{"id":54354,"date":"2019-12-24T00:00:00","date_gmt":"2019-12-23T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/uyazvimost-v-sqlite-pozvolyayushhaya-udalyonno-atakovat-chrome-cherez-websql"},"modified":"2020-02-18T14:02:21","modified_gmt":"2020-02-18T11:02:21","slug":"uyazvimost-v-sqlite-pozvolyayushhaya-udalyonno-atakovat-chrome-cherez-websql","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-sqlite-pozvolyayushhaya-udalyonno-atakovat-chrome-cherez-websql","title":{"rendered":"SQLite'i haavatavus, mis v\u00f5imaldab Chrome'i kaugseks r\u00fcndamiseks l\u00e4bi WebSQL","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Kaitseuurijad Hiina ettev\u00f5ttest Tencent tutvustanud<\/a><\/noindex> uus versioon haavatavusest Magellan<\/a><\/noindex> (CVE-2019-13734<\/a><\/noindex>), mis v\u00f5imaldab koodi t\u00e4itmist, kui eraldi vormindatud SQL-konstruktsioone t\u00f6\u00f6deldakse SQLite andmebaasihalduris. Sarnane haavatavus ilmus on avaldatud<\/a><\/noindex> sama uurijate poolt aastaga tagasi. Haavatavus on m\u00e4rkimisv\u00e4\u00e4rne, kuna see v\u00f5imaldab kaugl\u00f6\u00f6kide tegemist Chrome brauserile ja seadme t\u00e4ielikku \u00fclev\u00f5tmist pahatahtliku veebilehe avamise kaudu. <\/p>\n

Chrome'i\/Chromium'i r\u00fcnnak toimub l\u00e4bi WebSQL API, mille t\u00f6\u00f6tleja p\u00f5hineb SQLite koodil. Muudes rakendustes on r\u00fcnnak v\u00f5imalik vaid juhul, kui need v\u00f5imaldavad SQL-konstruktsioonide edastamist SQLite'sse v\u00e4ljastpoolt, n\u00e4iteks kasutades SQLite't andmevahetuse formaadina. Firefox ei ole haavatav, kuna Mozilla keeldusid<\/a><\/noindex> ei ole rakendanud WebSQL eelisteks<\/a><\/noindex> IndexedDB API-le. <\/p>\n

Google lahendas probleemi v\u00e4ljaandes Chrome 79<\/a><\/noindex>. SQLite koodip\u00f5hjas oli probleem parandatud<\/a><\/noindex> 17. november, ja Chromiumi koodibaasis — 21. novembril.<\/a><\/noindex>.
\nProbleem esineb koodis<\/a><\/noindex> FTS3 t\u00e4istekstiotsingu mootoris ja varjatud tabelitega (shadow tables), mis on eriline sort virtuaaltabelitest, millel on kirjutamisv\u00f5ime, v\u00f5ib p\u00f5hjustada indeksi kahjustamist ja puhver\u00fclevoolu. Tehnikate \u00fcksikasjad avaldatakse 90 p\u00e4eva jooksul.<\/p>\n

Uut SQLite v\u00e4ljaannet koos parandusega ei ole veel formeeritud<\/a><\/noindex> (oodatav<\/a><\/noindex> 31. detsembril). Kaitseks v\u00f5ib alates SQLite 3.26.0-st kasutada re\u017eiimi SQLITE_DBCONFIG_DEFENSIVE, mis t\u00f5kestab kirjutamise varjatud tabelitesse ja on soovitatav lubada v\u00e4liste SQL-p\u00e4ringute t\u00f6\u00f6tlemisel SQLite's. Haavatavus SQLite teeki jagamistes j\u00e4\u00e4b endiselt lahendamata Debian<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, RHEL<\/a><\/noindex>, openSUSE\/SUSE<\/a><\/noindex>, Arch Linuxis<\/a><\/noindex>, Fedora<\/a><\/noindex>, FreeBSD<\/a><\/noindex>. Chromium on k\u00f5ikides jagamistes juba uuendatud ja ei ole haavatav, kuid probleem v\u00f5ib ulatuda erinevatesse kolmandate osapoolte brauseritesse ja rakendustesse, mis kasutavad Chromiumi mootorit, samuti Android-rakendustesse, mis p\u00f5hinevad Webview-l.<\/p>\n

Lisaks on SQLite-s tuvastatud veel 4 v\u00e4hem ohtlikku probleemi (CVE-2019-13750<\/a><\/noindex>, CVE-2019-13751<\/a><\/noindex>, CVE-2019-13752<\/a><\/noindex>, CVE-2019-13753<\/a><\/noindex>), mis v\u00f5ivad p\u00f5hjustada teabe leket ja piirangutest m\u00f6\u00f6dumist (vaid kasutada kaasnevate teguritena Chrome'i r\u00fcnnakuks). Need probleemid on lahendatud SQLite koodis 13. detsembril. Kokkuv\u00f5ttes andsid probleemid uurijatele v\u00f5imaluse koostada t\u00f6\u00f6tav eksploit, mis v\u00f5imaldab koodi t\u00e4itmist Chromiumi protsessi kontekstis, mis vastutab renderdamise eest.<\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Tencent \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 Magellan (CVE-2019-13734), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0432 \u0421\u0423\u0411\u0414 SQLite \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 SQL-\u043a\u043e\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0439. \u041f\u043e\u0445\u043e\u0436\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0431\u044b\u043b\u0430 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430 \u0442\u0435\u043c\u0438 \u0436\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 \u0433\u043e\u0434 \u043d\u0430\u0437\u0430\u0434. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u0430 \u0442\u0435\u043c, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u0442\u044c \u0431\u0440\u0430\u0443\u0437\u0435\u0440 Chrome \u0438 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u043d\u0430\u0434 \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u043f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438 \u043f\u043e\u0434\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u043d\u044b\u0445 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 web-\u0441\u0442\u0440\u0430\u043d\u0438\u0446. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-54354","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47SQLite haavatavus, mis v\u00f5imaldab kaugl\u00f6\u00f6kide tegemist Chrome'is l\u00e4bi WebSQL | ProHoster","description":"Turva-uuringute eksperdid Hiina ettev\u00f5ttest Tencent esitasid uue haavatavuse variandi","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-sqlite-pozvolyayushhaya-udalyonno-atakovat-chrome-cherez-websql","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 SQLite, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u0442\u044c Chrome \u0447\u0435\u0440\u0435\u0437 WebSQL | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Tencent \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-sqlite-pozvolyayushhaya-udalyonno-atakovat-chrome-cherez-websql","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-23T21:00:00+00:00","article:modified_time":"2020-02-18T11:02:21+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"54354","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 11:02:28","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:07:25","updated":"2026-01-24 11:02:28","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/54354","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=54354"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/54354\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=54354"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=54354"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=54354"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}