{"id":111112,"date":"2023-10-26T21:10:14","date_gmt":"2023-10-26T19:10:15","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/rezultaty-audita-tor-browser-i-komponentov-infrastruktury-tor"},"modified":"2023-10-26T21:10:14","modified_gmt":"2023-10-26T19:10:15","slug":"rezultaty-audita-tor-browser-i-komponentov-infrastruktury-tor","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/rezultaty-audita-tor-browser-i-komponentov-infrastruktury-tor","title":{"rendered":"Tor Browser \u00e9s a Tor infrastrukt\u00fara komponensei audit\u00e1l\u00e1s\u00e1nak eredm\u00e9nyei","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

A Tor anonim h\u00e1l\u00f3zat fejleszt\u0151i k\u00f6zz\u00e9tett\u00e9k a Tor Browser \u00e9s a projekt \u00e1ltal fejlesztett OONI Probe, rdsys, BridgeDB \u00e9s Conjure eszk\u00f6z\u00f6k auditj\u00e1nak eredm\u00e9nyeit, amelyeket a cenz\u00far\u00e1z\u00e1s megker\u00fcl\u00e9s\u00e9re haszn\u00e1lnak. Az auditot a Cure53 v\u00e9gezte 2022 november\u00e9t\u0151l 2023 \u00e1prilis\u00e1ig. <\/p>\n

A vizsg\u00e1lat sor\u00e1n 9 sebezhet\u0151s\u00e9get azonos\u00edtottak, amelyekb\u0151l kett\u0151 a vesz\u00e9lyes kateg\u00f3ri\u00e1ba, egy k\u00f6zepes szint\u0171 vesz\u00e9lyess\u00e9g\u0171, m\u00edg 6 kisebb vesz\u00e9llyel j\u00e1r\u00f3 probl\u00e9m\u00e1k k\u00f6z\u00e9 sorolhat\u00f3. Ezen k\u00edv\u00fcl a k\u00f3d b\u00e1zis\u00e1ban 10 probl\u00e9m\u00e1t tal\u00e1ltak, amelyek biztons\u00e1ggal nem kapcsolatos hi\u00e1nyoss\u00e1goknak min\u0151s\u00fclnek. \u00d6sszess\u00e9g\u00e9ben a Tor projekt k\u00f3dj\u00e1t a biztons\u00e1gos programoz\u00e1si gyakorlatoknak megfelel\u0151nek \u00edt\u00e9lt\u00e9k. <\/p>\n

Az els\u0151 vesz\u00e9lyes sebezhet\u0151s\u00e9g a rdsys elosztott rendszer h\u00e1tt\u00e9rben tal\u00e1lhat\u00f3, amely biztos\u00edtja a cenz\u00far\u00e1zott felhaszn\u00e1l\u00f3k sz\u00e1m\u00e1ra a forr\u00e1sok, p\u00e9ld\u00e1ul proxylist\u00e1k \u00e9s let\u00f6lt\u00e9si linkek eljuttat\u00e1s\u00e1t. A sebezhet\u0151s\u00e9g az er\u0151forr\u00e1sok regisztr\u00e1ci\u00f3s kezel\u0151j\u00e9hez val\u00f3 hozz\u00e1f\u00e9r\u00e9skor tapasztalt hiteles\u00edt\u00e9s hi\u00e1ny\u00e1b\u00f3l fakadt, \u00e9s lehet\u0151v\u00e9 tette a t\u00e1mad\u00f3 sz\u00e1m\u00e1ra, hogy saj\u00e1t k\u00e1rtev\u0151 forr\u00e1st regisztr\u00e1ljon a felhaszn\u00e1l\u00f3k sz\u00e1m\u00e1ra t\u00f6rt\u00e9n\u0151 k\u00e9zbes\u00edt\u00e9shez. A kihaszn\u00e1l\u00e1s a rdsys kezel\u0151h\u00f6z k\u00fcld\u00f6tt HTTP-k\u00e9relmekre korl\u00e1toz\u00f3dik.

\"Tor<\/center> <\/p>\n

A m\u00e1sodik vesz\u00e9lyes sebezhet\u0151s\u00e9get a Tor Browser-ben tal\u00e1lt\u00e1k, amely a rdsys \u00e9s a BridgeDB \u00e1ltal a h\u00eddcsom\u00f3pontok list\u00e1j\u00e1nak megszerz\u00e9sekor tapasztalt digit\u00e1lis al\u00e1\u00edr\u00e1s ellen\u0151rz\u00e9s\u00e9nek hi\u00e1ny\u00e1b\u00f3l sz\u00e1rmazott. Mivel a lista a Tor anonim h\u00e1l\u00f3zathoz val\u00f3 csatlakoz\u00e1s el\u0151tt t\u00f6lt\u0151dik be a b\u00f6ng\u00e9sz\u0151be, a kriptogr\u00e1fiai digit\u00e1lis al\u00e1\u00edr\u00e1s ellen\u0151rz\u00e9s\u00e9nek hi\u00e1nya lehet\u0151v\u00e9 tette a t\u00e1mad\u00f3 sz\u00e1m\u00e1ra a lista tartalm\u00e1nak manipul\u00e1l\u00e1s\u00e1t, p\u00e9ld\u00e1ul a kapcsolat megszak\u00edt\u00e1s\u00e1val vagy a forr\u00e1s felt\u00f6r\u00e9s\u00e9vel, amelyen kereszt\u00fcl a lista terjed. a szerver<\/a>Sikeres t\u00e1mad\u00e1s eset\u00e9n a t\u00e1mad\u00f3 a felhaszn\u00e1l\u00f3kat saj\u00e1t kompromitt\u00e1lt h\u00eddcsom\u00f3pontj\u00e1n kereszt\u00fcl csatlakozathatta. <\/p>\n

A k\u00f6zepes vesz\u00e9lyess\u00e9g\u0171 sebezhet\u0151s\u00e9g a rdsys alrendszer\u00e9ben tal\u00e1lhat\u00f3, a telep\u00edt\u00e9si szkriptekben, \u00e9s lehet\u0151v\u00e9 tette a t\u00e1mad\u00f3 sz\u00e1m\u00e1ra, hogy a nobody felhaszn\u00e1l\u00f3r\u00f3l az rdsys felhaszn\u00e1l\u00f3ra emelje a jogosults\u00e1gait, amennyiben hozz\u00e1f\u00e9r\u00e9ssel rendelkezett szerverhez<\/a> \u00e9s \u00edr\u00e1si lehet\u0151s\u00e9ggel a tmp mapp\u00e1ba. A sebezhet\u0151s\u00e9g kihaszn\u00e1l\u00e1sa a \/tmp k\u00f6nyvt\u00e1rban elhelyezett v\u00e9grehajthat\u00f3 f\u00e1jl cser\u00e9j\u00e9re korl\u00e1toz\u00f3dik. Az rdsys felhaszn\u00e1l\u00f3i jogok megszerz\u00e9se lehet\u0151v\u00e9 teszi a t\u00e1mad\u00f3 sz\u00e1m\u00e1ra, hogy m\u00f3dos\u00edt\u00e1sokat v\u00e9gezzen az rdsys \u00e1ltal futtatott v\u00e9grehajthat\u00f3 f\u00e1jlokban. <\/p>\n

A kis fok\u00fa kock\u00e1zat\u00fa sebezhet\u0151s\u00e9gek f\u0151k\u00e9nt elavult f\u00fcgg\u0151s\u00e9gek haszn\u00e1lat\u00e1val voltak \u00f6sszef\u00fcgg\u00e9sben, amelyekben ismert sebezhet\u0151s\u00e9gek tal\u00e1lhat\u00f3k, vagy a szolg\u00e1ltat\u00e1s megtagad\u00e1s\u00e1nak lehet\u0151s\u00e9g\u00e9vel. A Tor Browser kisebb sebezhet\u0151s\u00e9gei k\u00f6z\u00f6tt eml\u00edt\u00e9st \u00e9rdemel, hogy a legmagasabb v\u00e9delmi szint be\u00e1ll\u00edt\u00e1sa mellett elker\u00fclhet\u0151 a JavaScript v\u00e9grehajt\u00e1s\u00e1nak tilalma, hi\u00e1nyoznak a f\u00e1jlok felt\u00f6lt\u00e9s\u00e9re vonatkoz\u00f3 korl\u00e1toz\u00e1sok, \u00e9s potenci\u00e1lis adatfoly\u00e1s figyelhet\u0151 meg a felhaszn\u00e1l\u00f3i kezd\u0151lap \u00e1ltal, ami lehet\u0151v\u00e9 teszi a felhaszn\u00e1l\u00f3k nyomon k\u00f6vet\u00e9s\u00e9t \u00fajraind\u00edt\u00e1sok k\u00f6z\u00f6tt. <\/p>\n

Jelenleg minden sebezhet\u0151s\u00e9get elh\u00e1r\u00edtottak, t\u00f6bbek k\u00f6z\u00f6tt megval\u00f3s\u00edtott\u00e1k az autentik\u00e1ci\u00f3t az \u00f6sszes rdsys kezel\u0151h\u00f6z, \u00e9s digit\u00e1lis al\u00e1\u00edr\u00e1s ellen\u0151rz\u00e9s\u00e9t vezett\u00e9k be a Tor Browser-ba felt\u00f6lt\u00f6tt list\u00e1k eset\u00e9ben. <\/p>\n

Tov\u00e1bb\u00e1 eml\u00edt\u00e9sre m\u00e9lt\u00f3 a Tor Browser 13.0.1 kiad\u00e1sa. A kiad\u00e1s szinkroniz\u00e1lva lett a Firefox 115.4.0 ESR k\u00f3dalapj\u00e1val, amelyben 19 sebezhet\u0151s\u00e9get h\u00e1r\u00edtottak el (13-at vesz\u00e9lyesnek min\u0151s\u00edtettek). Az Androidra k\u00e9sz\u00fclt Tor Browser 13.0.1 verzi\u00f3ba \u00e1tker\u00fcltek a Firefox 119-b\u0151l sz\u00e1rmaz\u00f3 sebezhet\u0151s\u00e9gek jav\u00edt\u00e1sai.
\n
Forr\u00e1s: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 Tor \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u0443\u0434\u0438\u0442\u0430 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430 Tor Browser \u0438 \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0435\u0432 OONI Probe, rdsys, BridgeDB \u0438 Conjure, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0445 \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u0446\u0435\u043d\u0437\u0443\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f. \u0410\u0443\u0434\u0438\u0442 \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u043b\u0441\u044f \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Cure53 \u0441 \u043d\u043e\u044f\u0431\u0440\u044f 2022 \u0433\u043e\u0434\u0430 \u043f\u043e \u0430\u043f\u0440\u0435\u043b\u044c 2023 \u0433\u043e\u0434\u0430. \u0412 \u0445\u043e\u0434\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0431\u044b\u043b\u0438 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b 9 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0434\u0432\u0435 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043e\u0442\u043d\u0435\u0441\u0435\u043d\u044b \u043a \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u0438 \u043e\u043f\u0430\u0441\u043d\u044b\u0445, \u043e\u0434\u043d\u043e\u0439 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u0441\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":111113,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-111112","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47A Tor Browser \u00e9s a Tor infrastrukt\u00fara komponenseinek audit\u00e1l\u00e1si eredm\u00e9nyei | ProHoster","description":"A Tor anonim h\u00e1l\u00f3zat fejleszt\u0151i k\u00f6zz\u00e9tett\u00e9k a Tor Browser \u00e9s az OONI Probe, rdsys, BridgeDB \u00e9s Conjure projektek eszk\u00f6zeinek audit\u00e1l\u00e1s\u00e1nak eredm\u00e9nyeit, amelyeket a cenz\u00fara megker\u00fcl\u00e9s\u00e9re alkalmaznak.","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/news\/rezultaty-audita-tor-browser-i-komponentov-infrastruktury-tor","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u0443\u0434\u0438\u0442\u0430 Tor Browser \u0438 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b Tor | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 Tor \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0430\u0443\u0434\u0438\u0442\u0430 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430 Tor Browser \u0438 \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0435\u0432 OONI Probe, rdsys, BridgeDB \u0438 Conjure, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0445 \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u0446\u0435\u043d\u0437\u0443\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f.","og:url":"https:\/\/prohoster.info\/hu\/blog\/news\/rezultaty-audita-tor-browser-i-komponentov-infrastruktury-tor","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-10-26T19:10:15+00:00","article:modified_time":"2023-10-26T19:10:15+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"111112","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-09 21:42:05","updated":"2026-02-22 15:31:12","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/111112","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=111112"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/111112\/revisions"}],"predecessor-version":[{"id":162425,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/111112\/revisions\/162425"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media\/111113"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=111112"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=111112"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=111112"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}