{"id":41185,"date":"2020-02-06T14:41:55","date_gmt":"2020-02-06T11:41:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/openwrt-19-07-1"},"modified":"2020-02-06T14:41:55","modified_gmt":"2020-02-06T11:41:55","slug":"openwrt-19-07-1","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/openwrt-19-07-1","title":{"rendered":"OpenWrt 19.07.1","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"


\n \"OpenWrt<\/p>\n

<\/a><\/p>\n

<\/p>\n

Le versioni del pacchetto OpenWrt sono state rilasciate 18.06.7<\/a> e 19.07.1<\/a>, in cui \u00e8 stato corretto una vulnerabilit\u00e0<\/a> il CVE-2020-7982 nel gestore dei pacchetti opkg, che permetteva di effettuare un attacco MITM e sostituire il contenuto di un pacchetto scaricato dal repository. A causa di un errore nel codice di verifica dei checksum, l'attaccante poteva ignorare i checksum SHA-256 del pacchetto, eludendo cos\u00ec i meccanismi di controllo dell'integrit\u00e0 delle risorse ipk scaricate.<\/p>\n

<\/noindex><\/p>\n

Il problema esiste dall'aprile 2017, dopo che \u00e8 stato aggiunto il codice per ignorare gli spazi iniziali prima del checksum. A causa di un errore nel salto degli spazi, il puntatore non si spostava nella posizione corretta nella stringa e il ciclo di decodifica della sequenza esadecimale SHA-256 restituiva immediatamente il controllo con un checksum di lunghezza zero.<\/p>\n

Poich\u00e9 il gestore di pacchetti opkg veniva eseguito come root, un attaccante poteva modificare il contenuto di un pacchetto ipk durante un attacco MITM mentre veniva scaricato dal repository durante l'esecuzione del comando «opkg install» da parte dell'utente, riuscendo a far eseguire il proprio codice con diritti di root mediante l'aggiunta di propri script di gestione nel pacchetto, invocati all'installazione. Per sfruttare la vulnerabilit\u00e0, l'attaccante doveva anche sostituire l'indice dei pacchetti (ad esempio, quello fornito da downloads.openwrt.org). La dimensione del pacchetto modificato doveva corrispondere a quella originale, secondo l'indice.<\/p>\n

Nelle nuove versioni \u00e8 stata corretta anche un'altra una vulnerabilit\u00e0<\/a> nella libreria libubox, che pu\u00f2 portare a un overflow del buffer durante l'elaborazione nella funzione blobmsg_format_json di dati binari serializzati formattati in modo specifico o dati in formato JSON. <\/p>\n

<\/noindex><\/noindex><\/p>\n

Fonte: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412\u044b\u043f\u0443\u0449\u0435\u043d\u044b \u0432\u0435\u0440\u0441\u0438\u0438 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430 OpenWrt 18.06.7 \u0438 19.07.1, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2020-7982 \u0432 \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0435 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 opkg, \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043c\u043e\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0442\u044c MITM-\u0430\u0442\u0430\u043a\u0443 \u0438 \u0437\u0430\u043c\u0435\u043d\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u043c\u043e\u0433\u043e \u0438\u0437 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u0430. \u0418\u0437-\u0437\u0430 \u043e\u0448\u0438\u0431\u043a\u0438 \u0432 \u043a\u043e\u0434\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u043d\u044b\u0445 \u0441\u0443\u043c\u043c, \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043c\u043e\u0433 \u043f\u0440\u043e\u0438\u0433\u043d\u043e\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u043d\u044b\u0435 \u0441\u0443\u043c\u043c\u044b SHA-256 \u0438\u0437 \u043f\u0430\u043a\u0435\u0442\u0430, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u043e \u043e\u0431\u043e\u0439\u0442\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u044b \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u043c\u044b\u0445 ipk-\u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":41186,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-41185","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47OpenWrt 19.07.1 | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/it\/blog\/openwrt-19-07-1","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47OpenWrt 19.07.1 | ProHoster","og:url":"https:\/\/prohoster.info\/it\/blog\/openwrt-19-07-1","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-06T11:41:55+00:00","article:modified_time":"2020-02-06T11:41:55+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"41185","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 00:23:10","updated":"2022-09-27 20:14:10","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/41185","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=41185"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/41185\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media\/41186"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=41185"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=41185"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=41185"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}