Sabunta Tor 0.3.5.10, 0.4.1.9 da 0.4.2.7 tare da kawar da raunin DoS

An Gabatar gyare-gyare na kayan aikin Tor (0.3.5.10, 0.4.1.9, 0.4.2.7, 0.4.3.3-alpha), da ake amfani da su don tsara aikin cibiyar sadarwar Tor. Sabbin sigogin suna gyara lahani guda biyu:

  • CVE-2020-10592 - kowane mai hari zai iya amfani da shi don fara ƙin sabis na relays. Sabar directory Tor kuma za ta iya kai harin don kai hari ga abokan ciniki da ayyukan ɓoye. Mai kai hari zai iya haifar da yanayin da ke haifar da nauyi mai yawa akan CPU, yana rushe aiki na yau da kullun na daƙiƙa ko mintuna (ta maimaita harin, ana iya ƙara DoS na dogon lokaci). Matsalar tana bayyana tun lokacin da aka saki 0.2.1.5-alpha.
  • CVE-2020-10593 - Ƙwaƙwalwar ƙwaƙwalwar da aka fara daga nesa wanda ke faruwa lokacin da madaidaicin madauri ya daidaita sau biyu don sarkar iri ɗaya.

Hakanan ana iya lura cewa a cikin 9.0.6 mai bincike na Tor rashin lahani a cikin ƙarawa ya kasance mara gyara NoScript, wanda ke ba ka damar gudanar da lambar JavaScript a cikin yanayin kariya mafi aminci. Ga wadanda hana aiwatar da JavaScript yana da mahimmanci ga waɗanda ke da mahimmanci, ana ba da shawarar kashe amfani da JavaScript na ɗan lokaci a cikin burauzar game da: config ta hanyar canza ma'aunin javascript.enabled a cikin game da: config.

Sun yi ƙoƙarin kawar da lahani a ciki Littafin Rubutun 11.0.17, amma kamar yadda ya fito, gyaran da aka tsara bai magance matsalar gaba daya ba. Yin la'akari da canje-canje a cikin sakin da aka fitar na gaba Littafin Rubutun 11.0.18, matsalar kuma ba a warware ba. Tor Browser ya haɗa da sabuntawar NoScript ta atomatik, don haka da zarar an sami gyara, za a isar da shi ta atomatik.

source: budenet.ru

Add a comment