{"id":105350,"date":"2022-10-21T09:36:42","date_gmt":"2022-10-21T07:36:42","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-biblioteke-s-osnovnoj-realizacziej-algoritma-sha-3"},"modified":"2022-10-21T09:36:42","modified_gmt":"2022-10-21T07:36:42","slug":"uyazvimost-v-biblioteke-s-osnovnoj-realizacziej-algoritma-sha-3","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-biblioteke-s-osnovnoj-realizacziej-algoritma-sha-3","title":{"rendered":"Haavatavus SHA-3 algoritmi p\u00f5hiteost tegevas raamistikus","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

XKCP (eXtended Keccak Code Package) pakendis leiti SHA-3 (Keccak) kr\u00fcptograafilise hajutefunktsiooni rakenduses haavatavus (CVE-2022-37454), mis v\u00f5ib p\u00f5hjustada puhversalvimise \u00fclekoormust teatud kujundatud andmete t\u00f6\u00f6tlemise k\u00e4igus. Probleem tuleneb SHA-3 konkreetse rakenduse koodist, mitte algoritmi enda haavatavusest. XKCP pakett esitatakse kui ametlik SHA-3 rakendus, seda arendavad Keccak arendusmeeskonna liikmed ja seda kasutatakse SHA-3 funktsioonide aluseks erinevates programmeerimiskeeltes (n\u00e4iteks kasutatakse XKCP koodi Python moodulis hashlib, Ruby paketis digest-sha3 ja PHP funktsioonides hash_*). <\/p>\n

Uurija v\u00e4itel, kes probleemi avastas, \u00f5nnestus tal kasutada haavatavust, et rikkuda kr\u00fcptograafilisi omadusi ja leida esimest ja teist eellaset ning m\u00e4\u00e4rata kokku langevusi. Samuti on teatatud protot\u00fc\u00fcbi valmistamisest, mis v\u00f5imaldab saavutada koodi t\u00e4itmist, kui arvutatakse kokku pandud faili h\u00e4sher. Potentsiaalselt v\u00f5ib haavatavust kasutada ka r\u00fcnnakute jaoks digitaalsete allkirjade kontrollimise algoritmide vastu, mis kasutavad SHA-3 (n\u00e4iteks Ed448). R\u00fcnnakute l\u00e4biviimise meetodite \u00fcksikasju kavatsetakse hiljem avaldada, p\u00e4rast haavatavuse laialdast k\u00f5rvaldamist. <\/p>\n

\u041d\u0430\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u043d\u0430 \u043f\u0440\u0430\u043a\u0442\u0438\u043a\u0435 \u043f\u043e\u043a\u0430 \u043d\u0435 \u044f\u0441\u043d\u043e, \u0442\u0430\u043a \u043a\u0430\u043a \u0434\u043b\u044f \u043f\u0440\u043e\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0432 \u043a\u043e\u0434\u0435 \u0434\u043e\u043b\u0436\u043d\u043e \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0442\u044c\u0441\u044f \u0446\u0438\u043a\u043b\u0438\u0447\u043d\u043e\u0435 \u0432\u044b\u0447\u0438\u0441\u043b\u0435\u043d\u0438\u0435 \u0445\u044d\u0448\u0430 \u0431\u043b\u043e\u043a\u0430\u043c\u0438 \u0438 \u043e\u0434\u0438\u043d \u0438\u0437 \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u043c\u044b\u0445 \u0431\u043b\u043e\u043a\u043e\u0432 \u0434\u043e\u043b\u0436\u0435\u043d \u0438\u043c\u0435\u0442\u044c \u0440\u0430\u0437\u043c\u0435\u0440 \u043e\u043a\u043e\u043b\u043e 4 \u0413\u0411 (\u043d\u0435 \u043c\u0435\u043d\u0435\u0435 2^32 — 200 \u0431\u0430\u0439\u0442). \u041f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0432\u0445\u043e\u0434\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0440\u0430\u0437\u043e\u043c (\u0431\u0435\u0437 \u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0432\u044b\u0447\u0438\u0441\u043b\u0435\u043d\u0438\u044f \u0445\u044d\u0448\u0430 \u0447\u0430\u0441\u0442\u044f\u043c\u0438) \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043d\u0435 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f. \u0412 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u043f\u0440\u043e\u0441\u0442\u043e\u0433\u043e \u043c\u0435\u0442\u043e\u0434\u0430 \u0437\u0430\u0449\u0438\u0442\u044b \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u0442\u0441\u044f \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0442\u044c \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u0439 \u0440\u0430\u0437\u043c\u0435\u0440 \u0434\u0430\u043d\u043d\u044b\u0445, \u0443\u0447\u0430\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u0432 \u043e\u0434\u043d\u043e\u0439 \u0438\u0442\u0435\u0440\u0430\u0446\u0438\u0438 \u0432\u044b\u0447\u0438\u0441\u043b\u0435\u043d\u0438\u044f \u0445\u044d\u0448\u0430. <\/p>\n

\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043e\u0448\u0438\u0431\u043a\u043e\u0439 \u043f\u0440\u0438 \u0431\u043b\u043e\u0447\u043d\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0432\u0445\u043e\u0434\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445. \u0418\u0437-\u0437\u0430 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0433\u043e \u0441\u0440\u0430\u0432\u043d\u0435\u043d\u0438\u044f \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0439 \u0441 \u0442\u0438\u043f\u043e\u043c «int» \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0435\u0432\u0435\u0440\u043d\u044b\u0439 \u0440\u0430\u0437\u043c\u0435\u0440 \u043e\u0436\u0438\u0434\u0430\u044e\u0449\u0438\u0445 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0434\u0430\u043d\u043d\u044b\u0445, \u0447\u0442\u043e \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u0437\u0430\u043f\u0438\u0441\u0438 \u0445\u0432\u043e\u0441\u0442\u0430 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0431\u0443\u0444\u0435\u0440\u0430. \u0412 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, \u043f\u0440\u0438 \u0441\u0440\u0430\u0432\u043d\u0435\u043d\u0438\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u043e\u0441\u044c \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u0435 «partialBlock + instance->byteIOIndex», \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u043f\u0440\u0438 \u0431\u043e\u043b\u044c\u0448\u0438\u0445 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f\u0445 \u0441\u043e\u0441\u0442\u0430\u0432\u043d\u044b\u0445 \u0447\u0430\u0441\u0442\u0435\u0439 \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u043b\u043e \u043a \u0446\u0435\u043b\u043e\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e. \u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u0432 \u043a\u043e\u0434\u0435 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u043e\u0432\u0430\u043b\u043e \u043d\u0435\u0432\u0435\u0440\u043d\u043e\u0435 \u043f\u0440\u0438\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0442\u0438\u043f\u043e\u0432 «(unsigned int)(dataByteLen — i)», \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0432\u0448\u0435\u0435 \u043a \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0441 64-\u0440\u0430\u0437\u0440\u044f\u0434\u043d\u044b\u043c \u0442\u0438\u043f\u043e\u043c size_t. <\/p>\n

\u041f\u0440\u0438\u043c\u0435\u0440 \u043a\u043e\u0434\u0430, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0435\u0433\u043e \u043a \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e: import hashlib h = hashlib.sha3_224() m1 = b»\x00″ * 1; m2 = b»\x00″ * 4294967295; h.update(m1) h.update(m2) print(h.hexdigest())
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0445\u044d\u0448-\u0444\u0443\u043d\u043a\u0446\u0438\u0438 SHA-3 (Keccak), \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u043c\u043e\u0439 \u0432 \u043f\u0430\u043a\u0435\u0442\u0435 XKCP (eXtended Keccak Code Package), \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-37454), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043e\u0448\u0438\u0431\u043a\u043e\u0439 \u0432 \u043a\u043e\u0434\u0435 \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 SHA-3, \u0430 \u043d\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e \u0432 \u0441\u0430\u043c\u043e\u043c \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c\u0435. \u041f\u0430\u043a\u0435\u0442 XKCP \u043f\u0440\u0435\u043f\u043e\u0434\u043d\u043e\u0441\u0438\u0442\u0441\u044f \u043a\u0430\u043a \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u0430\u044f \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f SHA-3, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043f\u0440\u0438 \u0443\u0447\u0430\u0441\u0442\u0438\u0438 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-105350","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47SHA-3 algoritmi p\u00f5hiraamatukogu haavatavus | ProHoster","description":"SHA-3 (Keccak) kr\u00fcptograafilise r\u00e4si funktsiooni teostamises, mis on ette n\u00e4htud XKCP (eXtended Keccak Code Package) paketis, avastati haavatavus (CVE-2022-37454), mis v\u00f5ib p\u00f5hjustada puhvrisse \u00fclevoolu protsessi k\u00e4igus.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-biblioteke-s-osnovnoj-realizacziej-algoritma-sha-3","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 \u0441 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c\u0430 SHA-3 | ProHoster","og:description":"\u0412 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0445\u044d\u0448-\u0444\u0443\u043d\u043a\u0446\u0438\u0438 SHA-3 (Keccak), \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u043c\u043e\u0439 \u0432 \u043f\u0430\u043a\u0435\u0442\u0435 XKCP (eXtended Keccak Code Package), \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-37454), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-biblioteke-s-osnovnoj-realizacziej-algoritma-sha-3","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-10-21T07:36:42+00:00","article:modified_time":"2022-10-21T07:36:42+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/105350","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=105350"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/105350\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=105350"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=105350"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=105350"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}