{"id":36775,"date":"2019-10-31T22:13:44","date_gmt":"2019-10-31T19:13:44","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimost-v-libreoffice-pozvolyayushhaya-vypolnit-kod-pri-otkrytii-vredonosnyh-dokumentov\/"},"modified":"2019-10-31T22:13:44","modified_gmt":"2019-10-31T19:13:44","slug":"uyazvimost-v-libreoffice-pozvolyayushhaya-vypolnit-kod-pri-otkrytii-vredonosnyh-dokumentov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-libreoffice-pozvolyayushhaya-vypolnit-kod-pri-otkrytii-vredonosnyh-dokumentov","title":{"rendered":"LibreOffice'is leitud haavatavus, mis v\u00f5imaldab koodi k\u00e4ivitada pahatahtlike dokumentide avamisel","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

LibreOffice'i kontoripakett tuvastatud<\/a><\/noindex> haavatavus (CVE-2019-9848<\/a><\/noindex>), mida saab kasutada pahatahtlike isikute poolt valmistatud dokumentide avamisel kahjustava koodi k\u00e4ivitamiseks. <\/p>\n

Haavatavus tuleneb sellest, et LibreLogo komponent, mis on m\u00f5eldud programmeerimise \u00f5ppimiseks ja vektorjooniste lisamiseks, t\u00f5lgendab oma toimingud Python-koodiks. Kui r\u00fcndajal on v\u00f5imalus t\u00e4ita LibreLogo juhiseid, v\u00f5ib ta saavutada mis tahes Python-koodi t\u00e4itmise praeguse kasutaja seansi kontekstis, kasutades LibreLogo k\u00e4sku 'run'. Pythonist saab seej\u00e4rel kasutada 'system()' funktsiooni, et kutsuda esile meelevaldseid s\u00fcsteemik\u00e4ske.<\/p>\n

LibreLogo on valikuline komponent, kuid LibreOffice'is on vaikimisi saadaval makrod, mis v\u00f5imaldavad LibreLogo k\u00e4ivitada ning ei vaja oma toimimise kinnitust ega kuvata hoiatust, isegi kui makrode maksimaalse kaitse re\u017eiim on sisse l\u00fclitatud (valides 'Very High' taseme).
\nR\u00fcnnaku korral saab sellise makro siduda s\u00fcndmuse k\u00e4itaja juurde, mis aktiveeritakse n\u00e4iteks siis, kui hiire kursori liigutamisel j\u00f5utakse kindlasse piirkonda v\u00f5i kui dokumendi sisestusfookus aktiveeritakse (s\u00fcndmus on onFocus). Seega, kui avatakse pahatahtlikult valmistatud dokument, v\u00f5ib juhtuda, et Python'i kood k\u00e4ivitatakse varjatult kasutajast m\u00e4rkamatult. N\u00e4iteks demonstreeritud \u00e4rakasutuse n\u00e4ites k\u00e4ivitatakse s\u00fcsteemi kalkulaator dokumendi avamisel ilma hoiatuseta.
\n

\"LibreOffice'is<\/center><\/p>\n

V\u00e4henemine lahendati vaikimisi LibreOffice 6.2.5 uuenduses, mis ilmus 1. juulil, kuid selgus, et probleem ei olnud t\u00e4ielikult lahendatud (ainult LibreLogo makrode kutsumine oli blokeeritud) ja m\u00f5ned teised r\u00fcnnaku vektorid j\u00e4\u00e4vad parandamata.<\/a><\/noindex> \u00dckski probleem ei ole lahendatud ka 6.1.6 versioonis, mida soovitatakse \u00e4rikasutajatele. T\u00e4ieliku haavatavuse k\u00f5rvaldamine on plaanis LibreOffice 6.3 versioonis, mis peaks ilmuma j\u00e4rgmisel n\u00e4dalal. Enne p\u00f5hjaliku uuenduse v\u00e4ljalaskmist soovitatakse kasutajatel selgelt keelata LibreLogo komponent, mis on vaikimisi paljudes komplektides saadaval. Osaliselt on haavatavust lahendatud Debian<\/a><\/noindex>, Fedora<\/a><\/noindex>, SUSE\/openSUSE<\/a><\/noindex> ja Ubuntu<\/a><\/noindex>.<\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043e\u0444\u0438\u0441\u043d\u043e\u043c \u043f\u0430\u043a\u0435\u0442\u0435 LibreOffice \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2019-9848), \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u043e\u0432, \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u043c. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u0442\u0435\u043c, \u0447\u0442\u043e \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442 LibreLogo, \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u044b\u0439 \u0434\u043b\u044f \u043e\u0431\u0443\u0447\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044e \u0438 \u0432\u0441\u0442\u0430\u0432\u043a\u0438 \u0432\u0435\u043a\u0442\u043e\u0440\u043d\u044b\u0445 \u0440\u0438\u0441\u0443\u043d\u043a\u043e\u0432, \u0442\u0440\u0430\u043d\u0441\u043b\u0438\u0440\u0443\u0435\u0442 \u0441\u0432\u043e\u0438 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u0432 \u043a\u043e\u0434 \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 Python. \u0418\u043c\u0435\u044f \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0438 LibreLogo \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043b\u044e\u0431\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 Python […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":27546,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-36775","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47V\u00e4henemine LibreOffice'is, mis v\u00f5imaldab koodide k\u00e4ivitamist pahatahtlike dokumentide avamisel | ProHoster","description":"LibreOffice'i kontoripaketis tuvastati haavatavus.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-libreoffice-pozvolyayushhaya-vypolnit-kod-pri-otkrytii-vredonosnyh-dokumentov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 LibreOffice, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u043e\u0432 | ProHoster","og:description":"\u0412 \u043e\u0444\u0438\u0441\u043d\u043e\u043c \u043f\u0430\u043a\u0435\u0442\u0435 LibreOffice \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-libreoffice-pozvolyayushhaya-vypolnit-kod-pri-otkrytii-vredonosnyh-dokumentov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:13:44+00:00","article:modified_time":"2019-10-31T19:13:44+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"36775","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 04:48:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:39:22","updated":"2026-01-22 04:48:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/36775","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=36775"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/36775\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/27546"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=36775"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=36775"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=36775"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}