Lachisanu, Epulo 12, katswiri wachitetezo wazidziwitso a John Page adafalitsa zambiri za kusatetezeka kosasinthika mu mtundu waposachedwa wa Internet Explorer, ndikuwonetsanso kukhazikitsidwa kwake. Chiwopsezo ichi chikhoza kulola wowukira kuti apeze zomwe zili m'mafayilo am'deralo a ogwiritsa ntchito Windows, kudutsa chitetezo cha msakatuli.
Chiwopsezo chagona momwe Internet Explorer imasamalirira mafayilo a MHTML, makamaka omwe ali ndi .mht kapena .mhtml extension. Mtunduwu umagwiritsidwa ntchito ndi Internet Explorer mwachisawawa posunga masamba, ndipo umakupatsani mwayi wosunga zonse zomwe zili patsambalo limodzi ndi zofalitsa zonse ngati fayilo imodzi. Pakadali pano, asakatuli ambiri amakono sasunganso masamba amtundu wa MHT ndikugwiritsa ntchito mtundu wa WEB wokhazikika - HTML, komabe amathandizira kukonza mafayilo mwanjira iyi, ndipo amathanso kuzigwiritsa ntchito posunga ndi zoikamo zoyenera kapena kugwiritsa ntchito zowonjezera.
Kusatetezeka komwe kunapezedwa ndi John kuli m'gulu la XXE (XML eXternal Entity) losatetezeka ndipo lili ndi masinthidwe olakwika a XML code handler mu Internet Explorer. "Kusatetezeka kumeneku kumapangitsa kuti woukira wakutali azitha kupeza mafayilo am'deralo ndipo, mwachitsanzo, amachotsa zambiri zamapulogalamu omwe adayikidwa pakompyuta," akutero Page. "Chotero funso la 'c:Python27NEWS.txt' libweza mtundu wa pulogalamuyo (wotanthauzira Python pankhaniyi)."
Popeza mu Windows mafayilo onse a MHT amatsegulidwa mu Internet Explorer mwachisawawa, kugwiritsa ntchito chiwopsezo ichi ndi ntchito yaing'ono chifukwa wogwiritsa ntchito amangodina kawiri pa fayilo yowopsa yolandilidwa ndi imelo, malo ochezera a pa Intaneti kapena ma messenger apompopompo.
"Kawirikawiri, popanga chitsanzo cha chinthu cha ActiveX, monga Microsoft.XMLHTTP, wogwiritsa ntchito adzalandira chenjezo la chitetezo mu Internet Explorer lomwe lidzapempha chitsimikiziro kuti atsegule zomwe zatsekedwa," akufotokoza wofufuzayo. "Komabe, potsegula fayilo ya .mht yokonzedweratu pogwiritsa ntchito ma tag olembedwa mwapadera wogwiritsa sadzalandira machenjezo okhudza zinthu zomwe zingawononge."
Malinga ndi Tsamba, adayesa bwino kusatetezeka kwa msakatuli waposachedwa wa Internet Explorer 11 ndi zosintha zaposachedwa kwambiri zachitetezo Windows 7, Windows 10 ndi Windows Server 2012 R2.
Mwina nkhani yabwino yokhayo pakuwululidwa kwa anthu pachiwopsezochi ndikuti msika womwe udali waukulu kwambiri wa Internet Explorer tsopano watsika mpaka 7,34%, malinga ndi NetMarketShare. Koma popeza Windows imagwiritsa ntchito Internet Explorer ngati pulogalamu yosasinthika kuti atsegule mafayilo a MHT, ogwiritsa ntchito safunika kukhazikitsa IE ngati msakatuli wawo wokhazikika, ndipo amakhala pachiwopsezo malinga ngati IE ikadalipo pamakina awo ndipo salipira. samalani ndi mafayilo otsitsa pa intaneti.
Kubwerera pa Marichi 27, John adadziwitsa Microsoft za chiwopsezo ichi mu msakatuli wawo, koma pa Epulo 10, wofufuzayo adalandira yankho kuchokera ku kampaniyo, pomwe idawonetsa kuti silinawone vutoli kukhala lovuta.
"Kukonzekera kumangotulutsidwa ndi mtundu wotsatira wa chinthucho," Microsoft idatero m'kalatayo. "Pakali pano tilibe malingaliro otulutsa yankho pankhaniyi."
Pambuyo poyankhidwa momveka bwino kuchokera ku Microsoft, wofufuzayo adafalitsa tsatanetsatane wa chiwopsezo cha tsiku la zero patsamba lake, komanso nambala yachiwonetsero ndi kanema pa YouTube.
Ngakhale kukhazikitsidwa kwa chiwopsezochi sikophweka ndipo kumafuna kukakamiza wogwiritsa ntchito fayilo yosadziwika ya MHT, kusatetezeka kumeneku sikuyenera kutengedwa mopepuka ngakhale kuti Microsoft sanayankhe. Magulu a hacker adagwiritsa ntchito mafayilo a MHT pofalitsa zachinyengo ndi pulogalamu yaumbanda m'mbuyomu, ndipo palibe chomwe chingawaletse kuchita izi tsopano.
Komabe, kuti mupewe izi ndi zovuta zambiri zofananira, muyenera kungoyang'ana pakukulitsa mafayilo omwe mumalandira kuchokera pa intaneti ndikuwunika ndi antivayirasi kapena patsamba la VirusTotal. Ndipo pofuna chitetezo chowonjezera, ingoikani msakatuli wanu womwe mumakonda kusiyapo Internet Explorer ngati pulogalamu yokhazikika yamafayilo a .mht kapena .mhtml. Mwachitsanzo, mu Windows 10 izi zimachitika mosavuta mu "Sankhani mapulogalamu okhazikika amitundu yamafayilo".
Source: 3dnews.ru