{"id":101354,"date":"2021-09-21T10:22:45","date_gmt":"2021-09-21T08:22:45","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-openoffice-pozvolyayushhaya-vypolnit-kod-pri-otkrytii-fajla"},"modified":"2021-09-21T10:22:45","modified_gmt":"2021-09-21T08:22:45","slug":"uyazvimost-v-openoffice-pozvolyayushhaya-vypolnit-kod-pri-otkrytii-fajla","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-v-openoffice-pozvolyayushhaya-vypolnit-kod-pri-otkrytii-fajla","title":{"rendered":"Zranite\u013enos\u0165 v OpenOffice, ktor\u00e1 umo\u017e\u0148uje vykonanie k\u00f3du pri otvoren\u00ed s\u00faboru","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V kancel\u00e1rskom bal\u00edku Apache OpenOffice bola zisten\u00e1 zranite\u013enos\u0165 (CVE-2021-33035), ktor\u00e1 umo\u017e\u0148uje vykonanie k\u00f3du pri otvoren\u00ed \u0161peci\u00e1lne upraven\u00e9ho s\u00faboru vo form\u00e1te DBF. V\u00fdskumn\u00edk, ktor\u00fd probl\u00e9m odhalil, varoval pred vytvoren\u00edm funk\u010dn\u00e9ho exploit pre platformu Windows. Oprava zranite\u013enosti je zatia\u013e k dispoz\u00edcii len vo forme patchu v repozit\u00e1ri projektu, ktor\u00fd bol zahrnut\u00fd do testovac\u00edch zost\u00e1v OpenOffice 4.1.11. Aktualiz\u00e1cie pre stabiln\u00fa verziu zatia\u013e neboli vytvoren\u00e9. <\/p>\n

Probl\u00e9m je sp\u00f4soben\u00fd t\u00fdm, \u017ee pri vy\u010dle\u0148ovan\u00ed pam\u00e4te OpenOffice sa spoliehal na hodnoty fieldLength a fieldType v hlavi\u010dk\u00e1ch s\u00faborov DBF, pri\u010dom neoveroval zodpovedaj\u00faci skuto\u010dn\u00fd typ \u00fadajov v poliach. Na vykonanie \u00fatoku je mo\u017en\u00e9 zada\u0165 v hodnote fieldType typ INTEGER, ale ulo\u017ei\u0165 \u00fadaje v\u00e4\u010d\u0161ej ve\u013ekosti a zada\u0165 hodnotu fieldLength, ktor\u00e1 nezodpoved\u00e1 ve\u013ekosti \u00fadajov s typom INTEGER, \u010do sp\u00f4sob\u00ed, \u017ee koniec \u00fadajov z po\u013ea bude zap\u00edsan\u00fd za hranice vy\u010dlenenej pam\u00e4te. V d\u00f4sledku kontrolovan\u00e9ho prete\u010denia pam\u00e4te sa v\u00fdskumn\u00edkovi podarilo prep\u00edsa\u0165 ukazovate\u013e n\u00e1vratu z funkcie a prostredn\u00edctvom techn\u00edk orientovan\u00fdch na n\u00e1vrat (ROP - Return-Oriented Programming) dosiahnu\u0165 vykonanie svojho k\u00f3du. <\/p>\n

Pri pou\u017eit\u00ed techniky ROP \u00fato\u010dn\u00edk sa nesna\u017e\u00ed umiestni\u0165 svoj k\u00f3d do pam\u00e4te, ale manipuluje u\u017e existuj\u00facimi kusmi strojov\u00fdch in\u0161trukci\u00ed v na\u010d\u00edtan\u00fdch kni\u017eniciach kon\u010diacich pr\u00edkazom na n\u00e1vrat riadenia (zvy\u010dajne s\u00fa to konce kni\u017eni\u010dn\u00fdch funkci\u00ed). Fungovanie exploitu spo\u010d\u00edva v zostaven\u00ed re\u0165azca volan\u00ed podobn\u00fdch blokov (\"gadgetov\") na z\u00edskanie po\u017eadovanej funk\u010dnosti. Ako gadgety v exploite pre OpenOffice sa pou\u017e\u00edval k\u00f3d z kni\u017enice libxml2, ktor\u00e1 sa na rozdiel od samotn\u00e9ho OpenOffice uk\u00e1zala by\u0165 zostaven\u00e1 bez mechanizmov ochrany DEP (Data Execution Prevention) a ASLR (Address Space Layout Randomization). <\/p>\n

V\u00fdvoj\u00e1ri OpenOffice boli o probl\u00e9me informovan\u00ed 4. m\u00e1ja, po \u010dom bolo na 30. augusta napl\u00e1novan\u00e9 verejn\u00e9 odhalenie inform\u00e1ci\u00ed o zranite\u013enosti. Ke\u010f\u017ee k term\u00ednu aktualiz\u00e1cia stabilnej vetvy e\u0161te nebola vytvoren\u00e1, v\u00fdskumn\u00edk presunul odhalenie detailov na 18. septembra, av\u0161ak v\u00fdvoj\u00e1ri OpenOffice nestihli vytvori\u0165 vydanie 4.1.11 ani do tohto term\u00ednu. Zauj\u00edmav\u00e9 je, \u017ee po\u010das toho ist\u00e9ho v\u00fdskumu bola odhalen\u00e1 podobn\u00e1 zranite\u013enos\u0165 v k\u00f3de podpory form\u00e1tu DBF v Microsoft Office Access (CVE-2021\u201338646), detaily o ktorej bud\u00fa zverejnen\u00e9 nesk\u00f4r. V LibreOffice neboli n\u00e1jden\u00e9 \u017eiadne probl\u00e9my.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043e\u0444\u0438\u0441\u043d\u043e\u043c \u043f\u0430\u043a\u0435\u0442\u0435 Apache OpenOffice \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-33035), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 DBF. \u0412\u044b\u044f\u0432\u0438\u0432\u0448\u0438\u0439 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b \u043e \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0438 \u0440\u0430\u0431\u043e\u0447\u0435\u0433\u043e \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430 \u0434\u043b\u044f \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Windows. \u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u043a\u0430 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0444\u043e\u0440\u043c\u0435 \u043f\u0430\u0442\u0447\u0430 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432\u043e\u0448\u0451\u043b \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 \u0442\u0435\u0441\u0442\u043e\u0432\u044b\u0445 \u0441\u0431\u043e\u0440\u043e\u043a OpenOffice 4.1.11. \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 \u043f\u043e\u043a\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101354","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranite\u013enos\u0165 v OpenOffice, ktor\u00e1 umo\u017e\u0148uje vykona\u0165 k\u00f3d pri otvoren\u00ed s\u00faboru | ProHoster","description":"V kancel\u00e1rskom bal\u00edku Apache OpenOffice bola zisten\u00e1 zranite\u013enos\u0165 (CVE-2021-33035), ktor\u00e1 umo\u017e\u0148uje vykonanie k\u00f3du pri otvoren\u00ed \u0161peci\u00e1lne upraven\u00e9ho s\u00faboru vo form\u00e1te DBF.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-v-openoffice-pozvolyayushhaya-vypolnit-kod-pri-otkrytii-fajla","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 OpenOffice, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438 \u0444\u0430\u0439\u043b\u0430 | ProHoster","og:description":"\u0412 \u043e\u0444\u0438\u0441\u043d\u043e\u043c \u043f\u0430\u043a\u0435\u0442\u0435 Apache OpenOffice \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-33035), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 DBF.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-v-openoffice-pozvolyayushhaya-vypolnit-kod-pri-otkrytii-fajla","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-09-21T08:22:45+00:00","article:modified_time":"2021-09-21T08:22:45+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101354","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-09-21 08:27:59","updated":"2022-10-03 20:50:17","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/101354","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=101354"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/101354\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=101354"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=101354"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=101354"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}