{"id":31611,"date":"2019-10-31T21:42:10","date_gmt":"2019-10-31T18:42:10","guid":{"rendered":"https:\/\/prohoster.info\/blog\/microsoft-otkazalas-ispravlyat-uyazvimost-nulevogo-dnya-v-nbsp-internet-explorer\/"},"modified":"2019-10-31T21:42:10","modified_gmt":"2019-10-31T18:42:10","slug":"microsoft-otkazalas-ispravlyat-uyazvimost-nulevogo-dnya-v-nbsp-internet-explorer","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/microsoft-otkazalas-ispravlyat-uyazvimost-nulevogo-dnya-v-nbsp-internet-explorer","title":{"rendered":"Microsoft sa odmietol zaobera\u0165 zranite\u013enos\u0165ou zero-day v Internet Explorer","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V piatok 12. apr\u00edla \u0161pecialista na informa\u010dn\u00fa bezpe\u010dnos\u0165 John Paige uverejnil inform\u00e1cie o neopravennej zranite\u013enosti v aktu\u00e1lnej verzii Internet Explorer a predviedol jej realiz\u00e1ciu. T\u00e1to zranite\u013enos\u0165 m\u00f4\u017ee potenci\u00e1lne umo\u017eni\u0165 \u00fato\u010dn\u00edkovi z\u00edska\u0165 obsah miestnych s\u00faborov pou\u017e\u00edvate\u013eov syst\u00e9mov Windows, pri\u010dom ob\u00edde bezpe\u010dnostn\u00fd syst\u00e9m prehliada\u010da.<\/p>\n

\"Microsoft<\/p>\n

Zranite\u013enos\u0165 spo\u010d\u00edva v tom, ako Internet Explorer spracov\u00e1va s\u00fabory vo form\u00e1te MHTML, ktor\u00e9 zvy\u010dajne maj\u00fa pr\u00edponu .mht alebo .mhtml. Tento form\u00e1t sa v Internet Explorer pou\u017e\u00edvaj\u00fa predvolene na ukladanie webov\u00fdch str\u00e1nok a umo\u017e\u0148uje ulo\u017ei\u0165 cel\u00fd obsah str\u00e1nky spolu so v\u0161etk\u00fdm multimedi\u00e1lnym obsahom do jedn\u00e9ho s\u00faboru. V s\u00fa\u010dasnosti v\u00e4\u010d\u0161ina modern\u00fdch prehliada\u010dov u\u017e neuklad\u00e1 webov\u00e9 str\u00e1nky vo form\u00e1te MHT a namiesto toho pou\u017e\u00edva \u0161tandardn\u00fd form\u00e1t pre WEB \u2014 HTML, av\u0161ak st\u00e1le podporuj\u00fa spracovanie s\u00faborov v tomto form\u00e1te a m\u00f4\u017eu ho pou\u017e\u00edva\u0165 na ukladanie pri pr\u00edslu\u0161n\u00fdch nastaveniach alebo pomocou roz\u0161\u00edren\u00ed.<\/p>\n

Zranite\u013enos\u0165, ktor\u00fa objavil John, patr\u00ed do kateg\u00f3rie zranite\u013enost\u00ed XXE (XML eXternal Entity) a spo\u010d\u00edva v nespr\u00e1vnej konfigur\u00e1cii spracovate\u013ea XML k\u00f3du v Internet Explorer. \u201eT\u00e1to zranite\u013enos\u0165 umo\u017e\u0148uje vzdialen\u00e9mu \u00fato\u010dn\u00edkovi z\u00edska\u0165 pr\u00edstup k miestnym s\u00faborom pou\u017e\u00edvate\u013ea a napr\u00edklad extrahova\u0165 inform\u00e1cie o verzii nain\u0161talovan\u00e9ho softv\u00e9ru v syst\u00e9me,\u201c hovor\u00ed Paige. \u201eTak\u017ee dopyt pre ‘c:Python27NEWS.txt’ vr\u00e1ti verziu tohto programu (v tomto pr\u00edpade interpretera Python).\"<\/p>\n

<\/center><\/p>\n

Ke\u010f\u017ee v syst\u00e9me Windows sa v\u0161etky s\u00fabory MHT predvolene otv\u00e1raj\u00fa v Internet Explorer, zneu\u017eitie tejto zranite\u013enosti je trivi\u00e1lnou \u00falohou, preto\u017ee pou\u017e\u00edvate\u013e mus\u00ed len dvakr\u00e1t klikn\u00fa\u0165 na nebezpe\u010dn\u00fd s\u00fabor, ktor\u00fd dostal prostredn\u00edctvom e-mailu, soci\u00e1lnych siet\u00ed alebo messengerov.<\/p>\n

\"Microsoft<\/p>\n

\u201ePri vytv\u00e1ran\u00ed in\u0161tancie objektu ActiveX, ako je Microsoft.XMLHTTP, dost\u00e1va pou\u017e\u00edvate\u013e varovanie od syst\u00e9mu zabezpe\u010denia v Internet Exploreri, ktor\u00e9 po\u017eaduje potvrdenie na aktiv\u00e1ciu zablokovan\u00e9ho obsahu,\u201c vysvet\u013euje v\u00fdskumn\u00edk. \u201eAv\u0161ak pri otvoren\u00ed vopred pripraven\u00e9ho s\u00faboru .mht pomocou \u0161peci\u00e1lne upraven\u00fdch zna\u010diek form\u00e1tu pou\u017e\u00edvate\u013e nedostane upozornenie na potenci\u00e1lne nebezpe\u010dn\u00fd obsah.\u201c<\/p>\n

Pod\u013ea Peyda \u00faspe\u0161ne otestoval zranite\u013enos\u0165 v aktu\u00e1lnej verzii prehliada\u010da Internet Explorer 11 so v\u0161etk\u00fdmi posledn\u00fdmi bezpe\u010dnostn\u00fdmi aktualiz\u00e1ciami v syst\u00e9moch Windows 7, Windows 10 a Windows Server 2012 R2.<\/p>\n

Jednou z m\u00e1la dobr\u00fdch spr\u00e1v o zverejnen\u00ed tejto zranite\u013enosti pre verejnos\u0165 je fakt, \u017ee kedysi dominantn\u00fd podiel na trhu Internet Explorera v s\u00fa\u010dasnosti klesol na nejak\u00fdch 7,34 %, pod\u013ea NetMarketShare. Ale preto\u017ee Windows pou\u017e\u00edva Internet Explorer ako predvolen\u00fa aplik\u00e1ciu na otv\u00e1ranie s\u00faborov MHT, pou\u017e\u00edvatelia nemusia nastavova\u0165 IE ako predvolen\u00fd prehliada\u010d a s\u00fa st\u00e1le zranite\u013en\u00ed, pokia\u013e IE zost\u00e1va pr\u00edtomn\u00fd v ich syst\u00e9moch a nezoh\u013ead\u0148uj\u00fa form\u00e1t s\u00faborov s\u0165ahovan\u00fdch z internetu.<\/p>\n

E\u0161te 27. marca John informoval Microsoft o tejto zranite\u013enosti v ich prehliada\u010di, ale 10. apr\u00edla v\u00fdskumn\u00edk dostal od spolo\u010dnosti odpove\u010f, v ktorej uviedla, \u017ee pova\u017euje t\u00fato ot\u00e1zku za menej v\u00fdznamn\u00fa.<\/p>\n

\u201eOprava bude vydan\u00e1 a\u017e s \u010fal\u0161ou verziou produktu,\u201c uv\u00e1dza sa v liste Microsoftu. \u201eV s\u00fa\u010dasnosti nepl\u00e1nujeme vydanie rie\u0161enia pre t\u00fato problematiku.\u201c<\/p>\n

Po jednozna\u010dnej reakcii Microsoft v\u00fdskumn\u00edk zverejnil podrobnosti o zranite\u013enosti nult\u00e9ho d\u0148a na svojej webovej str\u00e1nke, ako aj demonstra\u010dn\u00fd k\u00f3d a video na YouTube.<\/p>\n<\/p>\n

\r\n \"Prehrajte\r\n
<\/div>\r\n <\/div><\/center><\/center><\/p>\n

Hoci implement\u00e1cia tejto zranite\u013enosti nie je tak jednoduch\u00e1 a vy\u017eaduje si nejak\u00fdm sp\u00f4sobom don\u00fati\u0165 pou\u017e\u00edvate\u013ea spusti\u0165 nezn\u00e1my s\u00fabor vo form\u00e1te MHT, t\u00fato zranite\u013enos\u0165 netreba bra\u0165 na \u013eahk\u00fa v\u00e1hu, napriek absencii reakcie zo strany Microsoftu. Hackersk\u00e9 skupiny u\u017e v minulosti vyu\u017e\u00edvali s\u00fabory MHT na phishing a \u0161\u00edrenie \u0161kodliv\u00e9ho softv\u00e9ru, ni\u010d im nebr\u00e1ni robi\u0165 to aj teraz. <\/p>\n

Napriek tomu, aby ste sa vyhli tejto a mnoh\u00fdm podobn\u00fdm zranite\u013enostiam, sta\u010d\u00ed jednoducho venova\u0165 pozornos\u0165 pr\u00edpon\u00e1m s\u00faborov, ktor\u00e9 dost\u00e1vate z internetu, a kontrolova\u0165 ich antiv\u00edrusom alebo na str\u00e1nke VirusTotal. A pre \u010fal\u0161iu ochranu nastavte pre s\u00fabory .mht alebo .mhtml ako predvolen\u00e9 aplik\u00e1cie svoj ob\u013e\u00faben\u00fd prehliada\u010d, ktor\u00fd nie je Internet Explorer. Napr\u00edklad vo Windows 10 sa to rob\u00ed celkom jednoducho v menu \u201eV\u00fdber predvolen\u00fdch aplik\u00e1ci\u00ed pre typy s\u00faborov\u201c.<\/p>\n

\"Microsoft<\/p>\n

<\/p>\n

<\/center><\/p>\n

\t\t\t\t


\n\t\t\t\t\t\t\t\t<\/center>
\n
Zdroj: 3dnews.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043f\u044f\u0442\u043d\u0438\u0446\u0443 12 \u0430\u043f\u0440\u0435\u043b\u044f \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442 \u043f\u043e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0414\u0436\u043e\u043d \u041f\u0435\u0439\u0434\u0436 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u043d\u0435\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438 Internet Explorer, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043b \u0435\u0451 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044e. \u0414\u0430\u043d\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0441\u0438\u0441\u0442\u0435\u043c Windows, \u043c\u0438\u043d\u0443\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0443 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u0432 \u0442\u043e\u043c, \u043a\u0430\u043a Internet Explorer \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u0442 \u0444\u0430\u0439\u043b\u044b \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 MHTML, \u043a\u0430\u043a \u043f\u0440\u0430\u0432\u0438\u043b\u043e, \u0438\u043c\u0435\u044e\u0449\u0438\u0445 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":23533,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-31611","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Microsoft sa odmietol opravi\u0165 zranite\u013enos\u0165 nult\u00e9ho d\u0148a v Internet Exploreri | ProHoster","description":"V piatok 12. apr\u00edla \u0161pecialista na informa\u010dn\u00fa bezpe\u010dnos\u0165 John Page zverejnil inform\u00e1cie o neopravenej zranite\u013enosti v aktu\u00e1lnej verzii Internet Explorera a takisto predviedol jej realiz\u00e1ciu.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/microsoft-otkazalas-ispravlyat-uyazvimost-nulevogo-dnya-v-nbsp-internet-explorer","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Microsoft \u043e\u0442\u043a\u0430\u0437\u0430\u043b\u0430\u0441\u044c \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f \u0432 Internet Explorer | ProHoster","og:description":"\u0412 \u043f\u044f\u0442\u043d\u0438\u0446\u0443 12 \u0430\u043f\u0440\u0435\u043b\u044f \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442 \u043f\u043e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0414\u0436\u043e\u043d \u041f\u0435\u0439\u0434\u0436 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u043d\u0435\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438 Internet Explorer, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043b \u0435\u0451 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044e.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/microsoft-otkazalas-ispravlyat-uyazvimost-nulevogo-dnya-v-nbsp-internet-explorer","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:42:10+00:00","article:modified_time":"2019-10-31T18:42:10+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31611","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 06:59:22","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:14:43","updated":"2026-01-21 06:59:22","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/31611","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=31611"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/31611\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/23533"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=31611"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=31611"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=31611"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}