{"id":101354,"date":"2021-09-21T10:22:45","date_gmt":"2021-09-21T08:22:45","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-openoffice-pozvolyayushhaya-vypolnit-kod-pri-otkrytii-fajla"},"modified":"2021-09-21T10:22:45","modified_gmt":"2021-09-21T08:22:45","slug":"uyazvimost-v-openoffice-pozvolyayushhaya-vypolnit-kod-pri-otkrytii-fajla","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-openoffice-pozvolyayushhaya-vypolnit-kod-pri-otkrytii-fajla","title":{"rendered":"O vulnerabilitate \u00een OpenOffice, care permite executarea codului la deschiderea unui fi\u0219ier","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00cen pachetul de birou Apache OpenOffice a fost identificat\u0103 o vulnerabilitate (CVE-2021-33035), care permite executarea codului la deschiderea unui fi\u0219ier DBF special conceput. Cercet\u0103torul care a descoperit problema a avertizat cu privire la crearea unui exploit func\u021bional pentru platforma Windows. Corectarea vulnerabilit\u0103\u021bii este disponibil\u0103 momentan doar sub form\u0103 de patch \u00een depozitul proiectului, inclus inclus \u00een versiunile test ale OpenOffice 4.1.11. \u00cembun\u0103t\u0103\u021birile pentru ramura stabil\u0103 \u00eenc\u0103 nu sunt disponibile. <\/p>\n

Problema a fost cauzat\u0103 de faptul c\u0103, la alocarea memoriei, OpenOffice s-a bazat pe valorile fieldLength \u0219i fieldType din antetul fi\u0219ierelor DBF, f\u0103r\u0103 a verifica conformitatea cu tipul real de date din c\u00e2mpuri. Pentru a efectua un atac, se poate specifica \u00een valoarea fieldType tipul INTEGER, dar se pot plasa date de o dimensiune mai mare \u0219i se poate specifica o valoare fieldLength care nu corespunde dimensiunii datelor cu tipul INTEGER, ceea ce va duce la scrierea restului datelor din c\u00e2mp dincolo de bufferul alocat. Ca rezultat al unei supraaglomer\u0103ri controlate a bufferului, cercet\u0103torul a reu\u0219it s\u0103 redefineasc\u0103 pointerul de returnare din func\u021bie \u0219i, cu ajutorul tehnicilor de programare orientate pe returnare (ROP - Return-Oriented Programming), s\u0103 execute propriul cod. <\/p>\n

Atunci c\u00e2nd folose\u0219te tehnica ROP, atacatorul nu \u00eencearc\u0103 s\u0103 plaseze propriul cod \u00een memorie, ci opereaz\u0103 cu buc\u0103\u021bile de instruc\u021biuni de ma\u0219in\u0103 deja existente \u00een bibliotecile \u00eenc\u0103rcate, care se finalizeaz\u0103 cu instruc\u021biunea de returnare a controlului (de obicei, sf\u00e2r\u0219itul func\u021biilor din bibliotec\u0103). Func\u021bionarea exploit-ului const\u0103 \u00een construirea unei serii de apeluri c\u0103tre astfel de blocuri (\u201egadgeturi\u201d) pentru a ob\u021bine func\u021bionalitatea dorit\u0103. Ca gadgeturi, exploit-ul pentru OpenOffice a folosit cod din biblioteca libxml2 utilizat\u0103 \u00een OpenOffice, care, spre deosebire de OpenOffice, s-a dovedit a fi compilat\u0103 f\u0103r\u0103 mecanismele de protec\u021bie DEP (Data Execution Prevention) \u0219i ASLR (Address Space Layout Randomization). <\/p>\n

Dezvoltatorii OpenOffice au fost informa\u021bi despre problem\u0103 pe 4 mai, dup\u0103 care s-a stabilit o divulgare public\u0103 a detaliilor despre vulnerabilitate pe 30 august. Deoarece p\u00e2n\u0103 la termenul stabilit nu a fost formulat\u0103 actualizarea ramurii stabile, cercet\u0103torul a mutat divulgarea detaliilor pe 18 septembrie, dar dezvoltatorii OpenOffice nu au reu\u0219it s\u0103 finalizeze lansarea 4.1.11 p\u00e2n\u0103 la acel termen. Este remarcabil faptul c\u0103, \u00een cadrul acelea\u0219i cercet\u0103ri, a fost identificat\u0103 o vulnerabilitate similar\u0103 \u00een codul de suport pentru formatul DBF din Microsoft Office Access (CVE-2021\u201338646), detaliile c\u0103reia vor fi divulgate ulterior. \u00cen LibreOffice nu au fost g\u0103site probleme.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043e\u0444\u0438\u0441\u043d\u043e\u043c \u043f\u0430\u043a\u0435\u0442\u0435 Apache OpenOffice \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-33035), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 DBF. \u0412\u044b\u044f\u0432\u0438\u0432\u0448\u0438\u0439 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b \u043e \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0438 \u0440\u0430\u0431\u043e\u0447\u0435\u0433\u043e \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430 \u0434\u043b\u044f \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Windows. \u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u043a\u0430 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0444\u043e\u0440\u043c\u0435 \u043f\u0430\u0442\u0447\u0430 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432\u043e\u0448\u0451\u043b \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 \u0442\u0435\u0441\u0442\u043e\u0432\u044b\u0445 \u0441\u0431\u043e\u0440\u043e\u043a OpenOffice 4.1.11. \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 \u043f\u043e\u043a\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101354","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitate \u00een OpenOffice care permite executarea de cod prin deschiderea unui fi\u0219ier | ProHoster","description":"O vulnerabilitate a fost identificat\u0103 \u00een pachetul de birou Apache OpenOffice (CVE-2021-33035), care permite execu\u021bia de cod prin deschiderea unui fi\u0219ier special formatat \u00een DBF.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-openoffice-pozvolyayushhaya-vypolnit-kod-pri-otkrytii-fajla","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 OpenOffice, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438 \u0444\u0430\u0439\u043b\u0430 | ProHoster","og:description":"\u0412 \u043e\u0444\u0438\u0441\u043d\u043e\u043c \u043f\u0430\u043a\u0435\u0442\u0435 Apache OpenOffice \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-33035), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 DBF.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-openoffice-pozvolyayushhaya-vypolnit-kod-pri-otkrytii-fajla","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-09-21T08:22:45+00:00","article:modified_time":"2021-09-21T08:22:45+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101354","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-09-21 08:27:59","updated":"2022-10-03 20:50:17","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/101354","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=101354"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/101354\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=101354"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=101354"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=101354"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}