{"id":41415,"date":"2020-02-10T20:42:08","date_gmt":"2020-02-10T17:42:08","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/uyazvimost-v-android-pozvolyayushhaya-udalyonno-vypolnit-kod-pri-vklyuchyonnom-bluetooth"},"modified":"2020-02-10T20:42:08","modified_gmt":"2020-02-10T17:42:08","slug":"uyazvimost-v-android-pozvolyayushhaya-udalyonno-vypolnit-kod-pri-vklyuchyonnom-bluetooth","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/uyazvimost-v-android-pozvolyayushhaya-udalyonno-vypolnit-kod-pri-vklyuchyonnom-bluetooth","title":{"rendered":"O vulnerabilitate \u00een Android care permite executarea de cod de la distan\u021b\u0103 atunci c\u00e2nd Bluetooth este activat.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00cen actualizarea din februarie platformei<\/a><\/noindex> Android a fost eliminat\u0103 o vulnerabilitate critic\u0103 vulnerabilitatea<\/a><\/noindex> (CVE-2020-0022) \u00een stiva Bluetooth, care permite executarea de cod de la distan\u021b\u0103 prin trimiterea unui pachet Bluetooth special conceput. Problema poate fi exploatat\u0103 f\u0103r\u0103 ca atacatorul s\u0103 fie observat, aflat \u00een aria de acoperire Bluetooth. Nu este exclus ca vulnerabilitatea s\u0103 fie folosit\u0103 pentru a crea viermi care afecteaz\u0103 dispozitivele din jur. <\/p>\n

Pentru atac, este suficient s\u0103 cuno\u0219ti adresa MAC a dispozitivului \u021bint\u0103 (nu este necesar\u0103 asocierea prealabil\u0103, dar trebuie s\u0103 fie activat Bluetooth-ul pe dispozitiv). Pe unele dispozitive, adresa MAC Bluetooth poate fi calculat\u0103 pe baza adresei MAC Wi-Fi. \u00cen cazul unei exploat\u0103ri reu\u0219ite a vulnerabilit\u0103\u021bii, atacatorul poate rula codul s\u0103u cu drepturile procesului \u00een fundal care coordoneaz\u0103 func\u021bionarea Bluetooth-ului \u00een Android.
\nProblema este specific\u0103 stivei Bluetooth utilizate \u00een Android Fluoride<\/a><\/noindex> (bazat\u0103 pe codul proiectului BlueDroid de la Broadcom) \u0219i nu se manifest\u0103 \u00een stiva BlueZ utilizat\u0103 \u00een Linux.<\/p>\n

Cercet\u0103torii care au descoperit problema au reu\u0219it s\u0103 preg\u0103teasc\u0103 un prototip func\u021bional al exploit-ului, dar detaliile exploat\u0103rii vor fi dezv\u0103luite<\/a><\/noindex> mai t\u00e2rziu, dup\u0103 ce corec\u021bia va fi distribuit\u0103 la majoritatea utilizatorilor. Singurul lucru cunoscut este c\u0103 vulnerabilitatea este prezent\u0103 \u00een codul de refacere a pachetelor \u0219i provocat\u0103<\/a><\/noindex> de calculul incorect al dimensiunii pachetelor L2CAP (Logical Link Control and Adaptation Protocol), \u00een cazul \u00een care datele transmise de expeditor dep\u0103\u0219esc dimensiunea a\u0219teptat\u0103.<\/p>\n

\u00cen Android 8 \u0219i 9, problema poate duce la executarea de cod, dar \u00een Android 10 este limitat\u0103 la pr\u0103bu\u0219irea procesului de fundal Bluetooth. Versiunile mai vechi de Android sunt poten\u021bial afectate de problem\u0103, dar posibilitatea exploat\u0103rii vulnerabilit\u0103\u021bii nu a fost testat\u0103. Utilizatorii sunt sf\u0103tui\u021bi s\u0103 instaleze actualizarea de firmware c\u00e2t mai cur\u00e2nd posibil, iar dac\u0103 acest lucru nu este posibil \u2014 s\u0103 dezactiveze Bluetooth-ul implicit, s\u0103 interzic\u0103 descoperirea dispozitivului \u0219i s\u0103 activeze Bluetooth-ul \u00een locuri publice doar \u00een caz de necesitate extrem\u0103 (inclusiv se poate \u00eenlocui c\u0103\u0219tile wireless cu unele cu fir). <\/p>\n

Pe l\u00e2ng\u0103 problema men\u021bionat\u0103 \u00een actualizarea din februarie<\/a><\/noindex> pachetului de corec\u021bii de securitate pentru Android au fost remediate 26 de vulnerabilit\u0103\u021bi, dintre care uneia (CVE-2020-0023) i s-a atribuit un nivel critic de pericol. A doua vulnerabilitate, de asemenea, implic\u0103<\/a><\/noindex> Stiva Bluetooth \u0219i este legat\u0103 de procesarea incorect\u0103 a privilegului BLUETOOTH_PRIVILEGED \u00een setPhonebookAccessPermission. \u00cen ceea ce prive\u0219te vulnerabilit\u0103\u021bile marcate ca fiind periculoase, 7 probleme au fost solu\u021bionate \u00een cadrele \u0219i aplica\u021biile respective, 4 \u00een componentele de sistem, 2 \u00een kernel \u0219i 10 \u00een componentele deschise \u0219i proprietare pentru cipurile Qualcomm.<\/p>\n

<\/a><\/noindex><\/p>\n

Sursa: opennet.ro<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0444\u0435\u0432\u0440\u0430\u043b\u044c\u0441\u043a\u043e\u043c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Android \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-0022) \u0432 Bluetooth-\u0441\u0442\u0435\u043a\u0435, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e Bluetooth-\u043f\u0430\u043a\u0435\u0442\u0430. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043d\u0435\u0437\u0430\u043c\u0435\u0442\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u043c, \u043d\u0430\u0445\u043e\u0434\u044f\u0449\u0438\u043c\u0441\u044f \u0432 \u043f\u0440\u0435\u0434\u0435\u043b\u0430\u0445 \u0434\u043e\u0441\u044f\u0433\u0430\u0435\u043c\u043e\u0441\u0442\u0438 Bluetooth. \u041d\u0435 \u0438\u0441\u043a\u043b\u044e\u0447\u0435\u043d\u043e \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0447\u0435\u0440\u0432\u0435\u0439, \u043f\u043e \u0446\u0435\u043f\u043e\u0447\u043a\u0435 \u043f\u043e\u0440\u0430\u0436\u0430\u044e\u0449\u0438\u0445 \u0441\u043e\u0441\u0435\u0434\u043d\u0438\u0435 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430. \u0414\u043b\u044f \u0430\u0442\u0430\u043a\u0438 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0437\u043d\u0430\u0442\u044c MAC-\u0430\u0434\u0440\u0435\u0441 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u0436\u0435\u0440\u0442\u0432\u044b (\u043f\u0440\u0435\u0434\u0432\u0430\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0441\u043e\u043f\u0440\u044f\u0436\u0435\u043d\u0438\u044f \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-41415","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitate \u00een Android care permite execu\u021bia de cod de la distan\u021b\u0103 atunci c\u00e2nd Bluetooth este activat | ProHoster","description":"Actualizarea din februarie a platformei Android a remediat o vulnerabilitate critic\u0103","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/uyazvimost-v-android-pozvolyayushhaya-udalyonno-vypolnit-kod-pri-vklyuchyonnom-bluetooth","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Android, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043f\u0440\u0438 \u0432\u043a\u043b\u044e\u0447\u0451\u043d\u043d\u043e\u043c Bluetooth | ProHoster","og:description":"\u0412 \u0444\u0435\u0432\u0440\u0430\u043b\u044c\u0441\u043a\u043e\u043c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Android \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f","og:url":"https:\/\/prohoster.info\/ro\/blog\/uyazvimost-v-android-pozvolyayushhaya-udalyonno-vypolnit-kod-pri-vklyuchyonnom-bluetooth","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-10T17:42:08+00:00","article:modified_time":"2020-02-10T17:42:08+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"41415","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 13:26:29","updated":"2022-09-29 21:00:24","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/41415","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=41415"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/41415\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=41415"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=41415"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=41415"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}