{"id":105101,"date":"2022-09-15T09:36:58","date_gmt":"2022-09-15T07:36:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-paketnom-menedzhere-cargo-primenyaemom-dlya-proektov-na-yazyke-rust"},"modified":"2022-09-15T09:36:58","modified_gmt":"2022-09-15T07:36:58","slug":"uyazvimosti-v-paketnom-menedzhere-cargo-primenyaemom-dlya-proektov-na-yazyke-rust","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-paketnom-menedzhere-cargo-primenyaemom-dlya-proektov-na-yazyke-rust","title":{"rendered":"Vulnerabilit\u0103\u021bi \u00een managerul de pachete Cargo, utilizat pentru proiectele \u00een limbajul Rust","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00cen managerul de pachete Cargo, utilizat pentru gestionarea pachetelor \u0219i compilarea proiectelor \u00een limbajul Rust, au fost identificate dou\u0103 vulnerabilit\u0103\u021bi care pot fi exploatate prin desc\u0103rcarea pachetelor formatate special din depozite ter\u021be (se afirm\u0103 c\u0103 utilizatorii depozitului oficial crates.io nu sunt afecta\u021bi de problem\u0103). Prima vulnerabilitate (CVE-2022-36113) permite scrierea primelor dou\u0103 octe\u021bi din orice fi\u0219ier, \u00een m\u0103sura \u00een care permit permisiunile actuale. A doua vulnerabilitate (CVE-2022-36114) poate fi utilizat\u0103 pentru a epuiza spa\u021biul liber pe disc. <\/p>\n

Vulnerabilit\u0103\u021bile vor fi corectate \u00een versiunea Rust 1.64, programat\u0103 pentru 22 septembrie. Aceste vulnerabilit\u0103\u021bi au fost clasificate cu un nivel de risc sc\u0103zut, deoarece o daun\u0103 similar\u0103 poate fi cauzat\u0103 prin utilizarea pachetelor neverificate din depozite ter\u021be, prin intermediul func\u021bionalit\u0103\u021bii standard de a rula propriile manipulatoare din scripturile de construc\u021bie furnizate \u00een pachet sau din macrocomenzile procedurale. Cu toate acestea, problemele men\u021bionate mai sus se deosebesc prin faptul c\u0103 exploatarea lor se realizeaz\u0103 \u00een etapa de desf\u0103\u0219urare a pachetului dup\u0103 desc\u0103rcare (f\u0103r\u0103 construc\u021bie). <\/p>\n

\u00cen special, dup\u0103 desc\u0103rcarea pachetului, cargo dezarhiveaz\u0103 con\u021binutul acestuia \u00een directorul ~\/.cargo \u0219i salveaz\u0103 semnul de succes al dezarhiv\u0103rii \u00een fi\u0219ierul .cargo-ok. Esen\u021ba primei vulnerabilit\u0103\u021bi const\u0103 \u00een faptul c\u0103 creatorul pachetului poate plasa un link simbolic cu numele .cargo-ok, ceea ce va duce la scrierea textului \u00abok\u00bb \u00een fi\u0219ierul la care face referire linkul. <\/p>\n

A doua vulnerabilitate este cauzat\u0103 de lipsa unei restric\u021bii asupra dimensiunii datelor extrase din arhiv\u0103, ceea ce poate fi folosit pentru a crea \u00abzip-bomb\u00bb (\u00een arhiv\u0103 pot fi plasate date care permit ob\u021binerea unui grad maxim de compresie pentru formatul zip \u2014 aproximativ 28 de milioane de ori; \u00een acest caz, de exemplu, un fi\u0219ier zip preg\u0103tit special cu dimensiunea de 10 MB va duce la dezasamblarea a aproximativ 281 TB de date).
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u043c \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0435 Cargo, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0434\u043b\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u0430\u043c\u0438 \u0438 \u0441\u0431\u043e\u0440\u043a\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432 \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 Rust, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u043f\u0440\u0438 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0438\u0437 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432 (\u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f crates.io \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043d\u0435 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u043b\u0430). \u041f\u0435\u0440\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-36113) \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0430\u0442\u044c \u043f\u0435\u0440\u0432\u044b\u0435 \u0434\u0432\u0430 \u0431\u0430\u0439\u0442\u0430 \u0432 \u043b\u044e\u0431\u043e\u043c \u0444\u0430\u0439\u043b\u0435, \u043d\u0430\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u044d\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0442\u0435\u043a\u0443\u0449\u0438\u0435 \u043f\u0440\u0430\u0432\u0430 \u0434\u043e\u0441\u0442\u0443\u043f\u0430. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-105101","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilit\u0103\u021bi \u00een managerul de pachete Cargo, utilizat pentru proiectele \u00een limbajul Rust | ProHoster","description":"\u00cen managerul de pachete Cargo, utilizat pentru gestionarea pachetelor \u0219i compilarea proiectelor \u00een limbajul Rust, au fost identificate dou\u0103 vulnerabilit\u0103\u021bi care pot fi exploatate prin desc\u0103rcarea pachetelor formatate special din depozite ter\u021be.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-paketnom-menedzhere-cargo-primenyaemom-dlya-proektov-na-yazyke-rust","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u043c \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0435 Cargo, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0434\u043b\u044f \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432 \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 Rust | ProHoster","og:description":"\u0412 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u043c \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0435 Cargo, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0434\u043b\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u0430\u043c\u0438 \u0438 \u0441\u0431\u043e\u0440\u043a\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432 \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 Rust, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u043f\u0440\u0438 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0438\u0437 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-paketnom-menedzhere-cargo-primenyaemom-dlya-proektov-na-yazyke-rust","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-09-15T07:36:58+00:00","article:modified_time":"2022-09-15T07:36:58+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/105101","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=105101"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/105101\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=105101"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=105101"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=105101"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}