{"id":113095,"date":"2024-01-24T11:28:09","date_gmt":"2024-01-24T09:28:09","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-utilite-gnu-split-privodyashhaya-k-perepolneniyu-bufera"},"modified":"2024-01-24T11:28:09","modified_gmt":"2024-01-24T09:28:09","slug":"uyazvimost-v-utilite-gnu-split-privodyashhaya-k-perepolneniyu-bufera","status":"publish","type":"post","link":"https:\/\/prohoster.info\/lv\/blog\/news\/uyazvimost-v-utilite-gnu-split-privodyashhaya-k-perepolneniyu-bufera","title":{"rendered":"Vulnerability in the GNU split utility, leading to buffer overflow.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
GNU coreutils izsniegtaj\u0101 r\u012bka split, kas tiek izmantots lielu failu dal\u012b\u0161anai da\u013c\u0101s, ir atkl\u0101ta ievainojam\u012bba (CVE-2024-0684), kas izraisa bufera p\u0101rpl\u016bdi apstr\u0101d\u0101jot garas rindas (da\u017eas simti baitu), ja tiek izmantota opcija «—line-bytes» («-C»). Ievainojam\u012bba tika atkl\u0101ta anal\u012bzes proces\u0101, kas tika veikts, p\u0113t\u012bjot k\u013c\u016bmes, kas notiek, izmantojot r\u012bku split, lai dal\u012btu datus, kas tiek p\u0101rs\u016bt\u012bti, izmantojot QR kodus. <\/p>\n
Ievainojam\u012bba ir radusies k\u013c\u016bdas d\u0113\u013c, kas tika pie\u013cauta coreutils 7.2 publik\u0101cij\u0101, aizst\u0101jot xrealloc funkcijas izsaukumu ar xpalloc. Labojuma pl\u0101ksteris jau ir pie\u0146emts koda b\u0101z\u0113, ta\u010du jaun\u0101 versija ar labojumiem v\u0113l nav izveidota. Lai demonstr\u0113tu ievainojam\u012bbas izpausmes, ir public\u0113ts piem\u0113ra fails, kas izraisa p\u0101rpl\u016bdi, palai\u017eot «split -C 1024 .\\\/split_me». \n Avots: opennet.lv<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"