{"id":101354,"date":"2021-09-21T10:22:45","date_gmt":"2021-09-21T08:22:45","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-openoffice-pozvolyayushhaya-vypolnit-kod-pri-otkrytii-fajla"},"modified":"2021-09-21T10:22:45","modified_gmt":"2021-09-21T08:22:45","slug":"uyazvimost-v-openoffice-pozvolyayushhaya-vypolnit-kod-pri-otkrytii-fajla","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-openoffice-pozvolyayushhaya-vypolnit-kod-pri-otkrytii-fajla","title":{"rendered":"Nj\u00eb dob\u00ebsi n\u00eb OpenOffice q\u00eb lejon ekzekutimin e kodit kur hapet nj\u00eb skedar.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

N\u00eb paket\u00ebn zyrtare Apache OpenOffice \u00ebsht\u00eb identifikuar nj\u00eb dob\u00ebsi (CVE-2021-33035), q\u00eb lejon ekzekutimin e kodit kur hapet nj\u00eb skedar i formatuar posa\u00e7\u00ebrisht n\u00eb formatin DBF. Studimi q\u00eb e zbuloi k\u00ebt\u00eb problem paralajm\u00ebroi p\u00ebr krijimin e nj\u00eb eksploituesi funksional p\u00ebr platform\u00ebn Windows. Rregullimi i dob\u00ebsis\u00eb aktualisht \u00ebsht\u00eb i disponuesh\u00ebm vet\u00ebm si nj\u00eb patch n\u00eb depot e projektit, q\u00eb \u00ebsht\u00eb p\u00ebrfshir\u00eb n\u00eb nd.build.test t\u00eb OpenOffice 4.1.11. P\u00ebrdit\u00ebsimet p\u00ebr deg\u00ebn stabile ende nuk jan\u00eb formuar. <\/p>\n

Problemi \u00ebsht\u00eb shkaktuar nga fakti q\u00eb gjat\u00eb ndarjes s\u00eb memories, OpenOffice mb\u00ebshtetej n\u00eb vlerat fieldLength dhe fieldType n\u00eb titujt e skedareve DBF, pa kontrolluar p\u00ebrputhshm\u00ebrin\u00eb me tipin e t\u00eb dh\u00ebnave reale n\u00eb fusha. P\u00ebr t\u00eb realizuar nj\u00eb sulm, mund t\u00eb tregohet n\u00eb vler\u00ebn fieldType tipi INTEGER, por t\u00eb vendosen t\u00eb dh\u00ebna t\u00eb dimensionit m\u00eb t\u00eb madh dhe t\u00eb tregohet nj\u00eb vler\u00eb fieldLength q\u00eb nuk p\u00ebrputhet me madh\u00ebsin\u00eb e t\u00eb dh\u00ebnave t\u00eb tipit INTEGER, duke e b\u00ebr\u00eb q\u00eb bishti i t\u00eb dh\u00ebnave nga fusha t\u00eb shkruhet jasht\u00eb tamponit t\u00eb ndar\u00eb. Si rezultat i mbushjes s\u00eb kontrolluar t\u00eb tamponit, hulumtuesi arriti t\u00eb tejkaloj\u00eb pointerin e rikthimit nga funksioni dhe me ndihm\u00ebn e teknikave t\u00eb programimit t\u00eb orientuar nga rikthimi (ROP \u2014 Return-Oriented Programming) t\u00eb realizoj\u00eb ekzekutimin e kodit t\u00eb tij. <\/p>\n

Duke p\u00ebrdorur teknik\u00ebn ROP, sulmuesi nuk p\u00ebrpiqet t\u00eb vendos\u00eb kodin e tij n\u00eb memorie, por operon me copa t\u00eb instrukcioneve makinerike q\u00eb tashm\u00eb ekzistojn\u00eb n\u00eb bibliotekat e ngarkuara, duke p\u00ebrfunduar me instrukcioni e rikthimit t\u00eb kontrollit (zakonisht, k\u00ebto jan\u00eb fundet e funksioneve t\u00eb bibliotekave). Puna e eksploitatit reduktohet n\u00eb nd\u00ebrtimin e nj\u00eb zinxhiri thirrjesh t\u00eb k\u00ebtyre blloqeve (\"gadgjete\") p\u00ebr t\u00eb arritur funksionalitetin e d\u00ebshiruar. Si gadgjete, n\u00eb eksploitatit p\u00ebr OpenOffice u p\u00ebrdor kodi nga biblioteka libxml2 q\u00eb p\u00ebrdoret n\u00eb OpenOffice, e cila, n\u00eb ndryshim nga vet\u00eb OpenOffice, u nd\u00ebrtua pa mekanizmat e mbrojtjes DEP (Data Execution Prevention) dhe ASLR (Address Space Layout Randomization). <\/p>\n

Zhvilluesit e OpenOffice u njoftuan p\u00ebr problemin m\u00eb 4 maj, pas s\u00eb cil\u00ebs u caktua nj\u00eb zbulim publik mbi t\u00eb dh\u00ebnat p\u00ebr k\u00ebt\u00eb dob\u00ebsi m\u00eb 30 gusht. Pasi q\u00eb deri n\u00eb afatin e parashikuar azhurnimi i deg\u00ebs stabile nuk u krijua, hulumtuesi e shtyu zbulimin e detajeve deri m\u00eb 18 shtator, por zhvilluesit e OpenOffice nuk arrit\u00ebn t\u00eb krijonin versionin 4.1.11 deri n\u00eb at\u00eb afat. \u00cbsht\u00eb e r\u00ebnd\u00ebsishme t\u00eb p\u00ebrmendet se gjat\u00eb t\u00eb nj\u00ebjtit hulumtim u zbulua nj\u00eb dob\u00ebsi e ngjashme n\u00eb kodin e mb\u00ebshtetjes s\u00eb formatit DBF n\u00eb Microsoft Office Access (CVE-2021\u201338646), detajet e s\u00eb cil\u00ebs do t\u00eb zbulohen m\u00eb von\u00eb. N\u00eb LibreOffice nuk jan\u00eb gjetur probleme.
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043e\u0444\u0438\u0441\u043d\u043e\u043c \u043f\u0430\u043a\u0435\u0442\u0435 Apache OpenOffice \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-33035), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 DBF. \u0412\u044b\u044f\u0432\u0438\u0432\u0448\u0438\u0439 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b \u043e \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0438 \u0440\u0430\u0431\u043e\u0447\u0435\u0433\u043e \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430 \u0434\u043b\u044f \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Windows. \u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u043a\u0430 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0444\u043e\u0440\u043c\u0435 \u043f\u0430\u0442\u0447\u0430 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432\u043e\u0448\u0451\u043b \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 \u0442\u0435\u0441\u0442\u043e\u0432\u044b\u0445 \u0441\u0431\u043e\u0440\u043e\u043a OpenOffice 4.1.11. \u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 \u043f\u043e\u043a\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101354","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabiliteti n\u00eb OpenOffice, i cili lejon ekzekutimin e kodit kur hapet nj\u00eb skedar | ProHoster","description":"N\u00eb paket\u00ebn zyrtare Apache OpenOffice \u00ebsht\u00eb zbuluar nj\u00eb vulnerabilitet (CVE-2021-33035), i cili mund\u00ebson ekzekutimin e kodit kur hapet nj\u00eb skedar i formatuar posa\u00e7\u00ebrisht n\u00eb formatin DBF.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-openoffice-pozvolyayushhaya-vypolnit-kod-pri-otkrytii-fajla","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 OpenOffice, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438 \u0444\u0430\u0439\u043b\u0430 | ProHoster","og:description":"\u0412 \u043e\u0444\u0438\u0441\u043d\u043e\u043c \u043f\u0430\u043a\u0435\u0442\u0435 Apache OpenOffice \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-33035), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 DBF.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-openoffice-pozvolyayushhaya-vypolnit-kod-pri-otkrytii-fajla","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-09-21T08:22:45+00:00","article:modified_time":"2021-09-21T08:22:45+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101354","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-09-21 08:27:59","updated":"2022-10-03 20:50:17","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/101354","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=101354"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/101354\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=101354"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=101354"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=101354"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}