Kusagadzikana muFirefox yeAroid iyo inobvumira bhurawuza kuti ridzorerwe pane yakagovaniswa Wi-Fi

MuFirefox ye Android kuzivikanwa zvakakomba vulnerability mukuita kweprotocol SSDP, inoshandiswa kuwana masevhisi etiweki pane network yemuno. Kusagadzikana kunobvumira anorwisa ari panzvimbo imwecheteyo kana isina waya network kuti apindure kune zvikumbiro zveFirefox probe neUPnP XML "LOCATION" meseji ine. mirairo yevavariro, iyo yaunogona kuvhura nayo inopokana URI mubrowser kana kufonera vanobata mamwe maapplication.

Dambudziko rinozviratidza kusvikira rasunungurwa Firefox ye Android 68.11.0 uye yakabviswa mushanduro yeFirefox ye Android 79, i.e. ekare edhisheni eFirefox yeAroid ari panjodzi uye inoda kukwidziridzwa kuti new edition browser (Fenix), inoshandisa injini yeGeckoView, yakavakirwa paFirefox Quantum tekinoroji, uye seti yemaraibhurari. Mozilla Android Zvikamu. Desktop shanduro dzeFirefox hadzina kukanganiswa nenyaya iyi.

Zvekuongororwa kushaya simba gadzirira kushanda prototype yekushandiswa. Kurwiswa kwacho kunoitwa pasina chero chiito kune chikamu chemushandisi; zvakakwana kuti Firefox browser ye Android iri kushanda panhare mbozha uye kuti munhu anenge abatwa ari pane imwechete subnet seanorwisa SSDP server.

Firefox yeAroid nguva nenguva inotumira mameseji eSSDP mune yekutepfenyura modhi (multicast UDP) yekuona michina yekutepfenyura senge multimedia vatambi uye smart TVs aripo pane yemuno network. Midziyo yese iri panetiweki yemuno inogamuchira aya mameseji uye inokwanisa kutumira mhinduro. Kazhinji, mudziyo unodzosera chinongedzo kunzvimbo yefaira reXML rine ruzivo nezve UPnP-inogonesa mudziyo. Paunenge uchirwisa, pane chinongedzo kuXML, unogona kupfuudza URI uine mirairo ye Android.

Uchishandisa mirairo yechinangwa, unogona kuendesa mushandisi kunzvimbo dzekubira kana kupfuudza chinongedzo kune xpi faira (browser inokuita kuti uise iyo yekuwedzera). Sezvo mhinduro dzeanorwisa dzisina kuganhurirwa munzira ipi neipi, anogona kuyedza kufa nenzara uye mafashama browser nezvipo zvekuisa kana masaiti ane hutsinye achitarisira kuti mushandisi akanganisa odzvanya kuisa iyo yakaipa package. Pamusoro pekuvhura zvinongedzo mubrowser pachayo, mirairo yechinangwa inogona kushandiswa kugadzirisa zvirimo mune mamwe maapplication eAroid, semuenzaniso, unogona kuvhura template yetsamba mune email mutengi (URI mailto :) kana kuvhura interface yekufona. (URI tel:).

Source: opennet.ru