{"id":103636,"date":"2022-03-27T15:36:39","date_gmt":"2022-03-27T13:36:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-zlib-proyavlyayushhayasya-pri-szhatii-speczialno-oformlennyh-dannyh"},"modified":"2022-03-27T15:36:39","modified_gmt":"2022-03-27T13:36:39","slug":"uyazvimost-v-zlib-proyavlyayushhayasya-pri-szhatii-speczialno-oformlennyh-dannyh","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-zlib-proyavlyayushhayasya-pri-szhatii-speczialno-oformlennyh-dannyh","title":{"rendered":"zlib'is tuvastatud haavatavus, mis ilmneb spetsiaalselt kujundatud andmete kokkusurutamisel","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Zlib teegis avastus (CVE-2018-25032), mis p\u00f5hjustab puhversalvese \u00fclevoolu, kui proovida suruda kokku spetsiaalselt ettevalmistatud s\u00fcmbolite j\u00e4rjestust sisendandmetes. Praeguses vormis on teadlased demonstreerinud, et probleem v\u00f5ib p\u00f5hjustada protsessi ootamatut l\u00f5petamist. Probleemi t\u00f5sidust pole veel uuritud. <\/p>\n

Avasuus on probleem, mis ilmneb alates zlib 1.2.2.2 versioonist ja m\u00f5jutab ka praegust versiooni zlib 1.2.11. Muidugi, et kiirus, mis probleemi lahendamiseks v\u00e4ljapakuti, anti v\u00e4lja juba 2018. aastal, kuid arendajad ei p\u00f6\u00f6ranud sellele t\u00e4helepanu ega avaldanud paranduste v\u00e4ljaannet (zlib teek oli viimati v\u00e4rskendatud 2017. aastal). Parandust pole siiani ka jaotustes pakutavatesse pakettidesse kaasatud. Paranduste avaldamise j\u00e4lgimiseks jaotustes, vaadake j\u00e4rgmisi lehti: Debian, RHEL, Fedora, SUSE, Ubuntu, Arch Linux, OpenBSD, FreeBSD, NetBSD. Teek zlib-ng pole haavatav. <\/p>\n

Avasuus ilmneb, kui sisendis on suur hulk sobivaid pakenduspunkte, millele rakendatakse fikseeritud Huffmani koodide p\u00f5hjal pakendamist. Teatud tingimustel v\u00f5ib vahepealse puhversalvese sisu, kuhu salvestatakse surutud tulemus, kattuda m\u00e4luga, mis s\u00e4ilitab s\u00fcmbolite sagedustabeli. Tulemuseks on valepressed andmete genereerimine ja avarii puhversalvese \u00fclevoolu t\u00f5ttu. <\/p>\n

Vastuv\u00f5tmine kannatab ainult fikseeritud Huffmani koodide p\u00f5hjal pakendamise strateegia rakendamisel. Selline strateegia valitakse, kui Z_FIXED valik on koodis selgelt sisse l\u00fclitatud (n\u00e4ide j\u00e4rjestusest, mis v\u00f5ib p\u00f5hjustada avariid, kui Z_FIXED valik on sisse l\u00fclitatud). Koodeks Z_FIXED strateegia v\u00f5ib automaatselt valida, kui andmetele arvutatud optimaalsed ja staatilised puud on sama suurusega. <\/p>\n

Ei ole selge, kas Z_DEFAULT_STRATEGY kokkusurumise strateegia abil, mida kasutatakse vaikimisi, on v\u00f5imalik ohutuse tagamiseks tingimusi leida. Kui ei, siis piirneb haavatavus eraldi spetsiifiliste s\u00fcsteemidega, kus Z_FIXED valik on selgelt rakendatud. Kui jah, siis haavatavuse eest saadav kahju v\u00f5ib olla v\u00e4ga m\u00e4rkimisv\u00e4\u00e4rne, kuna zlib teeki peetakse de facto standardiks ja seda kasutatakse paljudes populaarsetes projektides, sealhulgas Linuxi, OpenSSH, OpenSSL, Apache HTTPD, libpng, FFmpeg, rsync, dpkg, rpm, Git, PostgreSQL, MySQL jne.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 zlib \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2018-25032), \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u0431\u0443\u0444\u0435\u0440\u0430 \u043f\u0440\u0438 \u043f\u043e\u043f\u044b\u0442\u043a\u0435 \u0441\u0436\u0430\u0442\u0438\u044f \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432 \u0432\u043e \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0445 \u0434\u0430\u043d\u043d\u044b\u0445. \u0412 \u0442\u0435\u043a\u0443\u0449\u0435\u043c \u0432\u0438\u0434\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0432\u044b\u0437\u043e\u0432\u0430 \u0430\u0432\u0430\u0440\u0438\u0439\u043d\u043e\u0433\u043e \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430. \u041c\u043e\u0436\u0435\u0442 \u043b\u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0438\u043c\u0435\u0442\u044c \u0431\u043e\u043b\u0435\u0435 \u0441\u0435\u0440\u044c\u0451\u0437\u043d\u044b\u0435 \u043f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u0435\u0449\u0451 \u043d\u0435 \u0438\u0437\u0443\u0447\u0435\u043d\u043e. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u0435\u0440\u0441\u0438\u0438 zlib 1.2.2.2 \u0438 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0439 \u0432\u044b\u043f\u0443\u0441\u043a zlib […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-103636","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zlib haavatavus, mis ilmneb spetsiaalselt vormindatud andmete kokkusurumisel | ProHoster","description":"Zlib raamatukogus on tuvastatud haavatavus (CVE-2018-25032), mis p\u00f5hjustab puhver\u00fclevuse, kui p\u00fc\u00fctakse kompresseerida spetsiaalselt ettevalmistatud s\u00fcmbolite jada sisendandmetes.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-zlib-proyavlyayushhayasya-pri-szhatii-speczialno-oformlennyh-dannyh","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 zlib, \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u044e\u0449\u0430\u044f\u0441\u044f \u043f\u0440\u0438 \u0441\u0436\u0430\u0442\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 | ProHoster","og:description":"\u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 zlib \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2018-25032), \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u0431\u0443\u0444\u0435\u0440\u0430 \u043f\u0440\u0438 \u043f\u043e\u043f\u044b\u0442\u043a\u0435 \u0441\u0436\u0430\u0442\u0438\u044f \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432 \u0432\u043e \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0445 \u0434\u0430\u043d\u043d\u044b\u0445.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-zlib-proyavlyayushhayasya-pri-szhatii-speczialno-oformlennyh-dannyh","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-03-27T13:36:39+00:00","article:modified_time":"2022-03-27T13:36:39+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"103636","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-03-27 13:37:36","updated":"2022-10-04 08:36:37","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/103636","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=103636"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/103636\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=103636"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=103636"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=103636"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}