{"id":91827,"date":"2020-08-19T13:41:59","date_gmt":"2020-08-19T11:41:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/mozilla-rasshirila-programmu-vyplaty-voznagrazhdenij-za-vyyavlenie-uyazvimostej"},"modified":"2020-08-19T13:41:59","modified_gmt":"2020-08-19T11:41:59","slug":"mozilla-rasshirila-programmu-vyplaty-voznagrazhdenij-za-vyyavlenie-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/mozilla-rasshirila-programmu-vyplaty-voznagrazhdenij-za-vyyavlenie-uyazvimostej","title":{"rendered":"Mozilla a \u00e9largi son programme de r\u00e9compenses pour la d\u00e9couverte de vuln\u00e9rabilit\u00e9s.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Entreprise Mozilla <noindex><a rel=\"nofollow\" href=\"https:\/\/blog.mozilla.org\/attack-and-defense\/2020\/08\/18\/exploit-mitigation-bounty\/\">a annonc\u00e9<\/a><\/noindex> sur l'extension de l'initiative de r\u00e9compense mon\u00e9taire pour la d\u00e9tection des probl\u00e8mes de s\u00e9curit\u00e9 dans Firefox. En plus des vuln\u00e9rabilit\u00e9s elles-m\u00eames, le programme Bug Bounty visera maintenant \u00e9galement <noindex><a rel=\"nofollow\" href=\"https:\/\/www.mozilla.org\/en-US\/security\/client-bug-bounty\/#exploit-mitigation-bounty\">des m\u00e9thodes<\/a><\/noindex> le contournement des m\u00e9canismes pr\u00e9sents dans le navigateur qui emp\u00eachent le fonctionnement des exploits. <\/p>\n<p>Parmi ces m\u00e9canismes, on trouve un syst\u00e8me de nettoyage des fragments HTML avant leur utilisation dans un contexte privil\u00e9gi\u00e9, la s\u00e9paration de la m\u00e9moire pour les n\u0153uds DOM et les cha\u00eenes\/ArrayBuffers, l'interdiction de eval() dans le contexte syst\u00e8me et le processus parent, l'application de restrictions strictes CSP (Content Security Policy) aux pages de service \u00ab about: \u00bb, l'interdiction de charger dans le processus parent des pages autres que \u00ab chrome:\/\/ \u00bb, \u00ab resource:\/\/ \u00bb et \u00ab about: \u00bb, l'interdiction d'ex\u00e9cuter du code JavaScript externe dans le processus parent, et la contournement des m\u00e9canismes de s\u00e9paration du code JavaScript privil\u00e9gi\u00e9 (utilis\u00e9 pour construire l'interface du navigateur) et non privil\u00e9gi\u00e9. Comme exemple d'erreur donnant droit \u00e0 une nouvelle r\u00e9compense, on peut citer <noindex><a rel=\"nofollow\" href=\"https:\/\/bugzilla.mozilla.org\/show_bug.cgi?id=1583949\">un oubli<\/a><\/noindex> de v\u00e9rification pour eval() dans les threads Web Workers.<\/p>\n<p>Lorsqu'une vuln\u00e9rabilit\u00e9 et un contournement des m\u00e9canismes de protection contre les exploits sont d\u00e9couverts, le chercheur pourra obtenir 50 % suppl\u00e9mentaires de la r\u00e9compense de base, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.mozilla.org\/en-US\/security\/client-bug-bounty\/\">attribu\u00e9e<\/a><\/noindex> pour la vuln\u00e9rabilit\u00e9 d\u00e9tect\u00e9e (par exemple, pour une vuln\u00e9rabilit\u00e9 UXSS contournant le m\u00e9canisme  <noindex><a rel=\"nofollow\" href=\"https:\/\/blog.mozilla.org\/attack-and-defense\/2019\/12\/02\/help-test-firefoxs-built-in-html-sanitizer-to-protect-against-uxss-bugs\/\">HTML Sanitizer<\/a><\/noindex>, il sera possible d'obtenir 7000 $ plus un bonus de 3500 $). Il est \u00e0 noter que l'extension du programme de r\u00e9compenses pour les chercheurs ind\u00e9pendants intervient dans le contexte du r\u00e9cent <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=53533\">licenciement<\/a><\/noindex> de 250 employ\u00e9s de Mozilla, parmi lesquels <noindex><a rel=\"nofollow\" href=\"https:\/\/twitter.com\/MichalPurzynski\/status\/1293220570885062657\">se trouvait<\/a><\/noindex> toute l'\u00e9quipe en charge de la gestion des menaces (Threat management team), qui s'occupait de l'identification et de l'analyse des incidents, ainsi que <noindex><a rel=\"nofollow\" href=\"https:\/\/news.ycombinator.com\/item?id=24121133\">une partie de l'\u00e9quipe<\/a><\/noindex>  Security team.<\/p>\n<p>De plus, il a \u00e9t\u00e9 signal\u00e9 un changement dans les r\u00e8gles d'application du programme de r\u00e9compense pour les vuln\u00e9rabilit\u00e9s d\u00e9tect\u00e9es dans les versions nocturnes. Il est not\u00e9 que de telles vuln\u00e9rabilit\u00e9s sont souvent imm\u00e9diatement d\u00e9tect\u00e9es lors des v\u00e9rifications automatis\u00e9es internes et du fuzzing. Les rapports sur de telles erreurs ne contribuent pas \u00e0 l'am\u00e9lioration de la s\u00e9curit\u00e9 de Firefox et au perfectionnement des m\u00e9canismes de fuzzing, c'est pourquoi les r\u00e9compenses pour les vuln\u00e9rabilit\u00e9s dans les versions nocturnes ne seront vers\u00e9es que si le probl\u00e8me est pr\u00e9sent dans le d\u00e9p\u00f4t principal pendant plus de 4 jours et reste non d\u00e9tect\u00e9 par les v\u00e9rifications internes et par les employ\u00e9s de Mozilla.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Source : <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=53567\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Mozilla \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0438 \u0438\u043d\u0438\u0446\u0438\u0430\u0442\u0438\u0432\u044b \u043f\u043e \u0432\u044b\u043f\u043b\u0430\u0442\u0435 \u0434\u0435\u043d\u0435\u0436\u043d\u044b\u0445 \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u0439 \u0437\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e \u0432 Firefox. \u041f\u043e\u043c\u0438\u043c\u043e \u043d\u0435\u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 Bug Bounty \u0442\u0435\u043f\u0435\u0440\u044c \u0431\u0443\u0434\u0435\u0442 \u043e\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u0442\u044c \u0438 \u043c\u0435\u0442\u043e\u0434\u044b \u043e\u0431\u0445\u043e\u0434\u0430 \u0438\u043c\u0435\u044e\u0449\u0438\u0445\u0441\u044f \u0432 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u043e\u0432, \u043f\u0440\u0435\u043f\u044f\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u0440\u0430\u0431\u043e\u0442\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u043e\u0432. \u0412 \u0447\u0438\u0441\u043b\u043e \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0445 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u043e\u0432 \u0432\u0445\u043e\u0434\u0438\u0442 \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u0447\u0438\u0441\u0442\u043a\u0438 \u0444\u0440\u0430\u0433\u043c\u0435\u043d\u0442\u043e\u0432 HTML \u043f\u0435\u0440\u0435\u0434 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0432 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0435, \u0440\u0430\u0437\u0434\u0435\u043b\u0435\u043d\u0438\u0435 \u043f\u0430\u043c\u044f\u0442\u0438 \u0434\u043b\u044f \u0443\u0437\u043b\u043e\u0432 DOM [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-91827","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Mozilla \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0438 \u0438\u043d\u0438\u0446\u0438\u0430\u0442\u0438\u0432\u044b \u043f\u043e \u0432\u044b\u043f\u043b\u0430\u0442\u0435 \u0434\u0435\u043d\u0435\u0436\u043d\u044b\u0445 \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u0439.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/fr\/blog\/news\/mozilla-rasshirila-programmu-vyplaty-voznagrazhdenij-za-vyyavlenie-uyazvimostej\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"fr_FR\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47Mozilla \u0440\u0430\u0441\u0448\u0438\u0440\u0438\u043b\u0430 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0443 \u0432\u044b\u043f\u043b\u0430\u0442\u044b \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u0439 \u0437\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Mozilla \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0438 \u0438\u043d\u0438\u0446\u0438\u0430\u0442\u0438\u0432\u044b \u043f\u043e \u0432\u044b\u043f\u043b\u0430\u0442\u0435 \u0434\u0435\u043d\u0435\u0436\u043d\u044b\u0445 \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u0439.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/fr\/blog\/news\/mozilla-rasshirila-programmu-vyplaty-voznagrazhdenij-za-vyyavlenie-uyazvimostej\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-08-19T11:41:59+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-08-19T11:41:59+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Mozilla a \u00e9largi son programme de r\u00e9compenses pour la d\u00e9couverte de vuln\u00e9rabilit\u00e9s | ProHoster","description":"La soci\u00e9t\u00e9 Mozilla a annonc\u00e9 l'expansion de son initiative de r\u00e9compense financi\u00e8re.","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/mozilla-rasshirila-programmu-vyplaty-voznagrazhdenij-za-vyyavlenie-uyazvimostej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Mozilla \u0440\u0430\u0441\u0448\u0438\u0440\u0438\u043b\u0430 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0443 \u0432\u044b\u043f\u043b\u0430\u0442\u044b \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u0439 \u0437\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Mozilla \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0438 \u0438\u043d\u0438\u0446\u0438\u0430\u0442\u0438\u0432\u044b \u043f\u043e \u0432\u044b\u043f\u043b\u0430\u0442\u0435 \u0434\u0435\u043d\u0435\u0436\u043d\u044b\u0445 \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u0439.","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/mozilla-rasshirila-programmu-vyplaty-voznagrazhdenij-za-vyyavlenie-uyazvimostej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-08-19T11:41:59+00:00","article:modified_time":"2020-08-19T11:41:59+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"91827","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:20:24","updated":"2022-10-08 11:15:02","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/91827","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=91827"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/91827\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=91827"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=91827"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=91827"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}