{"id":99784,"date":"2021-04-14T22:22:39","date_gmt":"2021-04-14T20:22:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/obnovlenie-chrome-89-0-4389-128-s-ustraneniem-0-day-uyazvimosti-chrome-90-zaderzhivaetsya"},"modified":"2021-04-14T22:22:39","modified_gmt":"2021-04-14T20:22:39","slug":"obnovlenie-chrome-89-0-4389-128-s-ustraneniem-0-day-uyazvimosti-chrome-90-zaderzhivaetsya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pl\/blog\/news\/obnovlenie-chrome-89-0-4389-128-s-ustraneniem-0-day-uyazvimosti-chrome-90-zaderzhivaetsya","title":{"rendered":"Aktualizacja Chrome 89.0.4389.128 z napraw\u0105 luki 0-day. Chrome 90 op\u00f3\u017anione.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Firma Google wprowadzi\u0142a aktualizacj\u0119 Chrome 89.0.4389.128, w kt\u00f3rej naprawiono dwie podatno\u015bci (CVE-2021-21206, CVE-2021-21220), dla kt\u00f3rych dost\u0119pne s\u0105 aktywne exploity (0-day). Podatno\u015b\u0107 CVE-2021-21220 zosta\u0142a wykorzystana do w\u0142amania do Chrome podczas konkursu Pwn2Own 2021. <\/p>\n

Eksploatacja wskazanej podatno\u015bci odbywa si\u0119 poprzez wykonanie specjalnie przygotowanego kodu WebAssembly (podatno\u015b\u0107 wynika z b\u0142\u0119du w maszynie wirtualnej WebAssembly, kt\u00f3ry pozwala na zapisanie lub odczytanie danych pod dowolnym adresem w pami\u0119ci). Zauwa\u017cono, \u017ce przedstawiony exploit nie pozwala na obej\u015bcie izolacji sandboxa i do pe\u0142nego ataku potrzebne jest wykrycie jeszcze jednej podatno\u015bci umo\u017cliwiaj\u0105cej wyj\u015bcie z sandboxa (w konkursie Pwn2Own 2021 taka podatno\u015b\u0107 zosta\u0142a zaprezentowana dla systemu Windows). <\/p>\n

Przyk\u0142ad exploita dla tego problemu zosta\u0142 opublikowany na GitHubie po wprowadzeniu poprawek do silnika V8, ale nie czekaj\u0105c na opracowanie aktualizacji przegl\u0105darek na jego podstawie (nawet gdyby exploit nie zosta\u0142 opublikowany, przest\u0119pcy zyskali mo\u017cliwo\u015b\u0107 odtworzenia go na podstawie analizy zmian w repozytorium V8, co mia\u0142o miejsce wcze\u015bniej, gdy poprawka w V8 zosta\u0142a ju\u017c opublikowana, ale produkty na jej podstawie nadal nie by\u0142y aktualizowane). <\/p>\n

Dodatkowo mo\u017cna zauwa\u017cy\u0107 przesuni\u0119cie harmonogramu publikacji wydania Chrome 90 dla system\u00f3w Linux, Windows i macOS. To wydanie by\u0142o planowane na 13 kwietnia, ale wczoraj nie zosta\u0142o opublikowane, a jedynie wydanie dla Androida. Dzi\u015b utworzono dodatkow\u0105 wersj\u0119 beta Chrome 90. Nowa data wydania nie zosta\u0142a podana.
\n
\u0179r\u00f3d\u0142o: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 Chrome 89.0.4389.128, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u044b \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2021-21206, CVE-2021-21220), \u0434\u043b\u044f \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u0440\u0430\u0431\u043e\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u044b (0-day). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2021-21220 \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0434\u043b\u044f \u0432\u0437\u043b\u043e\u043c\u0430 Chrome \u043d\u0430 \u0441\u043e\u0440\u0435\u0432\u043d\u043e\u0432\u0430\u043d\u0438\u0438 Pwn2Own 2021. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 WebAssembly (\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043e\u0448\u0438\u0431\u043a\u043e\u0439 \u0432 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0439 \u043c\u0430\u0448\u0438\u043d\u0435 WebAssembly, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0437\u0430\u043f\u0438\u0441\u0430\u0442\u044c \u0438\u043b\u0438 \u043f\u0440\u043e\u0447\u0438\u0442\u0430\u0442\u044c \u0434\u0430\u043d\u043d\u044b\u0435 \u043f\u043e \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u043c\u0443 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-99784","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Aktualizacja Chrome 89.0.4389.128 z poprawk\u0105 na luk\u0119 0-day. Chrome 90 op\u00f3\u017anione | ProHoster","description":"Firma Google wyda\u0142a aktualizacj\u0119 Chrome 89.0.4389.128, w kt\u00f3rej naprawiono dwie podatno\u015bci (CVE-2021-21206, CVE-2021-21220), dla kt\u00f3rych dost\u0119pne s\u0105 dzia\u0142aj\u0105ce exploity (0-day).","canonical_url":"https:\/\/prohoster.info\/pl\/blog\/news\/obnovlenie-chrome-89-0-4389-128-s-ustraneniem-0-day-uyazvimosti-chrome-90-zaderzhivaetsya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pl_PL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 Chrome 89.0.4389.128 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438. Chrome 90 \u0437\u0430\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442\u0441\u044f | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 Chrome 89.0.4389.128, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u044b \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2021-21206, CVE-2021-21220), \u0434\u043b\u044f \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u0440\u0430\u0431\u043e\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u044b (0-day).","og:url":"https:\/\/prohoster.info\/pl\/blog\/news\/obnovlenie-chrome-89-0-4389-128-s-ustraneniem-0-day-uyazvimosti-chrome-90-zaderzhivaetsya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-04-14T20:22:39+00:00","article:modified_time":"2021-04-14T20:22:39+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"99784","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-04-14 20:33:38","updated":"2022-10-02 17:16:28","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/99784","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/comments?post=99784"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/99784\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media?parent=99784"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/categories?post=99784"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/tags?post=99784"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}