{"id":123495,"date":"2025-04-14T09:05:08","date_gmt":"2025-04-14T07:05:08","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/perepolnenie-bufera-v-perl-svyazannoe-s-obrabotkoj-simvolov"},"modified":"2025-04-14T09:05:08","modified_gmt":"2025-04-14T07:05:08","slug":"perepolnenie-bufera-v-perl-svyazannoe-s-obrabotkoj-simvolov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/perepolnenie-bufera-v-perl-svyazannoe-s-obrabotkoj-simvolov","title":{"rendered":"Dep\u0103\u0219irea buffer-ului \u00een Perl, legat\u0103 de procesarea caracterelor","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

S-au publicat actualiz\u0103ri corective pentru interpretorul Perl 5.40.2 \u0219i 5.38.4, care rezolv\u0103 o vulnerabilitate (CVE-2024-56406) ce duce la o dep\u0103\u0219ire a buffer-ului \u00een timpul transliter\u0103rii caracterelor ne-ASCII formate special prin operatorul «tr\/....\/». Nu se exclude posibilitatea exploat\u0103rii vulnerabilit\u0103\u021bii pentru a executa cod arbitrar \u00een sistem. Problema apare \u00een versiunile stabile ale Perl \u00eencep\u00e2nd din anul 2021 \u0219i afecteaz\u0103 versiunile Perl 5.34, 5.36, 5.38 \u0219i 5.40. Poate fi urm\u0103rit\u0103 remedierea vulnerabilit\u0103\u021bii \u00een distribu\u021bii pe paginile urm\u0103toare: Debian, Ubuntu, Fedora, Arch, FreeBSD. Distribu\u021biile bazate pe RHEL 9, SUSE 15 \u0219i openSUSE Leap 15.6 nu sunt vulnerabile, deoarece con\u021bin versiuni Perl 5.32 \u0219i 5.26. <\/p>\n

Vulnerabilitatea afecteaz\u0103 programele care utilizeaz\u0103 date externe nevalidate \u00een partea st\u00e2ng\u0103 a operatorului «tr», unde se specific\u0103 o variabil\u0103 cu date pentru \u00eenlocuirea caracterelor (de exemplu, «$external_string =~ tr\/a\/b\/»). \u00cen func\u021bia S_do_trans_invmap() care asigur\u0103 func\u021bionarea operatorului, la procesarea unor byte-uri ne-ASCII apare accesarea memoriei \u00een afara buffer-ului alocat. Dep\u0103\u0219irea are loc deoarece unele secven\u021be de byte \u00een setul de date ini\u021bial pot fi transformate \u00een secven\u021be UTF-8, pentru care este necesar dou\u0103 byte-uri \u00een loc de unul. <\/p>\n

Este notabil c\u0103 vulnerabilitatea a ap\u0103rut dup\u0103 modificarea efectuat\u0103 \u00een 2020, care a eliminat verificarea suplimentar\u0103 a aloc\u0103rii suficiente a memoriei sub pretextul c\u0103, \u00een calculul dimensiunii, este suficient\u0103 rotunjirea dimensiunii \u00een sus. Pentru a verifica existen\u021ba vulnerabilit\u0103\u021bii, poate fi executat codul: perl -e ‘$_ = «\x{FF}» x 1000000; tr\/\xFF\/\x{100}\/;’ Segmentation fault (core dumped)
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u043d\u0442\u0435\u0440\u043f\u0440\u0435\u0442\u0430\u0442\u043e\u0440\u0430 Perl 5.40.2 \u0438 5.38.4, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-56406), \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u0431\u0443\u0444\u0435\u0440\u0430 \u043f\u0440\u0438 \u0442\u0440\u0430\u043d\u0441\u043b\u0438\u0442\u0435\u0440\u0430\u0446\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u043d\u0435-ASCII \u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432 \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u0430 «tr\/..\/..\/». \u041d\u0435 \u0438\u0441\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u044b\u0445 \u0440\u0435\u043b\u0438\u0437\u0430\u0445 Perl \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 2021 \u0433\u043e\u0434\u0430 \u0438 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0432\u0435\u0442\u043a\u0438 Perl 5.34, 5.36, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-123495","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Suprascrierea memoriei tampon \u00een Perl, legat\u0103 de procesarea caracterelor | ProHoster","description":"Au fost publicate actualiz\u0103ri corective pentru interpretorul Perl 5.40.2 \u0219i 5.38.4, care corecteaz\u0103 o vulnerabilitate (CVE-2024-56406) ce duce la o suprascriere a memoriei tampon \u00een timpul transliter\u0103rii caracterelor ne-ASCII special formulate.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/perepolnenie-bufera-v-perl-svyazannoe-s-obrabotkoj-simvolov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 Perl, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0435 \u0441 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u043d\u0442\u0435\u0440\u043f\u0440\u0435\u0442\u0430\u0442\u043e\u0440\u0430 Perl 5.40.2 \u0438 5.38.4, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-56406), \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u0431\u0443\u0444\u0435\u0440\u0430 \u043f\u0440\u0438 \u0442\u0440\u0430\u043d\u0441\u043b\u0438\u0442\u0435\u0440\u0430\u0446\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u043d\u0435-ASCII.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/perepolnenie-bufera-v-perl-svyazannoe-s-obrabotkoj-simvolov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-04-14T07:05:08+00:00","article:modified_time":"2025-04-14T07:05:08+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"123495","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 12:12:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 12:12:19","updated":"2026-01-23 12:12:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/123495","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=123495"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/123495\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=123495"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=123495"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=123495"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}