{"id":35502,"date":"2019-10-31T22:04:42","date_gmt":"2019-10-31T19:04:42","guid":{"rendered":"https:\/\/prohoster.info\/blog\/v-firefox-67-0-4-i-60-7-2-ustranena-eshhyo-odna-0-day-uyazvimost\/"},"modified":"2019-10-31T22:04:42","modified_gmt":"2019-10-31T19:04:42","slug":"v-firefox-67-0-4-i-60-7-2-ustranena-eshhyo-odna-0-day-uyazvimost","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/v-firefox-67-0-4-i-60-7-2-ustranena-eshhyo-odna-0-day-uyazvimost","title":{"rendered":"In Firefox 67.0.4 e 60.7.2 \u00e8 stata risolta un'altra vulnerabilit\u00e0 zero-day","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Dopo le versioni di Firefox 67.0.3 e 60.7.1 pubblicati<\/a><\/noindex> sono stati rilasciati aggiornamenti correttivi 67.0.4 e 60.7.2, che risolvono la seconda vulnerabilit\u00e0 0-day una vulnerabilit\u00e0<\/a><\/noindex> (CVE-2019-11708), che consente di aggirare il meccanismo di isolamento sandbox. Il problema utilizza la manipolazione della chiamata IPC Prompt:Open per aprire contenuti web selezionati dal processo figlio nel processo genitore, dove il sandbox non \u00e8 attivo. Combinato con un'altra vulnerabilit\u00e0, questo problema consente di bypassare tutti i livelli di protezione ed eseguire codice nel sistema.<\/p>\n

Le vulnerabilit\u00e0 riscontrate negli ultimi due rilasci di Firefox sono state utilizzate<\/a><\/noindex> per organizzare attacchi ai dipendenti della piattaforma di scambio di criptovalute Coinbase, e sono state usate<\/a><\/noindex> per diffondere malware sulla piattaforma macOS. Si sostiene<\/a><\/noindex>, che le informazioni sulla prima vulnerabilit\u00e0 siano state inviate a Mozilla da un partecipante del progetto Google Project Zero gi\u00e0 il 15 aprile e il 10 giugno siano state \u00e8 stata corretta<\/a><\/noindex> in beta con Firefox 68 (probabilmente gli attaccanti hanno analizzato la correzione pubblicata e preparato un exploit sfruttando un'altra vulnerabilit\u00e0 per bypassare l'isolamento sandbox). <\/p>\n

<\/a><\/noindex><\/p>\n

Fonte: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0421\u043b\u0435\u0434\u043e\u043c \u0437\u0430 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u043c\u0438 Firefox 67.0.3 \u0438 60.7.1 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0440\u0435\u043b\u0438\u0437\u044b 67.0.4 \u0438 60.7.2, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432\u0442\u043e\u0440\u0430\u044f 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2019-11708), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c sandbox-\u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u044e \u0441 IPC-\u0432\u044b\u0437\u043e\u0432\u043e\u043c Prompt:Open \u0434\u043b\u044f \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u044f \u0432 \u0440\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u043c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u043d\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f sandbox, web-\u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430, \u0432\u044b\u0431\u0440\u0430\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0447\u0435\u0440\u043d\u0438\u043c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u043c. \u0412 \u0441\u043e\u0447\u0435\u0442\u0430\u043d\u0438\u0438 \u0441 \u0434\u0440\u0443\u0433\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e \u0434\u0430\u043d\u043d\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0431\u043e\u0439\u0442\u0438 \u0432\u0441\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-35502","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 In Firefox 67.0.4 e 60.7.2 \u00e8 stata risolta un'altra vulnerabilit\u00e0 0-day | ProHoster","description":"Dopo i rilasci di Firefox 67.0.3 e 60.7.1 sono state pubblicate ulteriori patch 67.0.4 e 60.7.2, in cui \u00e8 stata risolta la seconda vulnerabilit\u00e0 0-day (CVE-2019-11708), che consente di eludere il meccanismo di isolamento della sandbox. Il problema sfrutta la manipolazione della chiamata IPC Prompt:Open per aprire contenuti web selezionati dal processo figlio nel processo padre, in cui non \u00e8 applicata la sandbox. In combinazione con un'altra vulnerabilit\u00e0, questo problema consente di bypassare tutte le protezioni.","canonical_url":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/v-firefox-67-0-4-i-60-7-2-ustranena-eshhyo-odna-0-day-uyazvimost","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 Firefox 67.0.4 \u0438 60.7.2 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0435\u0449\u0451 \u043e\u0434\u043d\u0430 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c | ProHoster","og:description":"\u0421\u043b\u0435\u0434\u043e\u043c \u0437\u0430 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u043c\u0438 Firefox 67.0.3 \u0438 60.7.1 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0440\u0435\u043b\u0438\u0437\u044b 67.0.4 \u0438 60.7.2, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432\u0442\u043e\u0440\u0430\u044f 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2019-11708), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c sandbox-\u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u044e \u0441 IPC-\u0432\u044b\u0437\u043e\u0432\u043e\u043c Prompt:Open \u0434\u043b\u044f \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u044f \u0432 \u0440\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u043c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u043d\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f sandbox, web-\u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430, \u0432\u044b\u0431\u0440\u0430\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0447\u0435\u0440\u043d\u0438\u043c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u043c. \u0412 \u0441\u043e\u0447\u0435\u0442\u0430\u043d\u0438\u0438 \u0441 \u0434\u0440\u0443\u0433\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e \u0434\u0430\u043d\u043d\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0431\u043e\u0439\u0442\u0438 \u0432\u0441\u0435","og:url":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/v-firefox-67-0-4-i-60-7-2-ustranena-eshhyo-odna-0-day-uyazvimost","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:04:42+00:00","article:modified_time":"2019-10-31T19:04:42+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"35502","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 23:33:22","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:01:26","updated":"2026-01-21 23:33:22"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/35502","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=35502"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/35502\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=35502"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=35502"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=35502"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}