{"id":111112,"date":"2023-10-26T21:10:14","date_gmt":"2023-10-26T19:10:15","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/rezultaty-audita-tor-browser-i-komponentov-infrastruktury-tor"},"modified":"2023-10-26T21:10:14","modified_gmt":"2023-10-26T19:10:15","slug":"rezultaty-audita-tor-browser-i-komponentov-infrastruktury-tor","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/rezultaty-audita-tor-browser-i-komponentov-infrastruktury-tor","title":{"rendered":"Tor Brauseri ja Tor infrastruktuuri komponentide auditi tulemused","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Tor v\u00f5rgu arendajad avaldasid Tor Brauseri ja arendatavate t\u00f6\u00f6riistade OONI Probe, rdsys, BridgeDB ja Conjure auditi tulemused, mida kasutatakse tsensuuri \u00fcletamiseks. Audiiti viis l\u00e4bi Cure53 2022. aasta novembrist kuni 2023. aasta aprillini. <\/p>\n

Kontrolli k\u00e4igus leiti 9 haavatavust, millest kaks klassifitseeriti ohtlikuks, \u00fchele m\u00e4\u00e4rati keskmine oht, ning 6 seostati v\u00e4ikese ohu probleemidega. Koodibaasis leiti ka 10 probleemi, mis kuuluvad mitteohutuse kategooriasse. \u00dcldiselt on Tor projekti kood m\u00e4rgitud vastavaks ohutu programmeerimise praktikatele. <\/p>\n

Esimene ohtlik haavatavus esines jaotatud s\u00fcsteemi rdsys tagapinnas, mis v\u00f5imaldas tsenseeritavatele kasutajatele selliste ressursside, nagu proxy-nimekirjad ja allalaadimislingid, tarnimist. Haavatavus tekkis autentimise puudumise t\u00f5ttu resursside registreerimise k\u00e4sitlejaga suhtlemisel, v\u00f5imaldades r\u00fcndajal registreerida oma pahatahtliku ressursi kasutajatele edastamiseks. Selle \u00e4ra kasutamine piirdub HTTP-p\u00e4ringu saatmisega rdsys k\u00e4sitlejale.

\"Tor<\/center> <\/p>\n

Teine ohtlik haavatavus avastati Tor Brauseris, mis tekkis digitaalallkirja kontrollimise puudumise t\u00f5ttu rdsys ja BridgeDB kaudu sildade nimekirja saamisel. Kuna nimekiri laaditakse brauserisse enne \u00fchenduse loomist anon\u00fc\u00fcmse Tor-v\u00f5rguga, v\u00f5imaldas digitaalallkirja kontrollimise puudumine r\u00fcndajal nimekirja sisu \u00fcmber vahetada, n\u00e4iteks \u00fchenduse pealtkuulamise v\u00f5i h\u00e4kkimise teel, mille kaudu nimekiri levib. Eduka r\u00fcnnaku korral v\u00f5is kurjategija korraldada kasutajate \u00fchendamise oma kompromiteeritud sildade kaudu. serverile<\/a>, mille kaudu levib loend. Eduka r\u00fcnnaku korral v\u00f5iks r\u00fcndaja korraldada kasutajate \u00fchendamise l\u00e4bi enda kompromiteeritud sildmooduli. <\/p>\n

Keskmise ohtlikkusega haavatavus oli olemas rdsys'i alam-s\u00fcsteemis t\u00f5ste skriptis, mis v\u00f5imaldas r\u00fcndajal oma \u00f5igusi kasutada kasutajalt nobody kasutajale rdsys, kui tal oli juurdep\u00e4\u00e4s ja kirjutamis\u00f5igus ajutiste failide katalooge. serverile<\/a> Haavatavuse \u00e4rakasutamine seisneb katalooge \/tmp paigutatava t\u00e4ideviidava faili asendamises. Rdsys'i kasutaja \u00f5iguste saamine v\u00f5imaldab r\u00fcndajal muuta rdsys'i kaudu k\u00e4ivitatavaid t\u00e4ideviidavaid faile. <\/p>\n

Madalate ohtlikkuse tasemega haavatavused olid peamiselt seotud vananenud s\u00f5ltuvuste kasutamisega, milles olid tuntud haavatavused, v\u00f5i v\u00f5imalusega tekitada teenuse katkestamise. Tor Brauseri v\u00e4heoluliste haavatavuste hulka kuulub JavaScripti t\u00e4itmisest k\u00f5rvalehoidmine k\u00f5rge kaitsetaseme seadistamisel, failide \u00fcleslaadimise piirangute puudumine ja potentsiaalne teabe lekke v\u00f5imalus kasutaja kodulehe kaudu, mis v\u00f5imaldab kasutajate j\u00e4lgimist \u00fcle k\u00e4ivituste. <\/p>\n

Praegu on k\u00f5ik haavatavused k\u00f5rvaldatud, sealhulgas on rakendatud autentimine k\u00f5igis rdsys t\u00f6\u00f6tlejates ning lisatud allkirjade kontroll Tor Browserisse laaditavatele loenditele. <\/p>\n

Lisaks tasub mainida Tor Browseri 13.0.1 versiooni v\u00e4ljalaskmist. V\u00e4ljaanne on s\u00fcnkroonitud Firefox 115.4.0 ESR koodibaasiga, milles on k\u00f5rvaldatud 19 haavatavust (13 peetakse ohtlikeks). Tor Browser 13.0.1 versioon Androidile sisaldab parandusi Firefox 119 harust.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 Tor \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u0443\u0434\u0438\u0442\u0430 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430 Tor Browser \u0438 \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0435\u0432 OONI Probe, rdsys, BridgeDB \u0438 Conjure, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0445 \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u0446\u0435\u043d\u0437\u0443\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f. \u0410\u0443\u0434\u0438\u0442 \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u043b\u0441\u044f \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Cure53 \u0441 \u043d\u043e\u044f\u0431\u0440\u044f 2022 \u0433\u043e\u0434\u0430 \u043f\u043e \u0430\u043f\u0440\u0435\u043b\u044c 2023 \u0433\u043e\u0434\u0430. \u0412 \u0445\u043e\u0434\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0431\u044b\u043b\u0438 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b 9 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0434\u0432\u0435 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043e\u0442\u043d\u0435\u0441\u0435\u043d\u044b \u043a \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u0438 \u043e\u043f\u0430\u0441\u043d\u044b\u0445, \u043e\u0434\u043d\u043e\u0439 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u0441\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":111113,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-111112","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Tor Browseri ja Tor infrastruktuuri komponentide auditi tulemused | ProHoster","description":"Anon\u00fc\u00fcmse Tor v\u00f5rgu arendajad on avaldanud Tor Browseri auditi tulemused ning OONI Probe, rdsys, BridgeDB ja Conjure t\u00f6\u00f6riistade auditi tulemused, mida kasutatakse tsensuuri \u00fcletamiseks. Audit viidi l\u00e4bi Cure53 poolt novembrist 2022 aprillini 2023. Kontrollimise k\u00e4igus tuvastati 9 haavatavust, millest kaks loeti ohtlikuks, \u00fchel m\u00e4\u00e4rati keskmine oht.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/rezultaty-audita-tor-browser-i-komponentov-infrastruktury-tor","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u0443\u0434\u0438\u0442\u0430 Tor Browser \u0438 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b Tor | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 Tor \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u0443\u0434\u0438\u0442\u0430 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430 Tor Browser \u0438 \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0435\u0432 OONI Probe, rdsys, BridgeDB \u0438 Conjure, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0445 \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u0446\u0435\u043d\u0437\u0443\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f. \u0410\u0443\u0434\u0438\u0442 \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u043b\u0441\u044f \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Cure53 \u0441 \u043d\u043e\u044f\u0431\u0440\u044f 2022 \u0433\u043e\u0434\u0430 \u043f\u043e \u0430\u043f\u0440\u0435\u043b\u044c 2023 \u0433\u043e\u0434\u0430. \u0412 \u0445\u043e\u0434\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0431\u044b\u043b\u0438 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b 9 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0434\u0432\u0435 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043e\u0442\u043d\u0435\u0441\u0435\u043d\u044b \u043a \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u0438 \u043e\u043f\u0430\u0441\u043d\u044b\u0445, \u043e\u0434\u043d\u043e\u0439 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u0441\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438,","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/rezultaty-audita-tor-browser-i-komponentov-infrastruktury-tor","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-10-26T19:10:15+00:00","article:modified_time":"2023-10-26T19:10:15+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"111112","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-09 21:42:05","updated":"2026-02-22 15:31:12","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/111112","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=111112"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/111112\/revisions"}],"predecessor-version":[{"id":162425,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/111112\/revisions\/162425"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/111113"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=111112"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=111112"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=111112"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}