{"id":54354,"date":"2019-12-24T00:00:00","date_gmt":"2019-12-23T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/uyazvimost-v-sqlite-pozvolyayushhaya-udalyonno-atakovat-chrome-cherez-websql"},"modified":"2020-02-18T14:02:21","modified_gmt":"2020-02-18T11:02:21","slug":"uyazvimost-v-sqlite-pozvolyayushhaya-udalyonno-atakovat-chrome-cherez-websql","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-sqlite-pozvolyayushhaya-udalyonno-atakovat-chrome-cherez-websql","title":{"rendered":"SQLite haavatavus, mis v\u00f5imaldab Chrome'i kaugelt r\u00fcnnata WebSQL kaudu","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Turvalouka uurijad Hiina ettev\u00f5ttest Tencent esitanud<\/a><\/noindex> uus haavatavuse variant Magellan<\/a><\/noindex> (CVE-2019-13734<\/a><\/noindex>), mis v\u00f5imaldab koodi t\u00e4itmist, kui SQLite andmebaas t\u00f6\u00f6tleb teatud viisil vormindatud SQL-konstruktsioone. Sarnane haavatavus tuvastati avalikustatud<\/a><\/noindex> sama uurijate poolt eelmisel aastal. Haavatavus on m\u00e4rkimisv\u00e4\u00e4rne, kuna see v\u00f5imaldab kaugr\u00fcnnakut Chrome brauserile ja annab kontrolli kasutaja s\u00fcsteemi \u00fcle, kui avatakse kurjategijate hallatavad veebilehed. <\/p>\n

R\u00fcnnak Chrome\/Chromiumile toimub WebSQL API kaudu, mille t\u00f6\u00f6tleja p\u00f5hineb SQLite koodil. Muude rakenduste r\u00fcndamine on v\u00f5imalik ainult siis, kui need lubavad v\u00e4liste SQL-konstruktsioonide edastamist SQLite'ile, n\u00e4iteks kasutades SQLite't andmevahetuse vorminguna. Firefox ei ole haavatav, kuna Mozilla keeldus<\/a><\/noindex> WebSQL'i rakendamisest API IndexedDB kasuks.<\/a><\/noindex> Google lahendas probleemi avalduses <\/p>\n

. SQLite koodibaasis oli probleem Chrome 79<\/a><\/noindex>17. novembril, ja Chromiumi koodibaasis \u2014 parandatud<\/a><\/noindex> 17. november, ja Chromiumi koodibaasis \u2014 Probleem esineb<\/a><\/noindex>.
\nFTS3 t\u00e4isteksti indeksi mootori kaudu ja v\u00f5ib varjatud tabelite (shadow tables, kirjutamisv\u00f5imekusega virtuaalsed tabelid) manipulatsiooniga p\u00f5hjustada indeksi rikutust ja m\u00e4lupuhvri \u00fclet\u00e4itumist. \u00dcksikasjalik teave ekspluateerimise tehnika kohta avaldatakse 90 p\u00e4eva jooksul. koodis<\/a><\/noindex> Uut SQLite'i versiooni koos parandusega ei ole veel<\/p>\n

kuup\u00e4evaks loodud 31. detsember). Kaitse \u00fcmberp\u00f6\u00f6ramiseks v\u00f5ib alates SQLite'i versioonist 3.26.0 kasutada re\u017eiimi SQLITE_DBCONFIG_DEFENSIVE, mis keelab kirjutamise varjatud tabelitesse ja mida soovitatakse kasutada v\u00e4liste SQL-p\u00e4ringute t\u00f6\u00f6tlemisel SQLite's. Jaotustes j\u00e4\u00e4b haavatavus SQLite'i teegis hetkel parandamata<\/a><\/noindex> (oodatakse<\/a><\/noindex> . Chromium k\u00f5igis jaotustes on juba uuendatud ja ei ole haavatav, kuid probleem v\u00f5ib ulatuda erinevatesse kolmandate osapoolte brauseritesse ja rakendustesse, mis kasutavad Chromiumi mootorit, samuti Android-rakendustesse, mis p\u00f5hinevad Webview'l. Debian<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, RHEL<\/a><\/noindex>, openSUSE\/SUSE<\/a><\/noindex>, Arch Linux<\/a><\/noindex>, Fedora<\/a><\/noindex>, FreeBSD<\/a><\/noindex>Lisaks on SQLite's tuvastatud veel 4 v\u00e4hem ohtlikku probleemi (<\/p>\n

CVE-2019-13750CVE-2019-13751<\/a><\/noindex>, CVE-2019-13752<\/a><\/noindex>, CVE-2019-13753<\/a><\/noindex>, CVE-2019-13753<\/a><\/noindex>), mis v\u00f5ivad viia teabe leketeni ja piirangute \u00fcmbers\u00f5idule (v\u00f5ivad olla kaasnevad tegurid Chrome'i r\u00fcnnakuks). M\u00e4rgitud probleemid on lahendatud SQLite koodis 13. detsembril. \u00dcheskoos v\u00f5imaldasid probleemid teadlastel valmistada ette t\u00f6\u00f6kindla eksploidimise, mis v\u00f5imaldab koodi k\u00e4ivitada Chromiumi protsessis, mis vastutab renderdamise eest.<\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Tencent \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 Magellan (CVE-2019-13734), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0432 \u0421\u0423\u0411\u0414 SQLite \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 SQL-\u043a\u043e\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0439. \u041f\u043e\u0445\u043e\u0436\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0431\u044b\u043b\u0430 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430 \u0442\u0435\u043c\u0438 \u0436\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 \u0433\u043e\u0434 \u043d\u0430\u0437\u0430\u0434. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u0430 \u0442\u0435\u043c, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u0442\u044c \u0431\u0440\u0430\u0443\u0437\u0435\u0440 Chrome \u0438 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u043d\u0430\u0434 \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u043f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438 \u043f\u043e\u0434\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u043d\u044b\u0445 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 web-\u0441\u0442\u0440\u0430\u043d\u0438\u0446. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-54354","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47SQLite haavatavus, mis v\u00f5imaldab Chrome'i kaugr\u00fcnnakut l\u00e4bi WebSQL | ProHoster","description":"Julgeolekuteadlased Hiina ettev\u00f5ttest Tencent esitlesid uut haavatavuse varianti","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-sqlite-pozvolyayushhaya-udalyonno-atakovat-chrome-cherez-websql","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 SQLite, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u0442\u044c Chrome \u0447\u0435\u0440\u0435\u0437 WebSQL | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Tencent \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-sqlite-pozvolyayushhaya-udalyonno-atakovat-chrome-cherez-websql","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-23T21:00:00+00:00","article:modified_time":"2020-02-18T11:02:21+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"54354","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 11:02:28","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:07:25","updated":"2026-01-24 11:02:28","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/54354","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=54354"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/54354\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=54354"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=54354"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=54354"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}