{"id":111112,"date":"2023-10-26T21:10:14","date_gmt":"2023-10-26T19:10:15","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/rezultaty-audita-tor-browser-i-komponentov-infrastruktury-tor"},"modified":"2023-10-26T21:10:14","modified_gmt":"2023-10-26T19:10:15","slug":"rezultaty-audita-tor-browser-i-komponentov-infrastruktury-tor","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/rezultaty-audita-tor-browser-i-komponentov-infrastruktury-tor","title":{"rendered":"Tor Browser\u2019i ja Tor infrastruktuuri komponentide auditi tulemused","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Tor-anon\u00fc\u00fcsiv\u00f5rgu arendajad avaldasid Tor Browseri ja projekti OONI Probe, rdsys, BridgeDB ja Conjure t\u00f6\u00f6riistade auditi tulemused, mida kasutatakse tsensorite \u00fcletamiseks. Audiiti viis l\u00e4bi Cure53 ettev\u00f5te alates novembrist 2022 kuni aprillini 2023. <\/p>\n

Kontrolli k\u00e4igus avastati 9 haavatavust, millest kaks klassifitseeriti ohtlikeks, \u00fchele anti keskmine ohtlikkuse tase ja 6 klassifitseeriti madala ohtlikkuse probleemideks. Samuti leiti koodibaasist 10 probleemi, mis kuuluvad mitteohutusalaste puuduste kategooriasse. \u00dcldiselt on Tor projekti kood hinnatud vastavaks turvalise programmeerimise praktikatele. <\/p>\n

Esimene ohtlik haavatavus esines jaotatud s\u00fcsteemi rdsys tagaplaanis, mis tagab tsensuuri all kannatavatele kasutajatele selliste ressursside nagu proxy-nimekirjad ja allalaadimislingid toimetamise. Haavatavus tulenes autentimise puudumisest ressursside registreerimise t\u00f6\u00f6tlusse ja v\u00f5imaldas r\u00fcndajal registreerida oma pahatahtliku ressursi kasutajatele toimetamiseks. Haavatavuse \u00e4rakasutamine seisneb HTTP-p\u00e4ringu saatmises rdsys-i t\u00f6\u00f6tlusse.

\"Tor<\/center> <\/p>\n

Teine ohtlik haavatavus leiti Tor Browseris ja oli p\u00f5hjustatud digitaalallkirja kontrollimise puudumisest rdsys-i ja BridgeDB kaudu sildade nimekirja hankimisel. Kuna nimekiri laetakse brauserisse enne Tor anon\u00fc\u00fcsiv\u00f5rguga \u00fchenduse loomist, v\u00f5imaldas kr\u00fcptograafilise digitaalallkirja kontrollimise puudumine r\u00fcndajal nimekirja sisu valev\u00e4iteid, n\u00e4iteks \u00fchenduse kuulamise v\u00f5i r\u00fcnde kaudu, mille kaudu nimekiri levib. Eduka r\u00fcnnaku korral sai r\u00fcndaja korraldada kasutajate \u00fchendamine l\u00e4bi enda kompromiteeritud sildade s\u00f5lme. serverilt<\/a>, mille kaudu levitatakse nimekirja. Eduka r\u00fcnnaku korral sai r\u00fcndaja korraldada kasutajate \u00fchendamise l\u00e4bi enda kompromiteeritud sildade s\u00f5lme. <\/p>\n

Keskmise ohtlikkuse haavatavus esines rdsys-i alams\u00fcsteemis kogumite juurutamise skriptis ja v\u00f5imaldas r\u00fcndajal oma \u00f5igusi kasutajast nobody t\u00f5sta rdsys-i kasutajaks, tingimusel, et tal on juurdep\u00e4\u00e4s serveri<\/a> ja kirjutamisv\u00f5ime ajutiste failide katalooge. Haavatavuse \u00e4rakasutamine seisneb katalooge \/tmp paigaldatava t\u00e4itmise faili asendamises. Rdsys-i kasutaja \u00f5iguste omamine annab r\u00fcndajale v\u00f5imaluse muuta rdsys-i kaudu k\u00e4ivitatavaid t\u00e4itmisfaile. <\/p>\n

Madala astme ohtlikkuse haavatavused olid peamiselt seotud vananenud s\u00f5ltuvuste kasutamisega, milles esinesid tuntud haavatavused, v\u00f5i v\u00f5imalusega tekitada teenuse keelamine. Tor Brauseri v\u00e4ikeste haavatavuste seas on m\u00e4rgitud JavaScripti t\u00e4itmise keelu ringi viimise v\u00f5imalus k\u00f5rgeima kaitseastme seadistamisel, failide laadimise piirangute puudumine ja potentsiaalne teabe leke kasutaja isikliku tugilehe kaudu, mis v\u00f5imaldab j\u00e4lgida kasutajaid taask\u00e4ivituste vahel. <\/p>\n

Praegu on k\u00f5ik haavatavused k\u00f5rvaldatud, muu hulgas on rakendatud autentimine k\u00f5igi rdsys t\u00f6\u00f6tlejate jaoks ja lisatud Tor Brauserisse allalaaditavate loendite digitaalallkiri kontroll. <\/p>\n

Lisaks tasub m\u00e4rkida Tor Brauseri versiooni 13.0.1 v\u00e4ljaandmist. V\u00e4ljaanne on s\u00fcmfoonsed Firefoxi versiooniga 115.4.0 ESR, milles on k\u00f5rvaldatud 19 haavatavust (13 tunnustatud ohtlikeks). Tor Brauseri 13.0.1 versioonile Androidile on kantud haavatavuste parandused Firefoxi 119 harust.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 Tor \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u0443\u0434\u0438\u0442\u0430 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430 Tor Browser \u0438 \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0435\u0432 OONI Probe, rdsys, BridgeDB \u0438 Conjure, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0445 \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u0446\u0435\u043d\u0437\u0443\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f. \u0410\u0443\u0434\u0438\u0442 \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u043b\u0441\u044f \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Cure53 \u0441 \u043d\u043e\u044f\u0431\u0440\u044f 2022 \u0433\u043e\u0434\u0430 \u043f\u043e \u0430\u043f\u0440\u0435\u043b\u044c 2023 \u0433\u043e\u0434\u0430. \u0412 \u0445\u043e\u0434\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0431\u044b\u043b\u0438 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b 9 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0434\u0432\u0435 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043e\u0442\u043d\u0435\u0441\u0435\u043d\u044b \u043a \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u0438 \u043e\u043f\u0430\u0441\u043d\u044b\u0445, \u043e\u0434\u043d\u043e\u0439 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u0441\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":111113,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-111112","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Tor Brauseri ja Tor infrastruktuuri komponentide auditite tulemused | ProHoster","description":"Tor'i anon\u00fc\u00fcmsuse v\u00f5rgu arendajad avaldasid Tor Brauseri ja arendatavate projektide OONI Probe, rdsys, BridgeDB ja Conjure auditite tulemused, mida kasutatakse tsensuuri \u00fcletamiseks.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/rezultaty-audita-tor-browser-i-komponentov-infrastruktury-tor","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u0443\u0434\u0438\u0442\u0430 Tor Browser \u0438 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b Tor | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 Tor \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u0443\u0434\u0438\u0442\u0430 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430 Tor Browser \u0438 \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0435\u0432 OONI Probe, rdsys, BridgeDB \u0438 Conjure, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0445 \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u0446\u0435\u043d\u0437\u0443\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/rezultaty-audita-tor-browser-i-komponentov-infrastruktury-tor","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-10-26T19:10:15+00:00","article:modified_time":"2023-10-26T19:10:15+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"111112","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-09 21:42:05","updated":"2026-02-22 15:31:12","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/111112","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=111112"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/111112\/revisions"}],"predecessor-version":[{"id":162425,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/111112\/revisions\/162425"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/111113"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=111112"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=111112"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=111112"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}