{"id":103636,"date":"2022-03-27T15:36:39","date_gmt":"2022-03-27T13:36:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-zlib-proyavlyayushhayasya-pri-szhatii-speczialno-oformlennyh-dannyh"},"modified":"2022-03-27T15:36:39","modified_gmt":"2022-03-27T13:36:39","slug":"uyazvimost-v-zlib-proyavlyayushhayasya-pri-szhatii-speczialno-oformlennyh-dannyh","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-zlib-proyavlyayushhayasya-pri-szhatii-speczialno-oformlennyh-dannyh","title":{"rendered":"Zlibis on haavatavus, mis ilmneb spetsiaalselt vormistatud andmete tihendamise k\u00e4igus","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Zlib raamatukogus tuvastati haavatavus (CVE-2018-25032), mis p\u00f5hjustab p\u00fcstitatud s\u00fcmbolite j\u00e4rjestuse tihendamisel puhversalvese t\u00e4itumise. Praeguses vormis demonstreeriti uurijate poolt v\u00f5imalust protsessi \u00e4kiliseks l\u00f5petamiseks. Probleemi t\u00f5sisemaid tagaj\u00e4rgi pole veel uuritud. <\/p>\n

Haavatavus ilmneb alates versioonist zlib 1.2.2.2, m\u00f5jutades ka viimast zlib 1.2.11 v\u00e4ljaannet. M\u00e4rkimisv\u00e4\u00e4rne on see, et haavatavuse parandamiseks m\u00f5eldud patch esitati juba 2018. aastal, kuid arendajad ei p\u00f6\u00f6ranud sellele t\u00e4helepanu ega v\u00e4ljastanud parandavat v\u00e4ljaannet (zlib raamatukogu v\u00e4rskendati viimati 2017. aastal). Parandust ei ole samuti praegu kaasatud pakettide koosseisu, mida pakuvad erinevad distributsioonid. Paranduste avaldamist distributsioonide poolt saab j\u00e4lgida j\u00e4rgmiste lehtede kaudu: Debian, RHEL, Fedora, SUSE, Ubuntu, Arch Linux, OpenBSD, FreeBSD, NetBSD. Zlib-ng raamatukogu ei ole sellele probleemile vastuv\u00f5tlik. <\/p>\n

Haavatavus ilmneb siis, kui sisestusteenuses kohtab suurt arvu pakendamisele alluvaid vasteid, millele rakendatakse fikseeritud Huffmani koodide p\u00f5hjal pakendamist. Teatud tingimustel v\u00f5ib vahebufferisse, kuhu t\u00f5mmatud tulemus paigutatakse, kattuda m\u00e4luga, kus hoitakse s\u00fcmbolite sagedustabelit. Selle tulemusena moodustuvad vale surutud andmed ja crash, kuna kirjutatakse m\u00e4lupiirist v\u00e4lja. <\/p>\n

Haavatavust saab \u00e4ra kasutada ainult siis, kui kasutada fikseeritud Huffmani koodide p\u00f5hjal surumistrateegiat. Selline strateegia valitakse koodis Z_FIXED valiku selge sissel\u00fclitamisega (n\u00e4ide j\u00e4rjekorrast, mis viib Z_FIXED valiku kasutamise korral crash'ini). Koodi kohaselt v\u00f5ib Z_FIXED strateegiat ka automaatselt valida, kui andmete jaoks arvutatud optimaalsed ja staatilised puud on sama suurusega. <\/p>\n

Praegu ei ole selge, kas haavatavuse ekspluateerimiseks saab kohaldada tingimusi, kui kasutatakse vaikimisi rakendatavat Z_DEFAULT_STRATEGY tihendamisstrateegiat. Kui ei, siis piirab haavatavus ainult teatud spetsiifilisi s\u00fcsteeme, kus valik Z_FIXED on selgelt rakendatud. Kui jah, siis v\u00f5ib haavatavuse kahju olla v\u00e4ga suur, kuna zlib teek on de facto standard ja seda kasutatakse paljudes populaarsetes projektides, sealhulgas Linuxi tuumas, OpenSSH, OpenSSL, Apache httpd, libpng, FFmpeg, rsync, dpkg, rpm, Git, PostgreSQL, MySQL jne.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 zlib \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2018-25032), \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u0431\u0443\u0444\u0435\u0440\u0430 \u043f\u0440\u0438 \u043f\u043e\u043f\u044b\u0442\u043a\u0435 \u0441\u0436\u0430\u0442\u0438\u044f \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432 \u0432\u043e \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0445 \u0434\u0430\u043d\u043d\u044b\u0445. \u0412 \u0442\u0435\u043a\u0443\u0449\u0435\u043c \u0432\u0438\u0434\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0432\u044b\u0437\u043e\u0432\u0430 \u0430\u0432\u0430\u0440\u0438\u0439\u043d\u043e\u0433\u043e \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430. \u041c\u043e\u0436\u0435\u0442 \u043b\u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0438\u043c\u0435\u0442\u044c \u0431\u043e\u043b\u0435\u0435 \u0441\u0435\u0440\u044c\u0451\u0437\u043d\u044b\u0435 \u043f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u0435\u0449\u0451 \u043d\u0435 \u0438\u0437\u0443\u0447\u0435\u043d\u043e. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u0435\u0440\u0441\u0438\u0438 zlib 1.2.2.2 \u0438 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0439 \u0432\u044b\u043f\u0443\u0441\u043a zlib […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-103636","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zlib haavatavus, mis ilmneb spetsiaalselt vormindatud andmete tihendamisel | ProHoster","description":"Zlib'i teeg on tuvastatud haavatavus (CVE-2018-25032), mis p\u00f5hjustab puhversalvuse \u00fcletamise, kui \u00fcritatakse tihendada spetsiaalselt v\u00e4ljat\u00f6\u00f6tatud s\u00fcmbolite j\u00e4rjestust sissetulevates andmetes.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-zlib-proyavlyayushhayasya-pri-szhatii-speczialno-oformlennyh-dannyh","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 zlib, \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u044e\u0449\u0430\u044f\u0441\u044f \u043f\u0440\u0438 \u0441\u0436\u0430\u0442\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 | ProHoster","og:description":"\u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 zlib \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2018-25032), \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u0431\u0443\u0444\u0435\u0440\u0430 \u043f\u0440\u0438 \u043f\u043e\u043f\u044b\u0442\u043a\u0435 \u0441\u0436\u0430\u0442\u0438\u044f \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432 \u0432\u043e \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0445 \u0434\u0430\u043d\u043d\u044b\u0445.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-zlib-proyavlyayushhayasya-pri-szhatii-speczialno-oformlennyh-dannyh","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-03-27T13:36:39+00:00","article:modified_time":"2022-03-27T13:36:39+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"103636","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-03-27 13:37:36","updated":"2022-10-04 08:36:37","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/103636","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=103636"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/103636\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=103636"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=103636"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=103636"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}