{"id":123495,"date":"2025-04-14T09:05:08","date_gmt":"2025-04-14T07:05:08","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/perepolnenie-bufera-v-perl-svyazannoe-s-obrabotkoj-simvolov"},"modified":"2025-04-14T09:05:08","modified_gmt":"2025-04-14T07:05:08","slug":"perepolnenie-bufera-v-perl-svyazannoe-s-obrabotkoj-simvolov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/news\/perepolnenie-bufera-v-perl-svyazannoe-s-obrabotkoj-simvolov","title":{"rendered":"Preklapanje bafera u Perlu, vezano uz obradu znakova","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Objavljene su ispravke za interpreter Perl 5.40.2 i 5.38.4, u kojima je uklonjena ranjivost (CVE-2024-56406), koja dovodi do prepunjenja bafera prilikom transliteracije posebno formatiranih ne-ASCII znakova pomo\u0107u operatora «tr\/..». Ne isklju\u010duje se mogu\u0107nost iskori\u0161tavanja ranjivosti za izvr\u0161avanje vlastitog koda u sustavu. Problem se javlja u stabilnim verzijama Perla od 2021. godine i poga\u0111a verzije Perl 5.34, 5.36, 5.38 i 5.40. Pra\u0107enje uklanjanja ranjivosti u distribucijama mogu\u0107e je na sljede\u0107im stranicama: Debian, Ubuntu, Fedora, Arch, FreeBSD. Distribucije temeljen na RHEL 9, SUSE 15 i openSUSE Leap 15.6 nisu podlo\u017ene ranjivosti, jer uklju\u010duju verzije Perla 5.32 i 5.26. <\/p>\n

Ranjivostpoga\u0111a programe koji koriste neprovjerene vanjske podatke na lijevoj strani operatora «tr», gdje se navodi varijabla s podacima za zamjenu znakova (na primjer, «$external_string =~ tr\/a\/b\/»). U funkcijama S_do_trans_invmap() koje omogu\u0107uju rad operatora, prilikom obrade nekih ne-ASCII bajtova dolazi do pristupa memoriji izvan dodijeljenog bafera. Prepunjenje se doga\u0111a jer se neki nizovi bajtova u izvornoj skupini podataka mogu pretvoriti u nizove UTF-8, za koje su potrebna dva bajta umjesto jednog. <\/p>\n

Zanimljivo je da je ranjivost nastala nakon izmjene iz 2020. godine koja je uklonila dodatnu provjeru dovoljnosti dodijeljene memorije pod izlikom da je prilikom izra\u010dunavanja veli\u010dine dovoljno zaokru\u017eivanje veli\u010dine na ve\u0107u stranu. Za provjeru prisutnosti ranjivosti mo\u017eete izvr\u0161iti sljede\u0107i kod: perl -e ‘$_ = «\x{FF}» x 1000000; tr\/\xFF\/\x{100}\/;’ Segmentation fault (core dumped)
\n
Izvor: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u043d\u0442\u0435\u0440\u043f\u0440\u0435\u0442\u0430\u0442\u043e\u0440\u0430 Perl 5.40.2 \u0438 5.38.4, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-56406), \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u0431\u0443\u0444\u0435\u0440\u0430 \u043f\u0440\u0438 \u0442\u0440\u0430\u043d\u0441\u043b\u0438\u0442\u0435\u0440\u0430\u0446\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u043d\u0435-ASCII \u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432 \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u0430 «tr\/..\/..\/». \u041d\u0435 \u0438\u0441\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u044b\u0445 \u0440\u0435\u043b\u0438\u0437\u0430\u0445 Perl \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 2021 \u0433\u043e\u0434\u0430 \u0438 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0432\u0435\u0442\u043a\u0438 Perl 5.34, 5.36, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-123495","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Preoptere\u0107enje bafera u Perlu, vezano za obradu znakova | ProHoster","description":"Objavljene su ispravke interpreter\u00e2 Perl 5.40.2 i 5.38.4, u kojima je otklonjena ranjivost (CVE-2024-56406) koja dovodi do preoptere\u0107enja bafera prilikom transliteracije posebno oblikovanih ne-ASCII.","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/news\/perepolnenie-bufera-v-perl-svyazannoe-s-obrabotkoj-simvolov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 Perl, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0435 \u0441 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u043d\u0442\u0435\u0440\u043f\u0440\u0435\u0442\u0430\u0442\u043e\u0440\u0430 Perl 5.40.2 \u0438 5.38.4, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-56406), \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u0431\u0443\u0444\u0435\u0440\u0430 \u043f\u0440\u0438 \u0442\u0440\u0430\u043d\u0441\u043b\u0438\u0442\u0435\u0440\u0430\u0446\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u043d\u0435-ASCII.","og:url":"https:\/\/prohoster.info\/hr\/blog\/news\/perepolnenie-bufera-v-perl-svyazannoe-s-obrabotkoj-simvolov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-04-14T07:05:08+00:00","article:modified_time":"2025-04-14T07:05:08+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"123495","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 12:12:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 12:12:19","updated":"2026-01-23 12:12:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/123495","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=123495"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/123495\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=123495"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=123495"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=123495"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}