{"id":103636,"date":"2022-03-27T15:36:39","date_gmt":"2022-03-27T13:36:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-zlib-proyavlyayushhayasya-pri-szhatii-speczialno-oformlennyh-dannyh"},"modified":"2022-03-27T15:36:39","modified_gmt":"2022-03-27T13:36:39","slug":"uyazvimost-v-zlib-proyavlyayushhayasya-pri-szhatii-speczialno-oformlennyh-dannyh","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-zlib-proyavlyayushhayasya-pri-szhatii-speczialno-oformlennyh-dannyh","title":{"rendered":"O vulnerabilitate \u00een zlib, care apare la comprimarea datelor special formatate","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

O bibliotec\u0103 zlib a identificat o vulnerabilitate (CVE-2018-25032) care poate provoca o suprasarcin\u0103 a buffer-ului atunci c\u00e2nd se \u00eencearc\u0103 comprimarea unei secven\u021be de caractere special preg\u0103tite \u00een datele de intrare. \u00cen starea actual\u0103, cercet\u0103torii au demonstrat posibilitatea de a provoca o eroare fatidic\u0103 a procesului. Impactul mai grav al problemei nu a fost \u00eenc\u0103 studiat. <\/p>\n

Vulnerabilitatea se manifest\u0103 \u00eencep\u00e2nd cu versiunea zlib 1.2.2.2 \u0219i afecteaz\u0103 inclusiv versiunea actual\u0103 zlib 1.2.11. Este notabil c\u0103 un patch pentru remedierea vulnerabilit\u0103\u021bii a fost propus \u00eenc\u0103 din 2018, dar dezvoltatorii nu i-au acordat aten\u021bie \u0219i nu au lansat o versiune corectiv\u0103 (biblioteca zlib a fost actualizat\u0103 ultima dat\u0103 \u00een 2017). Remedierea nu a fost deocamdat\u0103 inclus\u0103 nici \u00een pachetele oferite de distribu\u021bii. Monitorizarea public\u0103rii remediilor de c\u0103tre distribu\u021bii se poate face pe aceste pagini: Debian, RHEL, Fedora, SUSE, Ubuntu, Arch Linux, OpenBSD, FreeBSD, NetBSD. Biblioteca zlib-ng nu este afectat\u0103 de aceast\u0103 problem\u0103. <\/p>\n

Vulnerabilitatea se manifest\u0103 atunci c\u00e2nd \u00een fluxul de intrare sunt \u00eent\u00e2lnite un num\u0103r mare de coincidences ce trebuie ambalate, la care se aplic\u0103 ambalarea bazat\u0103 pe coduri Huffman fixe. \u00cen anumite circumstan\u021be, con\u021binutul buffer-ului intermediar, \u00een care se plaseaz\u0103 rezultatul comprimat, poate suprapune memoria \u00een care este stocat\u0103 tabela de frecven\u021b\u0103 a caracterelor. Ca urmare, se observ\u0103 formarea unor date comprimate incorecte \u0219i o eroare datorat\u0103 scrierii dincolo de limita buffer-ului. <\/p>\n

Vulnerabilitatea poate fi exploatat\u0103 doar folosind o strategie de comprimare bazat\u0103 pe coduri Huffman fixe. O astfel de strategie este aleas\u0103 prin activarea explicit\u0103 \u00een cod a op\u021biunii Z_FIXED (exemplu de secven\u021b\u0103 care duce la eroare atunci c\u00e2nd se folose\u0219te op\u021biunea Z_FIXED). Conform codului, strategia Z_FIXED poate fi de asemenea aleas\u0103 automat, dac\u0103 arborii optimali \u0219i statici calcula\u021bi pentru date au aceea\u0219i dimensiune. <\/p>\n

\u00cenc\u0103 nu este clar dac\u0103 pot fi stabilite condi\u021bii pentru exploatarea vulnerabilit\u0103\u021bii utiliz\u00e2nd strategia de comprimare Z_DEFAULT_STRATEGY, aplicat\u0103 \u00een mod implicit. Dac\u0103 nu, vulnerabilitatea va fi limitat\u0103 la anumite sisteme specifice \u00een care op\u021biunea Z_FIXED este aplicat\u0103 explicit. Dac\u0103 da, daunele cauzate de vulnerabilitate pot fi foarte semnificative, deoarece biblioteca zlib este standardul de facto \u0219i este utilizat\u0103 \u00een multe proiecte populare, inclusiv nucleul Linux, OpenSSH, OpenSSL, apache httpd, libpng, FFmpeg, rsync, dpkg, rpm, Git, PostgreSQL, MySQL etc.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 zlib \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2018-25032), \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u0431\u0443\u0444\u0435\u0440\u0430 \u043f\u0440\u0438 \u043f\u043e\u043f\u044b\u0442\u043a\u0435 \u0441\u0436\u0430\u0442\u0438\u044f \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432 \u0432\u043e \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0445 \u0434\u0430\u043d\u043d\u044b\u0445. \u0412 \u0442\u0435\u043a\u0443\u0449\u0435\u043c \u0432\u0438\u0434\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0432\u044b\u0437\u043e\u0432\u0430 \u0430\u0432\u0430\u0440\u0438\u0439\u043d\u043e\u0433\u043e \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430. \u041c\u043e\u0436\u0435\u0442 \u043b\u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0438\u043c\u0435\u0442\u044c \u0431\u043e\u043b\u0435\u0435 \u0441\u0435\u0440\u044c\u0451\u0437\u043d\u044b\u0435 \u043f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u0435\u0449\u0451 \u043d\u0435 \u0438\u0437\u0443\u0447\u0435\u043d\u043e. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u0435\u0440\u0441\u0438\u0438 zlib 1.2.2.2 \u0438 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0439 \u0432\u044b\u043f\u0443\u0441\u043a zlib […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-103636","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitate \u00een zlib, manifestat\u0103 la comprimarea datelor special formulate | ProHoster","description":"O vulnerabilitate a fost descoperit\u0103 \u00een biblioteca zlib (CVE-2018-25032), care duce la o dep\u0103\u0219ire a buffer-ului \u00een \u00eencercarea de a comprima o secven\u021b\u0103 de caractere preg\u0103tit\u0103 special \u00een datele de intrare.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-zlib-proyavlyayushhayasya-pri-szhatii-speczialno-oformlennyh-dannyh","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 zlib, \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u044e\u0449\u0430\u044f\u0441\u044f \u043f\u0440\u0438 \u0441\u0436\u0430\u0442\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 | ProHoster","og:description":"\u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 zlib \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2018-25032), \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u0431\u0443\u0444\u0435\u0440\u0430 \u043f\u0440\u0438 \u043f\u043e\u043f\u044b\u0442\u043a\u0435 \u0441\u0436\u0430\u0442\u0438\u044f \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432 \u0432\u043e \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0445 \u0434\u0430\u043d\u043d\u044b\u0445.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-zlib-proyavlyayushhayasya-pri-szhatii-speczialno-oformlennyh-dannyh","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-03-27T13:36:39+00:00","article:modified_time":"2022-03-27T13:36:39+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"103636","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-03-27 13:37:36","updated":"2022-10-04 08:36:37","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/103636","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=103636"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/103636\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=103636"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=103636"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=103636"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}