{"id":41415,"date":"2020-02-10T20:42:08","date_gmt":"2020-02-10T17:42:08","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/uyazvimost-v-android-pozvolyayushhaya-udalyonno-vypolnit-kod-pri-vklyuchyonnom-bluetooth"},"modified":"2020-02-10T20:42:08","modified_gmt":"2020-02-10T17:42:08","slug":"uyazvimost-v-android-pozvolyayushhaya-udalyonno-vypolnit-kod-pri-vklyuchyonnom-bluetooth","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/uyazvimost-v-android-pozvolyayushhaya-udalyonno-vypolnit-kod-pri-vklyuchyonnom-bluetooth","title":{"rendered":"Androidi haavatavus, mis v\u00f5imaldab kaugkoodi k\u00e4ivitamist Bluetoothi sisse l\u00fclitamisel","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Veebruaris uuenduses<\/a><\/noindex> Androidi platvormil on lahendatud kriitiline haavatavus<\/a><\/noindex> (CVE-2020-0022) Bluetoothi virna haavatavus, mis v\u00f5imaldab kauget koodit\u00e4itmist, saates spetsiaalselt koostatud Bluetooth-pakette. Probleemi v\u00f5ivad m\u00e4rkamatult \u00e4ra kasutada r\u00fcndajad, kes viibivad Bluetoothi levila piires. Haavatavust v\u00f5ib kasutada m\u00fcrgiste programmide loomiseks, mis levivad l\u00e4histe seadmete vahel. <\/p>\n

R\u00fcnnakuks on piisav teada ohvri seadme MAC-aadressi (eelnevat sidumist ei ole vajalik, kuid Bluetooth peab olema seadmes sisse l\u00fclitatud). M\u00f5nedes seadmetes v\u00f5ib Bluetoothi MAC-aadressi arvutada Wi-Fi MAC-aadressi alusel. Eduka haavatavuse \u00e4rakasutamise korral saab r\u00fcndaja k\u00e4ivitada oma koodi tausta protsessi \u00f5igustes, mis koordineerib Bluetoothi t\u00f6\u00f6d Androidis.
\nProbleem on spetsiifiline Androidi Bluetoothi virna Fluoride<\/a><\/noindex> (p\u00f5hineb Broadcomi BlueDroid projekti koodil) ja ei ilmne Linuxi BlueZ virnas.<\/p>\n

Probleemi tuvastanud teadlased suutsid valmistada toimiva eksploitatsiooni protot\u00fc\u00fcbi, kuid eksploitatsiooni \u00fcksikasjad avaldatakse<\/a><\/noindex> hiljem, p\u00e4rast seda, kui parandus on levitatud p\u00f5hikasutajatele. On teada, et haavatavus on olemas pakettide uuendamise koodis ja p\u00f5hjustatud<\/a><\/noindex> vale pakettide suuruse arvutamine L2CAP (Loogiline linkide juhtimise ja kohandamise protokoll) puhul, kui saatja edastatud andmed \u00fcletavad oodatud suuruse.<\/p>\n

Android 8 ja 9 puhul v\u00f5ib probleem viia koodi k\u00e4ivitamiseni, kuid Android 10 puhul piirab see Bluetoothi taustaprotsessi kokkukukkumist. Vanemad Androidi versioonid v\u00f5ivad samuti olla probleemile vastuv\u00f5tlikud, kuid haavatavuse \u00e4rakasutamise v\u00f5imalust ei ole testitud. Kasutajatele soovitatakse v\u00f5imalikult kiiresti tarkvarauuendus installida; kui see ei ole v\u00f5imalik, siis on soovitatav Bluetooth vaikepeatusesse panna, seadme avastamine keelata ning Bluetoothi avalikes kohtades aktsepteerida ainult \u00e4\u00e4rmise vajaduse korral (sealhulgas saab juhtmete kaudu \u00fchendatavaid k\u00f5rvaklappe kasutada). <\/p>\n

Lisaks mainitud probleemile on veebruari<\/a><\/noindex> Androidi turvaparanduskomplektis lahendatud 26 haavatavust, millest \u00fcks haavatavus (CVE-2020-0023) on saanud kriitilise ohutaseme. Teine haavatavus samuti puudutab<\/a><\/noindex> Bluetooth-i paan ja on seotud BTOOTH_PRIVILEGED privileegi vale t\u00f6\u00f6tlemisega setPhonebookAccessPermission-is. Mis puudutab ohtlike haavatavuste m\u00e4rgistusi, siis on 7 probleemi lahendatud raamistikus ja rakendustes, 4 s\u00fcsteemikomponentides, 2 tuumas ja 10 avatud ning patenteeritud komponentides Qualcommi kiipide jaoks.<\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0444\u0435\u0432\u0440\u0430\u043b\u044c\u0441\u043a\u043e\u043c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Android \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-0022) \u0432 Bluetooth-\u0441\u0442\u0435\u043a\u0435, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e Bluetooth-\u043f\u0430\u043a\u0435\u0442\u0430. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043d\u0435\u0437\u0430\u043c\u0435\u0442\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u043c, \u043d\u0430\u0445\u043e\u0434\u044f\u0449\u0438\u043c\u0441\u044f \u0432 \u043f\u0440\u0435\u0434\u0435\u043b\u0430\u0445 \u0434\u043e\u0441\u044f\u0433\u0430\u0435\u043c\u043e\u0441\u0442\u0438 Bluetooth. \u041d\u0435 \u0438\u0441\u043a\u043b\u044e\u0447\u0435\u043d\u043e \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0447\u0435\u0440\u0432\u0435\u0439, \u043f\u043e \u0446\u0435\u043f\u043e\u0447\u043a\u0435 \u043f\u043e\u0440\u0430\u0436\u0430\u044e\u0449\u0438\u0445 \u0441\u043e\u0441\u0435\u0434\u043d\u0438\u0435 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430. \u0414\u043b\u044f \u0430\u0442\u0430\u043a\u0438 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0437\u043d\u0430\u0442\u044c MAC-\u0430\u0434\u0440\u0435\u0441 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u0436\u0435\u0440\u0442\u0432\u044b (\u043f\u0440\u0435\u0434\u0432\u0430\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0441\u043e\u043f\u0440\u044f\u0436\u0435\u043d\u0438\u044f \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-41415","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Androidi haavatavus, mis v\u00f5imaldab Bluetooth'il sisse l\u00fclitamise ajal kaugkoodi t\u00e4itmist | ProHoster","description":"Veebruari v\u00e4rskenduses Androidi platvormil on k\u00f5rvaldatud kriitiline viga","canonical_url":"https:\/\/prohoster.info\/et\/blog\/uyazvimost-v-android-pozvolyayushhaya-udalyonno-vypolnit-kod-pri-vklyuchyonnom-bluetooth","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Android, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043f\u0440\u0438 \u0432\u043a\u043b\u044e\u0447\u0451\u043d\u043d\u043e\u043c Bluetooth | ProHoster","og:description":"\u0412 \u0444\u0435\u0432\u0440\u0430\u043b\u044c\u0441\u043a\u043e\u043c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Android \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f","og:url":"https:\/\/prohoster.info\/et\/blog\/uyazvimost-v-android-pozvolyayushhaya-udalyonno-vypolnit-kod-pri-vklyuchyonnom-bluetooth","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-10T17:42:08+00:00","article:modified_time":"2020-02-10T17:42:08+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"41415","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 13:26:29","updated":"2022-09-29 21:00:24","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/41415","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=41415"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/41415\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=41415"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=41415"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=41415"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}