{"id":121941,"date":"2025-02-14T20:22:09","date_gmt":"2025-02-14T18:22:09","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-musl-ekspluatiruemaya-pri-perekodirovanii-teksta-v-kodirovke-euc-kr"},"modified":"2025-02-14T20:22:09","modified_gmt":"2025-02-14T18:22:09","slug":"uyazvimost-v-musl-ekspluatiruemaya-pri-perekodirovanii-teksta-v-kodirovke-euc-kr","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-musl-ekspluatiruemaya-pri-perekodirovanii-teksta-v-kodirovke-euc-kr","title":{"rendered":"O vulnerabilitate \u00een Musl, exploatat\u0103 \u00een timpul re\u00eencod\u0103rii textului \u00een codificarea EUC-KR.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

O bibliotec\u0103 standard C Musl a identificat o vulnerabilitate (CVE-2024-2961) care duce la un overflow de buffer \u00een timpul conversiei unui text special formatat din codificarea EUC-KR \u00een UTF-8 prin func\u021bia iconv(). Vulnerabilitatea apare \u00eencep\u00e2nd cu versiunea musl 0.9.13 \u0219i va fi corectat\u0103 \u00een versiunea 1.2.6 care este \u00een curs de publicare (p\u00e2n\u0103 la publicarea actualiz\u0103rii, se recomand\u0103 utilizarea unui patch). Vulnerabilitatea a fost descoperit\u0103 de c\u0103tre biblioteca libxml2 \u00een timpul test\u0103rii fuzzing. <\/p>\n

Vulnerabilitatea poate fi utilizat\u0103 pentru a lansa atacuri asupra aplica\u021biilor construite cu biblioteca Musl, care efectueaz\u0103 conversia textului ob\u021binut din surse externe. Exploatarea vulnerabilit\u0103\u021bii este posibil\u0103 prin apelarea func\u021biei iconv_open() \u00een aplica\u021bie, specific\u00e2nd codarea surs\u0103 EUC-KR \u0219i codarea \u021bint\u0103 UTF-8. Ca exemplu de aplica\u021bii poten\u021bial vulnerabile sunt men\u021bionate programele care reconvertesc XML, HTML \u0219i mesaje de e-mail pe baza cod\u0103rii specificate \u00een antetul cu tip MIME (de exemplu, «text\/plain; charset=EUC-KR»). De exemplu, asemenea reconvertiri sunt realizate de programele care utilizeaz\u0103 biblioteca libxml2. <\/p>\n

Vulnerabilitatea este cauzat\u0103 de combina\u021bia a dou\u0103 erori. Prima eroare este legat\u0103 de lipsa unei verific\u0103ri corespunz\u0103toare a secven\u021belor multibayt incorecte \u00een decodorul EUC-KR. A doua eroare se afl\u0103 \u00een codificatorul UTF-8, care nu a fost conceput pentru a lua \u00een considerare faptul c\u0103 decodorul de intrare poate returna valori scalar Unicode invalide. Drept urmare, procesarea secven\u021belor de tip «\xc8\x41» duce la scrierea valorilor \u00een zona dincolo de bufferul alocat.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u0439 \u0421\u0438-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 Musl \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-2961), \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u0431\u0443\u0444\u0435\u0440\u0430 \u043f\u0440\u0438 \u043f\u0440\u0435\u043e\u0431\u0440\u0430\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0442\u0435\u043a\u0441\u0442\u0430 \u0438\u0437 \u043a\u043e\u0434\u0438\u0440\u043e\u0432\u043a\u0438 EUC-KR \u0432 UTF-8 \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 iconv(). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u0435\u0440\u0441\u0438\u0438 musl 0.9.13 \u0438 \u0431\u0443\u0434\u0435\u0442 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0432 \u0433\u043e\u0442\u043e\u0432\u044f\u0449\u0435\u043c\u0441\u044f \u043a \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u0432\u044b\u043f\u0443\u0441\u043a\u0435 1.2.6 (\u0434\u043e \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043f\u0430\u0442\u0447). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0438\u043c \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0443 libxml2 \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 fuzzing-\u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-121941","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitate \u00een Musl, exploatat\u0103 \u00een timpul recodific\u0103rii textului \u00een codificarea EUC-KR | ProHoster","description":"O bibliotec\u0103 standard C Musl a identificat o vulnerabilitate (CVE-2024-2961) care duce la un overflow de buffer \u00een timpul conversiei unui text special formatat din codificarea EUC-KR \u00een UTF-8 prin func\u021bia iconv().","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-musl-ekspluatiruemaya-pri-perekodirovanii-teksta-v-kodirovke-euc-kr","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Musl, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0430\u044f \u043f\u0440\u0438 \u043f\u0435\u0440\u0435\u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0438 \u0442\u0435\u043a\u0441\u0442\u0430 \u0432 \u043a\u043e\u0434\u0438\u0440\u043e\u0432\u043a\u0435 EUC-KR | ProHoster","og:description":"\u0412 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u0439 \u0421\u0438-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 Musl \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-2961), \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u0431\u0443\u0444\u0435\u0440\u0430 \u043f\u0440\u0438 \u043f\u0440\u0435\u043e\u0431\u0440\u0430\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0442\u0435\u043a\u0441\u0442\u0430 \u0438\u0437 \u043a\u043e\u0434\u0438\u0440\u043e\u0432\u043a\u0438 EUC-KR \u0432 UTF-8 \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 iconv().","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-musl-ekspluatiruemaya-pri-perekodirovanii-teksta-v-kodirovke-euc-kr","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-02-14T18:22:09+00:00","article:modified_time":"2025-02-14T18:22:09+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"121941","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 10:36:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 10:36:19","updated":"2026-01-23 10:36:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/121941","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=121941"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/121941\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=121941"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=121941"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=121941"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}