{"id":110912,"date":"2023-10-18T09:10:25","date_gmt":"2023-10-18T07:10:25","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/desyatki-uyazvimostej-v-squid-ne-mogut-ispravit-uzhe-25-goda"},"modified":"2023-10-18T09:10:25","modified_gmt":"2023-10-18T07:10:25","slug":"desyatki-uyazvimostej-v-squid-ne-mogut-ispravit-uzhe-25-goda","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/desyatki-uyazvimostej-v-squid-ne-mogut-ispravit-uzhe-25-goda","title":{"rendered":"Zeci de vulnerabilit\u0103\u021bi \u00een Squid nu pot fi corectate de 2,5 ani","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Au trecut mai bine de doi ani de la descoperirea a 35 de vulnerabilit\u0103\u021bi \u00een proxy-ul de caching Squid, iar majoritatea dintre ele nu au fost \u00eenc\u0103 remediate, avertizeaz\u0103 un expert \u00een securitate care a raportat prima dat\u0103 aceste probleme.<\/p>\n

\u00cen februarie 2021, specialistul \u00een securitate Joshua Rogers a efectuat o analiz\u0103 a Squid \u0219i a identificat 55 de vulnerabilit\u0103\u021bi \u00een codul proiectului.<\/p>\n

P\u00e2n\u0103 \u00een prezent, au fost remediate doar 20 dintre acestea. Majoritatea vulnerabilit\u0103\u021bilor nu au primit denumiri CVE, ceea ce \u00eenseamn\u0103 c\u0103 nu exist\u0103 remedieri oficiale sau recomand\u0103ri pentru a le aborda. Rogers a declarat \u00eentr-o scrisoare adresat\u0103 comunit\u0103\u021bii de securitate Openwall c\u0103, dup\u0103 o lung\u0103 a\u0219teptare, a decis s\u0103 publice aceste informa\u021bii.<\/p>\n

Rogers a detaliat vulnerabilit\u0103\u021bile pe site-ul s\u0103u, subliniind diversitatea problemelor \u2013 utilizare dup\u0103 eliberare (Use-After-Free), scurgeri de memorie (memory leak), otr\u0103virea cache-ului (cache poisoning), eroarea de afirma\u021bie (assertion failure) \u0219i alte deficien\u021be \u00een diverse componente. \u00cen acest context, specialistul a ar\u0103tat \u00een\u021belegere fa\u021b\u0103 de echipa Squid, men\u021bion\u00e2nd c\u0103 mul\u021bi dezvoltatori ai proiectelor open-source lucreaz\u0103 pe baz\u0103 de voluntariat \u0219i nu pot reac\u021biona \u00eentotdeauna rapid la astfel de probleme.<\/p>\n

Este de men\u021bionat c\u0103 Squid este \u00een prezent utilizat \u00een milioane de instan\u021be din \u00eentreaga lume.<\/p>\n

Recomand\u0103rile lui Rogers implic\u0103 faptul c\u0103 fiecare utilizator ar trebui s\u0103 evalueze dac\u0103 Squid este potrivit pentru sistemul s\u0103u. \u00cen caz contrar, utilizatorii se pot confrunta cu e\u0219ecuri \u0219i riscuri \u00een ceea ce prive\u0219te securitatea informa\u021biilor.<\/p>\n

Aceast\u0103 situa\u021bie ne aminte\u0219te tuturor de importan\u021ba actualiz\u0103rii regulate \u0219i asigur\u0103rii securit\u0103\u021bii software-ului. Altfel, a\u0219a cum subliniaz\u0103 Rogers, «nu va avea niciun sens».<\/p>\n

Acest episod \u00eengrijor\u0103tor ridic\u0103 \u00eentreb\u0103ri serioase cu privire la securitatea proiectelor open-source \u0219i la capacitatea lor de a face fa\u021b\u0103 fluxului ne\u00eencetat de noi vulnerabilit\u0103\u021bi.<\/p>\n

R\u0103m\u00e2ne de sperat c\u0103 membrii comunit\u0103\u021bii \u0219i dezvoltatorii vor lua m\u0103suri imediate pentru a remedia aceast\u0103 amenin\u021bare \u00een viitor.<\/p>\n

<\/p>\n

Scrisoarea lui Joshua pe Openwall<\/a> (eng.)<\/p>\n

<\/noindex><\/noindex> <\/p>\n

Detalierea problemelor pe site-ul lui Joshua<\/a> (eng.)<\/p>\n

<\/noindex><\/p>\n

Sursa: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0411\u043e\u043b\u0435\u0435 \u0434\u0432\u0443\u0445 \u043b\u0435\u0442 \u043f\u0440\u043e\u0448\u043b\u043e \u0441 \u043c\u043e\u043c\u0435\u043d\u0442\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f 35 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043a\u0435\u0448\u0438\u0440\u0443\u044e\u0449\u0435\u043c \u043f\u0440\u043e\u043a\u0441\u0438 Squid, \u0438 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0438\u0437 \u043d\u0438\u0445 \u0434\u043e \u0441\u0438\u0445 \u043f\u043e\u0440 \u043d\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043e, \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u0435\u0442 \u044d\u043a\u0441\u043f\u0435\u0440\u0442 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0435\u0440\u0432\u044b\u043c \u0441\u043e\u043e\u0431\u0449\u0438\u043b \u043e \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430\u0445. \u0412 \u0444\u0435\u0432\u0440\u0430\u043b\u0435 2021 \u0433\u043e\u0434\u0430 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0414\u0436\u043e\u0448\u0443\u0430 \u0420\u043e\u0434\u0436\u0435\u0440\u0441 \u043f\u0440\u043e\u0432\u0435\u043b \u0430\u043d\u0430\u043b\u0438\u0437 Squid \u0438 \u0432\u044b\u044f\u0432\u0438\u043b 55 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043a\u043e\u0434\u0435 \u043f\u0440\u043e\u0435\u043a\u0442\u0430. \u041a \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0435\u043c\u0443 \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u0431\u044b\u043b\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-110912","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zeci de vulnerabilit\u0103\u021bi \u00een Squid nu pot fi corectate de deja 2,5 ani | ProHoster","description":"Au trecut mai bine de doi ani de la descoperirea a 35 de vulnerabilit\u0103\u021bi \u00een proxy-ul de caching Squid, iar majoritatea dintre ele nu au fost \u00eenc\u0103 remediate, avertizeaz\u0103 un expert \u00een securitate care a raportat prima dat\u0103 aceste probleme.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/desyatki-uyazvimostej-v-squid-ne-mogut-ispravit-uzhe-25-goda","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0414\u0435\u0441\u044f\u0442\u043a\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 Squid \u043d\u0435 \u043c\u043e\u0433\u0443\u0442 \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0443\u0436\u0435 2,5 \u0433\u043e\u0434\u0430 | ProHoster","og:description":"\u0411\u043e\u043b\u0435\u0435 \u0434\u0432\u0443\u0445 \u043b\u0435\u0442 \u043f\u0440\u043e\u0448\u043b\u043e \u0441 \u043c\u043e\u043c\u0435\u043d\u0442\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f 35 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043a\u0435\u0448\u0438\u0440\u0443\u044e\u0449\u0435\u043c \u043f\u0440\u043e\u043a\u0441\u0438 Squid, \u0438 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0438\u0437 \u043d\u0438\u0445 \u0434\u043e \u0441\u0438\u0445 \u043f\u043e\u0440 \u043d\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043e, \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u0435\u0442 \u044d\u043a\u0441\u043f\u0435\u0440\u0442 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0435\u0440\u0432\u044b\u043c \u0441\u043e\u043e\u0431\u0449\u0438\u043b \u043e \u0434\u0430\u043d\u043d\u044b\u0445.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/desyatki-uyazvimostej-v-squid-ne-mogut-ispravit-uzhe-25-goda","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-10-18T07:10:25+00:00","article:modified_time":"2023-10-18T07:10:25+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/110912","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=110912"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/110912\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=110912"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=110912"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=110912"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}