p\u00e4rines OpenOffice'is kasutatavast libxml2 raamatukogust, mis erinevalt OpenOfficest oli koostatud ilma DEP (Data Execution Prevention) ja ASLR (Address Space Layout Randomization) kaitsemehhanismideta. <\/p>\n

OpenOffice'i arendajatele teatati probleemist 4. mail, mille j\u00e4rel oli avalik haavatavuse teave kavandatud 30. augustiks. Kuna m\u00e4\u00e4ratud ajaks ei olnud stabiilse versiooni uuendust koostatud, l\u00fckkas uurija detailide avaldamise edasi 18. septembrile, kuid OpenOffice'i arendajad ei olnud suutnud versiooni 4.1.11 selleks ajaks v\u00e4lja anda. M\u00e4rkimisv\u00e4\u00e4rne on, et sama uuringu k\u00e4igus leiti sarnane haavatavus Microsoft Office Accessi DBF formaadi toe koodis (CVE-2021-38646), mille \u00fcksikasjad avaldatakse hiljem. LibreOffice'is ei leitud probleeme.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043e\u0444\u0438\u0441\u043d\u043e\u043c \u043f\u0430\u043a\u0435\u0442\u0435 Apache OpenOffice \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-33035), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 DBF. \u0412\u044b\u044f\u0432\u0438\u0432\u0448\u0438\u0439 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b \u043e \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0438 \u0440\u0430\u0431\u043e\u0447\u0435\u0433\u043e \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430 \u0434\u043b\u044f \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Windows. \u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u043a\u0430 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0444\u043e\u0440\u043c\u0435 \u043f\u0430\u0442\u0447\u0430 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432\u043e\u0448\u0451\u043b \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 \u0442\u0435\u0441\u0442\u043e\u0432\u044b\u0445 \u0441\u0431\u043e\u0440\u043e\u043a OpenOffice 4.1.11. \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 \u043f\u043e\u043a\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101354","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47OpenOffice'i haavatavus, mis v\u00f5imaldab koodi t\u00e4itmist faili avamisel | ProHoster","description":"Apache OpenOffice'i kontoripaketis tuvastati haavatavus (CVE-2021-33035), mis v\u00f5imaldab koodi t\u00e4itmist spetsiaalselt kujundatud DBF-formaadiga faili avamisel.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-openoffice-pozvolyayushhaya-vypolnit-kod-pri-otkrytii-fajla","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 OpenOffice, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438 \u0444\u0430\u0439\u043b\u0430 | ProHoster","og:description":"\u0412 \u043e\u0444\u0438\u0441\u043d\u043e\u043c \u043f\u0430\u043a\u0435\u0442\u0435 Apache OpenOffice \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-33035), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 DBF.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-openoffice-pozvolyayushhaya-vypolnit-kod-pri-otkrytii-fajla","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-09-21T08:22:45+00:00","article:modified_time":"2021-09-21T08:22:45+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101354","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-09-21 08:27:59","updated":"2022-10-03 20:50:17","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/101354","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=101354"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/101354\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=101354"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=101354"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=101354"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}