{"id":102629,"date":"2021-12-16T03:36:46","date_gmt":"2021-12-16T01:36:46","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/perepolnenie-bufera-v-toxcore-ekspluatiruemoe-cherez-otpravku-udp-paketa"},"modified":"2021-12-16T03:36:46","modified_gmt":"2021-12-16T01:36:46","slug":"perepolnenie-bufera-v-toxcore-ekspluatiruemoe-cherez-otpravku-udp-paketa","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/news\/perepolnenie-bufera-v-toxcore-ekspluatiruemoe-cherez-otpravku-udp-paketa","title":{"rendered":"Buffer overflow in Toxcore exploited via UDP packet sending","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

In Toxcore, the reference implementation of the P2P messaging protocol Tox, a vulnerability (CVE-2021-44847) has been identified, which potentially allows for code execution through specially crafted UDP packets. All users of applications based on Toxcore that do not disable UDP transport are vulnerable. For an attack, it is enough to send a UDP packet knowing the victim's IP address, network port, and public DHT key (this information is publicly available in DHT, meaning the attack could be directed at any user or DHT node). <\/p>\n

The issue was present in toxcore releases from 0.1.9 to 0.2.12 and has been fixed in version 0.2.13. As of now, only the qTox project has released an update to address the vulnerability for client applications. As a workaround for protection, UDP can be disabled while keeping TCP support. <\/p>\n

La vulnerabilit\u00e0 \u00e8 causata da un overflow del buffer nella funzione handle_request(), che si verifica a causa di un calcolo errato della dimensione dei dati nel pacchetto di rete. In particolare, la lunghezza dei dati crittografati era determinata nel macro CRYPTO_SIZE, definito come \u00ab1 + CRYPTO_PUBLIC_KEY_SIZE * 2 + CRYPTO_NONCE_SIZE\u00bb, che veniva poi utilizzato nell'operazione di sottrazione \u00ablength - CRYPTO_SIZE\u00bb. A causa della mancanza di parentesi nel macro, invece di sottrarre la somma di tutti i valori, veniva sottratto 1 e sommati gli altri componenti. Ad esempio, invece di \u00ablength - (1 + 32 * 2 + 24)\u00bb, la dimensione del buffer veniva calcolata come \u00ablength - 1 + 32 * 2 + 24\u00bb, provocando la sovrascrittura dei dati nello stack, oltre il limite del buffer.
\n
Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 Toxcore, \u044d\u0442\u0430\u043b\u043e\u043d\u043d\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 P2P-\u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 \u043e\u0431\u043c\u0435\u043d\u0430 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f\u043c\u0438 Tox, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-44847), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0438\u043d\u0438\u0446\u0438\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e UDP-\u043f\u0430\u043a\u0435\u0442\u0430. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b \u0432\u0441\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u043d\u0430 \u0431\u0430\u0437\u0435 Toxcore, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043d\u0435 \u043e\u0442\u043a\u043b\u044e\u0447\u0451\u043d \u0442\u0440\u0430\u043d\u0441\u043f\u043e\u0440\u0442 UDP. \u0414\u043b\u044f \u0430\u0442\u0430\u043a\u0438 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c UDP-\u043f\u0430\u043a\u0435\u0442, \u0437\u043d\u0430\u044f IP-\u0430\u0434\u0440\u0435\u0441, \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u043f\u043e\u0440\u0442 \u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 DHT-\u043a\u043b\u044e\u0447 \u0436\u0435\u0440\u0442\u0432\u044b (\u0434\u0430\u043d\u043d\u044b\u0435 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e \u0432 DHT, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102629","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Overflow del buffer in Toxcore, sfruttato tramite l'invio di pacchetti UDP | ProHoster","description":"In Toxcore, l'implementazione di riferimento del protocollo P2P per lo scambio di messaggi Tox, \u00e8 stata individuata una vulnerabilit\u00e0 (CVE-2021-44847) che potrebbe potenzialmente consentire l'esecuzione di codice durante l'elaborazione di un pacchetto UDP appositamente formattato.","canonical_url":"https:\/\/prohoster.info\/it\/blog\/news\/perepolnenie-bufera-v-toxcore-ekspluatiruemoe-cherez-otpravku-udp-paketa","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 Toxcore, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u043e\u0435 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 UDP-\u043f\u0430\u043a\u0435\u0442\u0430 | ProHoster","og:description":"\u0412 Toxcore, \u044d\u0442\u0430\u043b\u043e\u043d\u043d\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 P2P-\u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 \u043e\u0431\u043c\u0435\u043d\u0430 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f\u043c\u0438 Tox, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-44847), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0438\u043d\u0438\u0446\u0438\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e UDP-\u043f\u0430\u043a\u0435\u0442\u0430.","og:url":"https:\/\/prohoster.info\/it\/blog\/news\/perepolnenie-bufera-v-toxcore-ekspluatiruemoe-cherez-otpravku-udp-paketa","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-12-16T01:36:46+00:00","article:modified_time":"2021-12-16T01:36:46+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102629","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-12-16 01:37:03","updated":"2022-10-02 18:35:56","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/102629","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=102629"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/102629\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=102629"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=102629"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=102629"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}