{"id":102629,"date":"2021-12-16T03:36:46","date_gmt":"2021-12-16T01:36:46","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/perepolnenie-bufera-v-toxcore-ekspluatiruemoe-cherez-otpravku-udp-paketa"},"modified":"2021-12-16T03:36:46","modified_gmt":"2021-12-16T01:36:46","slug":"perepolnenie-bufera-v-toxcore-ekspluatiruemoe-cherez-otpravku-udp-paketa","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/perepolnenie-bufera-v-toxcore-ekspluatiruemoe-cherez-otpravku-udp-paketa","title":{"rendered":"Shkall\u00ebzimi i bufrit n\u00eb Toxcore, i shfryt\u00ebzuar p\u00ebrmes d\u00ebrgimit t\u00eb paketave UDP","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
N\u00eb Toxcore, implementimi referent i protokollit P2P p\u00ebr shk\u00ebmbim mesazhe Tox, u zbulua nj\u00eb vulnerabilitet (CVE-2021-44847) q\u00eb potencialisht lejon iniciimin e ekzekutimit t\u00eb kodit gjat\u00eb p\u00ebrpunimit t\u00eb nj\u00eb pakete UDP t\u00eb formuar posa\u00e7\u00ebrisht. T\u00eb gjith\u00eb p\u00ebrdoruesit e aplikacioneve t\u00eb bazuara n\u00eb Toxcore, p\u00ebr t\u00eb cilat nuk \u00ebsht\u00eb \u00e7aktivizuar transporti UDP, jan\u00eb t\u00eb ndjesh\u00ebm ndaj k\u00ebtij vulnerabiliteti. P\u00ebr t\u00eb kryer nj\u00eb sulm, mjafton t\u00eb d\u00ebrgohet nj\u00eb paket\u00eb UDP me dijeni p\u00ebr adres\u00ebn IP, portin rrjetor dhe \u00e7el\u00ebsin DHT t\u00eb hapur t\u00eb viktim\u00ebs (kjo informacion \u00ebsht\u00eb n\u00eb dispozicion publik n\u00eb DHT, \u00e7ka do t\u00eb thot\u00eb se sulmi mund t\u00eb kryhet ndaj \u00e7do p\u00ebrdoruesi ose nodi DHT). <\/p>\n
Problemi u shfaq n\u00eb versionet e toxcore nga 0.1.9 deri n\u00eb 0.2.12 dhe u eliminua n\u00eb versionin 0.2.13. Nga aplikacionet klient, p\u00ebrdit\u00ebsimin p\u00ebr eliminimin e vulnerabilitetit deri tani e ka l\u00ebshuar vet\u00ebm projekti qTox. Si nj\u00eb zgjidhje mbrojt\u00ebse, mund t\u00eb \u00e7aktivizohet p\u00ebrdorimi i UDP, duke l\u00ebn\u00eb mb\u00ebshtetje p\u00ebr TCP. <\/p>\n
Dob\u00ebsia shkaktohet nga mbipopullimi i tamponit n\u00eb funksionin handle_request(), q\u00eb ndodh p\u00ebr shkak t\u00eb llogaritjes jo t\u00eb sakt\u00eb t\u00eb madh\u00ebsis\u00eb s\u00eb t\u00eb dh\u00ebnave n\u00eb paket\u00ebn e rrjetit. N\u00eb ve\u00e7anti, gjat\u00ebsi e t\u00eb dh\u00ebnave t\u00eb enkriptuara u p\u00ebrcaktua n\u00eb makron CRYPTO_SIZE, e cila u definuar si \"1 + CRYPTO_PUBLIC_KEY_SIZE * 2 + CRYPTO_NONCE_SIZE\", e cila m\u00eb von\u00eb u p\u00ebrdor n\u00eb operacionin e zbritjes \"length - CRYPTO_SIZE\". P\u00ebr shkak t\u00eb munges\u00ebs s\u00eb kllapave n\u00eb makro, n\u00eb vend t\u00eb zbritjes s\u00eb shum\u00ebs s\u00eb t\u00eb gjitha vlerave, u krye zbritja e 1 dhe shtimi i pjes\u00ebve t\u00eb tjera. P\u00ebr shembull, n\u00eb vend t\u00eb \"length - (1 + 32 * 2 + 24)\" gjat\u00ebsia e tamponit u llogarit si \"length - 1 + 32 * 2 + 24\", e cila \u00e7oi n\u00eb mbivendosjen e t\u00eb dh\u00ebnave n\u00eb grumbull, q\u00eb ndodh jasht\u00eb tamponit. \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"