{"id":115207,"date":"2024-04-21T02:30:03","date_gmt":"2024-04-21T00:30:03","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-glibc-ekspluatiruemaya-cherez-skripty-na-php"},"modified":"2024-04-21T02:30:03","modified_gmt":"2024-04-21T00:30:03","slug":"uyazvimost-v-glibc-ekspluatiruemaya-cherez-skripty-na-php","status":"publish","type":"post","link":"https:\/\/prohoster.info\/lv\/blog\/news\/uyazvimost-v-glibc-ekspluatiruemaya-cherez-skripty-na-php","title":{"rendered":"Vulnerability in Glibc, exploited through PHP scripts","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Standarta C bibliot\u0113k\u0101 Glibc tika atkl\u0101ta ievainojam\u012bba (CVE-2024-2961), kas izraisa bufera p\u0101rpildi, p\u0101rveidojot \u012bpa\u0161i noform\u0113tus tekstus ISO-2022-CN-EXT kod\u0113jum\u0101 ar funkciju iconv(). Probl\u0113mas atkl\u0101j\u0113js pl\u0101no 10. maij\u0101 uzst\u0101ties konferenc\u0113 OffensiveCon ar zi\u0146ojumu, kur\u0101 min\u0113ta iesp\u0113ja izmantot ievainojam\u012bbu PHP valod\u0101 rakst\u012btu lietojumprogrammu kontekst\u0101. Tiek apgalvots, ka \u0161\u012b probl\u0113ma skar visu PHP ekosist\u0113mu un da\u017eas lietojumprogrammas. <\/p>\n

UCS4 kod\u0113juma virk\u0146u p\u0101rv\u0113r\u0161anas proces\u0101, saska\u0146\u0101 ar RFC 1922 pras\u012bb\u0101m, bibliot\u0113ka pievieno da\u017eus escape simbolus, kuri izce\u013c virknes da\u013cas, kur\u0101s kod\u0113jums ir main\u012bts. Vainojam\u012bba rodas nepareizas iek\u0161\u0113jo buferu robe\u017eu p\u0101rbaudes d\u0113\u013c funkcij\u0101 iconv(), kas var rad\u012bt bufera p\u0101rpild\u012b\u0161anos l\u012bdz 4 baitiem. Bufera robe\u017eas p\u0101rk\u0101puma laik\u0101 var tikt ierakst\u012btas noteiktas fiks\u0113tas v\u0113rt\u012bbas, piem\u0113ram, ‘$+I’, ‘$+J’, ‘$+K’, ‘$+L’, ‘$+M’ un ‘$*H’. Lai gan \u0161\u0101das v\u0101jin\u0101\u0161anas izmanto\u0161ana koda izpildei \u0161\u0137iet maz ticama, atkl\u0101j\u0113ju p\u0113tnieka pazi\u0146ojums liecina, ka tas ir bijis pietiekami, lai sagatavotu vair\u0101kus prototipus exploitiem, kuri paredz att\u0101lin\u0101tus uzbrukumus PHP lietojumprogramm\u0101m, izraisot koda izpildi. <\/p>\n

Ievainojam\u012bba izpau\u017eas kop\u0161 2000. gada un ir nov\u0113rsta izstr\u0101d\u0113 eso\u0161aj\u0101 Glibc 2.40 versij\u0101. Labojums ar\u012b pieejams k\u0101 pl\u0101ksteri Glibc izlaidumiem no 2.32 l\u012bdz 2.39. Izplat\u012bjumos var sekot ievainojam\u012bbas labojumiem lap\u0101s: Debian, Ubuntu, Gentoo, RHEL, SUSE, Fedora, Arch.
\n
Avots: opennet.lv<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u0439 \u0421\u0438-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 Glibc \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-2961), \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u0431\u0443\u0444\u0435\u0440\u0430 \u043f\u0440\u0438 \u043f\u0440\u0435\u043e\u0431\u0440\u0430\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u0441\u0442\u0440\u043e\u043a \u0432 \u043a\u043e\u0434\u0438\u0440\u043e\u0432\u043a\u0435 ISO-2022-CN-EXT \u0444\u0443\u043d\u043a\u0446\u0438\u0435\u0439 iconv(). \u0412\u044b\u044f\u0432\u0438\u0432\u0448\u0438\u0439 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043f\u043b\u0430\u043d\u0438\u0440\u0443\u0435\u0442 10 \u043c\u0430\u044f \u0432\u044b\u0441\u0442\u0443\u043f\u0438\u0442\u044c \u043d\u0430 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 OffensiveCon \u0441 \u0434\u043e\u043a\u043b\u0430\u0434\u043e\u043c, \u0432 \u0430\u043d\u043e\u043d\u0441\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0443\u043f\u043e\u043c\u0438\u043d\u0430\u0435\u0442\u0441\u044f \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0447\u0435\u0440\u0435\u0437 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 PHP. \u0417\u0430\u044f\u0432\u043b\u0435\u043d\u043e, \u0447\u0442\u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0432\u0441\u044e \u044d\u043a\u043e\u0441\u0438\u0441\u0442\u0435\u043c\u0443 PHP \u0438 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-115207","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ievainojam\u012bba Glibc, ko izmanto, izmantojot PHP skriptus | ProHoster","description":"Standarta C bibliot\u0113k\u0101 Glibc tika atkl\u0101ta ievainojam\u012bba (CVE-2024-2961), kas izraisa bufera p\u0101rpildi, p\u0101rveidojot \u012bpa\u0161i noform\u0113tus tekstus ISO-2022-CN-EXT kod\u0113jum\u0101 ar funkciju iconv().","canonical_url":"https:\/\/prohoster.info\/lv\/blog\/news\/uyazvimost-v-glibc-ekspluatiruemaya-cherez-skripty-na-php","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"lv_LV","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Glibc, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0430\u044f \u0447\u0435\u0440\u0435\u0437 \u0441\u043a\u0440\u0438\u043f\u0442\u044b \u043d\u0430 PHP | ProHoster","og:description":"\u0412 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u0439 \u0421\u0438-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 Glibc \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-2961), \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u0431\u0443\u0444\u0435\u0440\u0430 \u043f\u0440\u0438 \u043f\u0440\u0435\u043e\u0431\u0440\u0430\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u0441\u0442\u0440\u043e\u043a \u0432 \u043a\u043e\u0434\u0438\u0440\u043e\u0432\u043a\u0435 ISO-2022-CN-EXT \u0444\u0443\u043d\u043a\u0446\u0438\u0435\u0439 iconv().","og:url":"https:\/\/prohoster.info\/lv\/blog\/news\/uyazvimost-v-glibc-ekspluatiruemaya-cherez-skripty-na-php","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-04-21T00:30:03+00:00","article:modified_time":"2024-04-21T00:30:03+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"115207","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 22:47:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-22 22:47:20","updated":"2026-01-22 22:47:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/115207","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/comments?post=115207"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/115207\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/media?parent=115207"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/categories?post=115207"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/tags?post=115207"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}