{"id":41185,"date":"2020-02-06T14:41:55","date_gmt":"2020-02-06T11:41:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/openwrt-19-07-1"},"modified":"2020-02-06T14:41:55","modified_gmt":"2020-02-06T11:41:55","slug":"openwrt-19-07-1","status":"publish","type":"post","link":"https:\/\/prohoster.info\/lv\/blog\/openwrt-19-07-1","title":{"rendered":"OpenWrt 19.07.1","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"


\n \"OpenWrt<\/p>\n

<\/a><\/p>\n

<\/p>\n

Izlaistas OpenWrt izplat\u012b\u0161anas versijas 18.06.7<\/a> un 19.07.1<\/a>, kur\u0101s ir labota vulnerability<\/a> CVE-2020-7982 opkg pakot\u0146u p\u0101rvaldniek\u0101, ar kura pal\u012bdz\u012bbu bija iesp\u0113jams veikt MITM uzbrukumu un nomain\u012bt lejupiel\u0101d\u0113jamo pakotni no repozitorija. K\u013c\u016bdas d\u0113\u013c kontrolsummas p\u0101rbaud\u0113 uzbruc\u0113js var\u0113ja ignor\u0113t SHA-256 kontrolsummas no pakotnes, kas \u013c\u0101va apiet aug\u0161upiel\u0101d\u0113to ipk resursu integrit\u0101tes p\u0101rbaudes meh\u0101nismus.<\/p>\n

<\/noindex><\/p>\n

Probl\u0113ma past\u0101v kop\u0161 2017. gada febru\u0101ra, kad tika pievienots kods, lai ignor\u0113tu s\u0101kuma atstarpes, kas iet pirms kontrolsummas. K\u013c\u016bdas d\u0113\u013c, izlaizot atstarpes, r\u0101d\u012bt\u0101js netika p\u0101rvietots uz poz\u012bciju rind\u0101 un SHA-256 heksadecim\u0101l\u0101s sec\u012bbas dekod\u0113\u0161anas cikls uzreiz atgrieza kontroli, atdodot kontrolsummu nulles garum\u0101.<\/p>\n

T\u0101 k\u0101 opkg pakot\u0146u mened\u017eeris tika palaists ar root privil\u0113\u0123ij\u0101m, uzbruc\u0113js var\u0113ja main\u012bt IPK pakotnes saturu MITM uzbrukuma laik\u0101, to iel\u0101d\u0113jot no repozitorija, kad lietot\u0101js izpild\u012bja komandu «opkg install», un veikt savu kodu ar root privil\u0113\u0123ij\u0101m, pievienojot pakotnei savus apstr\u0101des skriptus, kas tiek izsaukti instal\u0101cijas laik\u0101. Lai izmantotu \u0161o ievainojam\u012bbu, uzbruc\u0113jam ar\u012b j\u0101maina pakot\u0146u indekss (piem\u0113ram, tas, kas n\u0101k no downloads.openwrt.org). Main\u012bt\u0101s pakotnes izm\u0113ram j\u0101atbilst s\u0101kotn\u0113jam izm\u0113ram no indeksa.<\/p>\n

Jaunaj\u0101s versij\u0101s ir nov\u0113rsta v\u0113l viena vulnerability<\/a> libubox bibliot\u0113k\u0101, kas var izrais\u012bt bufera p\u0101rpl\u016bdi, apstr\u0101d\u0101jot blobmsg_format_json funkcij\u0101 \u012bpa\u0161i format\u0113tus serializ\u0113tus bin\u0101ros datus vai datus JSON form\u0101t\u0101. <\/p>\n

<\/noindex><\/noindex><\/p>\n

Avots: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412\u044b\u043f\u0443\u0449\u0435\u043d\u044b \u0432\u0435\u0440\u0441\u0438\u0438 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430 OpenWrt 18.06.7 \u0438 19.07.1, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2020-7982 \u0432 \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0435 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 opkg, \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043c\u043e\u0436\u043d\u043e \u0431\u044b\u043b\u043e \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0442\u044c MITM-\u0430\u0442\u0430\u043a\u0443 \u0438 \u0437\u0430\u043c\u0435\u043d\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u043c\u043e\u0433\u043e \u0438\u0437 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u0430. \u0418\u0437-\u0437\u0430 \u043e\u0448\u0438\u0431\u043a\u0438 \u0432 \u043a\u043e\u0434\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u043d\u044b\u0445 \u0441\u0443\u043c\u043c, \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043c\u043e\u0433 \u043f\u0440\u043e\u0438\u0433\u043d\u043e\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u043d\u044b\u0435 \u0441\u0443\u043c\u043c\u044b SHA-256 \u0438\u0437 \u043f\u0430\u043a\u0435\u0442\u0430, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u043e \u043e\u0431\u043e\u0439\u0442\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u044b \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u043c\u044b\u0445 ipk-\u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":41186,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-41185","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47OpenWrt 19.07.1 | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/lv\/blog\/openwrt-19-07-1","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"lv_LV","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47OpenWrt 19.07.1 | ProHoster","og:url":"https:\/\/prohoster.info\/lv\/blog\/openwrt-19-07-1","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-06T11:41:55+00:00","article:modified_time":"2020-02-06T11:41:55+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"41185","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 00:23:10","updated":"2022-09-27 20:14:10","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/41185","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/comments?post=41185"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/41185\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/media\/41186"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/media?parent=41185"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/categories?post=41185"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/tags?post=41185"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}