{"id":40697,"date":"2020-02-03T14:36:04","date_gmt":"2020-02-03T11:36:04","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/obnovlenie-openwrt-19-07-1-s-ustraneniem-uyazvimosti-dopuskayushhej-podmenu-paketov"},"modified":"2020-02-03T14:36:04","modified_gmt":"2020-02-03T11:36:04","slug":"obnovlenie-openwrt-19-07-1-s-ustraneniem-uyazvimosti-dopuskayushhej-podmenu-paketov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/obnovlenie-openwrt-19-07-1-s-ustraneniem-uyazvimosti-dopuskayushhej-podmenu-paketov","title":{"rendered":"Mise \u00e0 jour d'OpenWrt 19.07.1 corrigeant une vuln\u00e9rabilit\u00e9 permettant une substitution des paquets","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Des versions correctrices de la distribution OpenWrt ont \u00e9t\u00e9 publi\u00e9es 18.06.7<\/a><\/noindex> et 19.07.1<\/a><\/noindex>, dans lesquelles a \u00e9t\u00e9 corrig\u00e9 vuln\u00e9rabilit\u00e9 critique<\/a><\/noindex> (CVE-2020-7982) dans le gestionnaire de paquets opkg<\/a><\/noindex>, permettant de r\u00e9aliser une attaque MITM et de manipuler le contenu du paquet t\u00e9l\u00e9charg\u00e9 depuis le d\u00e9p\u00f4t. En raison d'une erreur dans le code de v\u00e9rification des sommes de contr\u00f4le, un attaquant peut cr\u00e9er des conditions dans lesquelles les sommes de contr\u00f4le SHA-256, pr\u00e9sentes dans l'index des paquets prot\u00e9g\u00e9 par une signature num\u00e9rique, seront ignor\u00e9es, ce qui permet de contourner les m\u00e9canismes de v\u00e9rification de l'int\u00e9grit\u00e9 des ressources ipk t\u00e9l\u00e9charg\u00e9es.<\/p>\n

Le probl\u00e8me appara\u00eet depuis f\u00e9vrier 2017, apr\u00e8s d'ajouter<\/a><\/noindex> le code pour ignorer les espaces initiaux avant la somme de contr\u00f4le. En raison d'une erreur lors du saut des espaces, le pointeur de position dans la cha\u00eene ne se d\u00e9pla\u00e7ait pas, et la boucle de d\u00e9codage de la s\u00e9quence hexad\u00e9cimale SHA-256 renvoyait imm\u00e9diatement le contr\u00f4le avec une somme de contr\u00f4le de longueur nulle. <\/p>\n

Comme le gestionnaire de paquets opkg dans OpenWrt s'ex\u00e9cute avec les droits root, en cas d'attaque MITM, un attaquant a la possibilit\u00e9 d'apporter des modifications subtiles au paquet ipk t\u00e9l\u00e9charg\u00e9 depuis le r\u00e9f\u00e9rentiel lors de l'ex\u00e9cution de la commande \u00ab opkg install \u00bb par l'utilisateur, et d'organiser l'ex\u00e9cution de son code avec des droits root en ajoutant ses propres scripts de traitement au paquet, appel\u00e9s lors de l'installation. Pour exploiter cette vuln\u00e9rabilit\u00e9, l'attaquant doit \u00e9galement remplacer l'index des paquets valide et sign\u00e9 (par exemple, celui fourni par downloads.openwrt.org). La taille du paquet modifi\u00e9 doit correspondre \u00e0 la taille d'origine d\u00e9finie dans l'index.<\/p>\n

Dans une situation o\u00f9 il est n\u00e9cessaire de se passer de la mise \u00e0 jour de tout le firmware, il est possible de mettre \u00e0 jour uniquement le gestionnaire de paquets opkg en ex\u00e9cutant les commandes suivantes :<\/p>\n

cd \/tmp
\n opkg update
\n opkg download opkg
\n zcat .\/opkg-lists\/openwrt_base | grep -A10 \u00ab Package: opkg \u00bb | grep SHA256sum
\n sha256sum .\/opkg_2020-01-25-c09fe209-1_*.ipk<\/p>\n

Ensuite, il faut comparer les sommes de contr\u00f4le affich\u00e9es, et si elles co\u00efncident, ex\u00e9cuter :<\/p>\n

opkg install .\/opkg_2020-01-25-c09fe209-1_*.ipk<\/p>\n

Dans les nouvelles versions, un autre probl\u00e8me a \u00e9galement \u00e9t\u00e9 r\u00e9solu CVE-2020-10174<\/a><\/noindex> dans la biblioth\u00e8que libubox<\/a><\/noindex>, qui peut entra\u00eener un d\u00e9passement de tampon lors du traitement dans la fonction blobmsg_format_json<\/a><\/noindex> de donn\u00e9es binaires s\u00e9rialis\u00e9es sp\u00e9cialement format\u00e9es ou de donn\u00e9es au format JSON. La biblioth\u00e8que est utilis\u00e9e dans des composants de la distribution tels que netifd, procd, ubus, rpcd et uhttpd, ainsi que dans le paquet auc<\/a><\/noindex> (Attended sysUpgrade CLI). Un d\u00e9bordement de tampon se produit lors de la transmission de grands attributs num\u00e9riques de type \u00ab double \u00bb dans des blocs blob. Vous pouvez v\u00e9rifier la vuln\u00e9rabilit\u00e9 du syst\u00e8me en ex\u00e9cutant la commande :<\/p>\n

$ ubus call luci getFeatures \\
\n \u2018{ \u00ab banik \u00bb: 00192200197600198000198100200400.1922 }\u2019<\/p>\n

En plus de corriger les vuln\u00e9rabilit\u00e9s et de r\u00e9soudre les erreurs accumul\u00e9es dans la version OpenWrt 19.07.1, la version du noyau Linux a \u00e9galement \u00e9t\u00e9 mise \u00e0 jour (de 4.14.162 \u00e0 4.14.167), et des probl\u00e8mes de performance lors de l'utilisation de fr\u00e9quences de 5 GHz ont \u00e9t\u00e9 r\u00e9solus, prenant en charge des appareils tels que Ubiquiti Rocket M Titanium, Netgear WN2500RP v1,
\n Zyxel NSA325, Netgear WNR3500 V2, Archer C6 v2, Ubiquiti EdgeRouter-X, Archer C20 v4, Archer C50 v4 Archer MR200, TL-WA801ND v5, HiWiFi HC5962, Xiaomi Mi Router 3 Pro et Netgear R6350.<\/p>\n

<\/a><\/noindex><\/p>\n

Source : opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430 OpenWrt 18.06.7 \u0438 19.07.1, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u043e\u043f\u0430\u0441\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-7982) \u0432 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u043c \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0435 opkg, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0442\u044c MITM-\u0430\u0442\u0430\u043a\u0443 \u0438 \u043f\u043e\u0434\u043c\u0435\u043d\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u043c\u043e\u0433\u043e \u0438\u0437 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u0430. \u0418\u0437-\u0437\u0430 \u043e\u0448\u0438\u0431\u043a\u0438 \u0432 \u043a\u043e\u0434\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u043d\u044b\u0445 \u0441\u0443\u043c\u043c, \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043c\u043e\u0436\u0435\u0442 \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u0443\u0441\u043b\u043e\u0432\u0438\u044f, \u043f\u0440\u0438 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u043d\u044b\u0435 \u0441\u0443\u043c\u043c\u044b SHA-256, \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u0432 \u0437\u0430\u0432\u0435\u0440\u0435\u043d\u043d\u043e\u043c \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u044c\u044e \u0438\u043d\u0434\u0435\u043a\u0441\u0435 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0431\u0443\u0434\u0443\u0442 \u0438\u0433\u043d\u043e\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u044b, \u0447\u0442\u043e \u0434\u0430\u0451\u0442 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-40697","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Mise \u00e0 jour OpenWrt 19.07.1 corrig\u00e9e pour la vuln\u00e9rabilit\u00e9 permettant la substitution de paquets | ProHoster","description":"Des releases de correction ont \u00e9t\u00e9 publi\u00e9es pour la distribution OpenWrt 18.06.7 et","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/obnovlenie-openwrt-19-07-1-s-ustraneniem-uyazvimosti-dopuskayushhej-podmenu-paketov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 OpenWrt 19.07.1 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0435\u0439 \u043f\u043e\u0434\u043c\u0435\u043d\u0443 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430 OpenWrt 18.06.7 \u0438","og:url":"https:\/\/prohoster.info\/fr\/blog\/obnovlenie-openwrt-19-07-1-s-ustraneniem-uyazvimosti-dopuskayushhej-podmenu-paketov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-03T11:36:04+00:00","article:modified_time":"2020-02-03T11:36:04+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"40697","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 00:32:41","updated":"2022-09-30 04:43:23","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/40697","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=40697"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/40697\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=40697"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=40697"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=40697"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}