{"id":94683,"date":"2020-09-20T01:42:01","date_gmt":"2020-09-19T23:42:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-firefox-dlya-android-pozvolyayushhaya-upravlyat-brauzerom-cherez-obshhij-wi-fi"},"modified":"2020-09-20T01:42:01","modified_gmt":"2020-09-19T23:42:01","slug":"uyazvimost-v-firefox-dlya-android-pozvolyayushhaya-upravlyat-brauzerom-cherez-obshhij-wi-fi","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-v-firefox-dlya-android-pozvolyayushhaya-upravlyat-brauzerom-cherez-obshhij-wi-fi","title":{"rendered":"Zranite\u013enos\u0165 vo Firefoxe pre Android, ktor\u00e1 umo\u017e\u0148uje spravova\u0165 prehliada\u010d cez spolo\u010dn\u00e9 Wi-Fi","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Vo Firefox pre Android bola zisten\u00e1<\/a><\/noindex> z\u00e1va\u017en\u00e1 zranite\u013enos\u0165<\/a><\/noindex> v realiz\u00e1cii protokolu SSDP<\/a><\/noindex>, pou\u017e\u00edvan\u00e9ho na detekciu sie\u0165ov\u00fdch slu\u017eieb v lok\u00e1lnej sieti. Zranite\u013enos\u0165 umo\u017e\u0148uje \u00fato\u010dn\u00edkovi, nach\u00e1dzaj\u00facemu sa v tej istej lok\u00e1lnej alebo bezdr\u00f4tovej sieti, odpoveda\u0165 na overovacie po\u017eiadavky Firefoxu spr\u00e1vou UPnP XML \u201eLOCATION\u201c s intent-pr\u00edkazmi<\/a><\/noindex>, pomocou ktor\u00fdch je mo\u017en\u00e9 otvori\u0165 v prehliada\u010di \u013eubovo\u013en\u00fd URI alebo vyvola\u0165 spracovate\u013eov in\u00fdch aplik\u00e1ci\u00ed. <\/p>\n

Probl\u00e9m sa prejavuje a\u017e do vydania Firefox pre Android 68.11.0<\/a><\/noindex> a odstr\u00e1nen\u00fd je vo verzii Firefox pre Android 79, t.j. star\u0161ie klasick\u00e9 vydania Firefoxu pre Android s\u00fa zranite\u013en\u00e9 a na blokovanie probl\u00e9mu je potrebn\u00e9 prejs\u0165 na nov\u00fa ed\u00edciu<\/a><\/noindex> prehliada\u010da (Fenix), v ktorej sa pou\u017e\u00edva engin GeckoView, postaven\u00fd na technol\u00f3gi\u00e1ch Firefox Quantum, a s\u00fabor kni\u017en\u00edc Mozilla Android Components<\/a><\/noindex>. Verzie Firefoxu pre stolov\u00e9 syst\u00e9my sa probl\u00e9mu net\u00fdkaj\u00fa.<\/p>\n

Na testovanie zranite\u013enosti bol pripraven\u00fd<\/a><\/noindex> pracovn\u00fd prototyp exploitu. \u00datok prebieha bez ak\u00fdchko\u013evek akci\u00ed zo strany pou\u017e\u00edvate\u013ea, sta\u010d\u00ed, aby na mobilnom zariaden\u00ed bol spusten\u00fd zranite\u013en\u00fd prehliada\u010d Firefox pre Android a aby sa obe\u0165 nach\u00e1dzala v tej istej podsieti s SSDP-serverom \u00fato\u010dn\u00edka. <\/p>\n

Firefox pre Android pravidelne v \u0161irok\u00e9ho vysielan\u00ed (multicast UDP) posiela SSDP-spr\u00e1vy na ur\u010denie pr\u00edtomn\u00fdch v lok\u00e1lnej sieti zariaden\u00ed vysielania, ako s\u00fa multimedi\u00e1lne prehr\u00e1va\u010de a inteligentn\u00e9 telev\u00edzory. V\u0161etky zariadenia v lok\u00e1lnej sieti prij\u00edmaj\u00fa tieto spr\u00e1vy a maj\u00fa mo\u017enos\u0165 posla\u0165 odpove\u010f. V norm\u00e1lnom re\u017eime zariadenie vracia odkaz na umiestnenie XML-s\u00faboru s inform\u00e1ciami o zariaden\u00ed podporuj\u00facom UPnP. Pri \u00fatoku je mo\u017en\u00e9 namiesto odkazu na XML posla\u0165 URI s intent-pr\u00edkazmi pre Android. <\/p>\n

Pomocou intent-pr\u00edkazov je mo\u017en\u00e9 presmerova\u0165 pou\u017e\u00edvate\u013ea na phishingov\u00e9 str\u00e1nky alebo mu poskytn\u00fa\u0165 odkaz na xpi s\u00fabor (prehliada\u010d navrhne nain\u0161talova\u0165 doplnok). Ke\u010f\u017ee odpovede \u00fato\u010dn\u00edka nie s\u00fa nijako obmedzen\u00e9, m\u00f4\u017ee sa pok\u00fasi\u0165 unavi\u0165 pou\u017e\u00edvate\u013ea a zaplavi\u0165 prehliada\u010d n\u00e1vrhmi na in\u0161tal\u00e1ciu alebo \u0161kodliv\u00fdmi str\u00e1nkami v n\u00e1deji, \u017ee si pou\u017e\u00edvate\u013e pom\u00fdli a klikne na in\u0161tal\u00e1ciu \u0161kodliv\u00e9ho bal\u00edka. Okrem otv\u00e1rania \u013eubovo\u013en\u00fdch odkazov v samotnom prehliada\u010di sa intent-pr\u00edkazy m\u00f4\u017eu pou\u017e\u00edva\u0165 aj na spracovanie obsahu v in\u00fdch aplik\u00e1ci\u00e1ch pre Android, napr\u00edklad je mo\u017en\u00e9 otvori\u0165 \u0161abl\u00f3nu e-mailu v po\u0161tovom klientovi (URI mailto:) alebo spusti\u0165 rozhranie na uskuto\u010dnenie hovoru (URI tel:).<\/p>\n


\n

<\/a><\/noindex><\/p>\n

Zdroj: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 Firefox \u0434\u043b\u044f Android \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0441\u0435\u0440\u044c\u0451\u0437\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 SSDP, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u0434\u043b\u044f \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432 \u0432 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443, \u043d\u0430\u0445\u043e\u0434\u044f\u0449\u0435\u043c\u0443\u0441\u044f \u0432 \u0442\u043e\u0439 \u0436\u0435 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043b\u0438 \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u043e\u0439 \u0441\u0435\u0442\u0438, \u043e\u0442\u0432\u0435\u0442\u0438\u0442\u044c \u043d\u0430 \u043f\u0440\u043e\u0432\u0435\u0440\u043e\u0447\u043d\u044b\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u044b Firefox \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0435\u043c UPnP XML «LOCATION» \u0441 intent-\u043a\u043e\u043c\u0430\u043d\u0434\u0430\u043c\u0438, \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043c\u043e\u0436\u043d\u043e \u043e\u0442\u043a\u0440\u044b\u0442\u044c \u0432 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 URI \u0438\u043b\u0438 \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-94683","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranite\u013enos\u0165 v Firefox pre Android, ktor\u00e1 umo\u017e\u0148uje ovl\u00e1da\u0165 prehliada\u010d cez verejn\u00e9 Wi-Fi | ProHoster","description":"V Firefox pre Android bola zisten\u00e1 v\u00e1\u017ena","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-v-firefox-dlya-android-pozvolyayushhaya-upravlyat-brauzerom-cherez-obshhij-wi-fi","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Firefox \u0434\u043b\u044f Android, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043e\u043c \u0447\u0435\u0440\u0435\u0437 \u043e\u0431\u0449\u0438\u0439 Wi-Fi | ProHoster","og:description":"\u0412 Firefox \u0434\u043b\u044f Android \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0441\u0435\u0440\u044c\u0451\u0437\u043d\u0430\u044f","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-v-firefox-dlya-android-pozvolyayushhaya-upravlyat-brauzerom-cherez-obshhij-wi-fi","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-09-19T23:42:01+00:00","article:modified_time":"2020-09-19T23:42:01+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"94683","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 11:21:10","updated":"2022-10-02 05:53:14","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/94683","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=94683"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/94683\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=94683"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=94683"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=94683"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}