{"id":41415,"date":"2020-02-10T20:42:08","date_gmt":"2020-02-10T17:42:08","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/uyazvimost-v-android-pozvolyayushhaya-udalyonno-vypolnit-kod-pri-vklyuchyonnom-bluetooth"},"modified":"2020-02-10T20:42:08","modified_gmt":"2020-02-10T17:42:08","slug":"uyazvimost-v-android-pozvolyayushhaya-udalyonno-vypolnit-kod-pri-vklyuchyonnom-bluetooth","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/uyazvimost-v-android-pozvolyayushhaya-udalyonno-vypolnit-kod-pri-vklyuchyonnom-bluetooth","title":{"rendered":"Androidi haavatavus, mis v\u00f5imaldab Bluetoothi sissel\u00fclitamisel koodi kaugtegevust","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Veebruarite v\u00e4rskenduses<\/a><\/noindex> Androidi platvormil on k\u00f5rvaldatud kriitiline haavatavus<\/a><\/noindex> (CVE-2020-0022) Bluetoothi kujunduses, mis v\u00f5imaldab kaugt\u00e4ideviimist, saates spetsiaalselt vormindatud Bluetooth-pakette. Probleemi saab m\u00e4rkamatult \u00e4ra kasutada r\u00fcndaja, kes on Bluetoothi ulatuses. Ei ole v\u00e4listatud, et haavatavust kasutatakse usside loomiseks, mis nakatavad naaberseadmeid. <\/p>\n

R\u00fcnnakuks on piisav, et teada seadme ohvri MAC-aadressi (eelnevat paaritamist ei n\u00f5uta, kuid Bluetooth peab seadmes olema sisse l\u00fclitatud). M\u00f5nedes seadmetes v\u00f5ib Bluetoothi MAC-aadressi arvutada Wi-Fi MAC-aadressi p\u00f5hjal. Kui haavatavust \u00f5nnestub \u00e4ra kasutada, saab r\u00fcndaja k\u00e4ivitada oma koodi taustaprotsessi \u00f5igustes, mis koordineerib Bluetoothi t\u00f6\u00f6 tegemist Androidis.
\nProbleem on spetsiifiline Androidis kasutatavale Bluetoothi kujundusele Fluoride<\/a><\/noindex> (p\u00f5hineb Broadcomi BlueDroid projekti koodil) ja ei esine Linuxi BlueZ kujunduses.<\/p>\n

Probleemi avastanud teadlased suudsid koostada t\u00f6\u00f6tava eksploidimisseadme protot\u00fc\u00fcbi, kuid v\u00e4ljat\u00f6\u00f6tamise \u00fcksikasjad avalikustatakse hiljem, p\u00e4rast seda, kui parandus on j\u00f5udnud suure hulga kasutajateni. On teada, et haavatavus on olemas pakettide rekonstrueerimise koodis ja<\/a><\/noindex> vale L2CAP (Loogiline linkkontroll ja adapteerimisprotokoll) paketisuuruse arvutamisel, kui saatja edastatud andmed \u00fcletavad oodatud suuruse. on p\u00f5hjustatud<\/a><\/noindex> Android 8 ja 9 puhul v\u00f5ib probleem p\u00f5hjustada koodi t\u00e4ideviimist, kuid Android 10 puhul piirdub see Bluetoothi taustaprotsessi kokkuvarisemisega. Vanemad Androidi versioonid v\u00f5ivad probleemile olla potentsiaalselt altiiv, kuid haavatavuse testitud on kontrollitud. Kasutajatele soovitatakse paigaldada tarkvarauuendus v\u00f5imalikult kiiresti, ja kui see ei ole v\u00f5imalik \u2014 tuleks vaikimisi Bluetooth v\u00e4lja l\u00fclitada, seadmest leiduvat avastamist keelata ja l\u00fclitada Bluetooth sisse avalikes kohtades ainult \u00e4\u00e4rmisel vajadusel (sealhulgas v\u00f5ib juhtmevabad k\u00f5rvaklapid asendada juhtmega).<\/p>\n

Android 8 ja 9-s v\u00f5ib probleem viia koodi t\u00e4itmiseni, kuid Android 10-s piirdub see Bluetoothi taustaprotsessi k\u00f5rvaldamisega. Vanemad Androidi versioonid on potentsiaalselt haavatavad, kuid haavatavuse \u00e4rakasutamise v\u00f5imalust ei ole testitud. Kasutajatel on soovitatav v\u00f5imalikult kiiresti installida p\u00fcsivara uuendus, ja kui see ei ole v\u00f5imalik, siis vaikimisi Bluetooth v\u00e4lja l\u00fclitada, seadme leidmine keelata ning Bluetoothi avalikes kohtades aktiveerida ainult \u00e4\u00e4rmuslikel juhtudel (sh v\u00f5ib juhtmevabad k\u00f5rvaklapid asendada juhtmega). <\/p>\n

m\u00f5jutatud. veebruari<\/a><\/noindex> turvaparanduste komplektis Androidi jaoks on parandatud 26 haavatavust, millest \u00fche haavatavuse (CVE-2020-0023) ohtlikkuse tase on m\u00e4\u00e4ratud kriitiliseks. Teisele haavatavusele on samuti puudutab<\/a><\/noindex> Bluetooth-stek ja on seotud BLUETOOTH_PRIVILEGED privileegide eba\u00f5ige t\u00f6\u00f6tlemisega setPhonebookAccessPermission funktsioonis. Mis puutub haavatavustesse, mis on m\u00e4rgitud ohtlikeks, siis 7 probleemi on lahendatud raamistikus ja rakendustes, 4 s\u00fcsteemikomponentides, 2 tuumas ja 10 avatud ning patenteeritud komponentides Qualcommi kiipidele.<\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0444\u0435\u0432\u0440\u0430\u043b\u044c\u0441\u043a\u043e\u043c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Android \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-0022) \u0432 Bluetooth-\u0441\u0442\u0435\u043a\u0435, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e Bluetooth-\u043f\u0430\u043a\u0435\u0442\u0430. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043d\u0435\u0437\u0430\u043c\u0435\u0442\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u043c, \u043d\u0430\u0445\u043e\u0434\u044f\u0449\u0438\u043c\u0441\u044f \u0432 \u043f\u0440\u0435\u0434\u0435\u043b\u0430\u0445 \u0434\u043e\u0441\u044f\u0433\u0430\u0435\u043c\u043e\u0441\u0442\u0438 Bluetooth. \u041d\u0435 \u0438\u0441\u043a\u043b\u044e\u0447\u0435\u043d\u043e \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0447\u0435\u0440\u0432\u0435\u0439, \u043f\u043e \u0446\u0435\u043f\u043e\u0447\u043a\u0435 \u043f\u043e\u0440\u0430\u0436\u0430\u044e\u0449\u0438\u0445 \u0441\u043e\u0441\u0435\u0434\u043d\u0438\u0435 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430. \u0414\u043b\u044f \u0430\u0442\u0430\u043a\u0438 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0437\u043d\u0430\u0442\u044c MAC-\u0430\u0434\u0440\u0435\u0441 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u0436\u0435\u0440\u0442\u0432\u044b (\u043f\u0440\u0435\u0434\u0432\u0430\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0441\u043e\u043f\u0440\u044f\u0436\u0435\u043d\u0438\u044f \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-41415","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Androidi haavatavus, mis v\u00f5imaldab koodi kaugk\u00e4ivitust Bluetoothi sissel\u00fclitamise korral | ProHoster","description":"Februari Androidi platvormi uuenduses on k\u00f5rvaldatud kriitiline","canonical_url":"https:\/\/prohoster.info\/et\/blog\/uyazvimost-v-android-pozvolyayushhaya-udalyonno-vypolnit-kod-pri-vklyuchyonnom-bluetooth","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Android, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043f\u0440\u0438 \u0432\u043a\u043b\u044e\u0447\u0451\u043d\u043d\u043e\u043c Bluetooth | ProHoster","og:description":"\u0412 \u0444\u0435\u0432\u0440\u0430\u043b\u044c\u0441\u043a\u043e\u043c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Android \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f","og:url":"https:\/\/prohoster.info\/et\/blog\/uyazvimost-v-android-pozvolyayushhaya-udalyonno-vypolnit-kod-pri-vklyuchyonnom-bluetooth","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-10T17:42:08+00:00","article:modified_time":"2020-02-10T17:42:08+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"41415","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 13:26:29","updated":"2022-09-29 21:00:24","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/41415","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=41415"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/41415\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=41415"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=41415"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=41415"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}