{"id":102629,"date":"2021-12-16T03:36:46","date_gmt":"2021-12-16T01:36:46","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/perepolnenie-bufera-v-toxcore-ekspluatiruemoe-cherez-otpravku-udp-paketa"},"modified":"2021-12-16T03:36:46","modified_gmt":"2021-12-16T01:36:46","slug":"perepolnenie-bufera-v-toxcore-ekspluatiruemoe-cherez-otpravku-udp-paketa","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/perepolnenie-bufera-v-toxcore-ekspluatiruemoe-cherez-otpravku-udp-paketa","title":{"rendered":"Te Toxcore, mbingarkimi i buffer-it, i shfryt\u00ebzuar p\u00ebrmes d\u00ebrgimit t\u00eb nj\u00eb pakete UDP","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

N\u00eb Toxcore, nj\u00eb implementim referimi i protokollit P2P p\u00ebr shk\u00ebmbim mesazhi Tox, \u00ebsht\u00eb identifikuar nj\u00eb vulnerabilitet (CVE-2021-44847), i cili potencialisht lejon iniciimin e ekzekutimit t\u00eb kodit gjat\u00eb trajtimit t\u00eb nj\u00eb pakete UDP t\u00eb formatuar n\u00eb m\u00ebnyr\u00eb t\u00eb ve\u00e7ant\u00eb. T\u00eb gjith\u00eb p\u00ebrdoruesit e aplikacioneve bazuar n\u00eb Toxcore, n\u00eb t\u00eb cilat nuk \u00ebsht\u00eb \u00e7aktivizuar transporti UDP, jan\u00eb t\u00eb predispozuar ndaj k\u00ebtij vulnerabiliteti. P\u00ebr t\u00eb sulmuar, mjafton t\u00eb d\u00ebrgohet nj\u00eb paket\u00eb UDP, duke e ditur adres\u00ebn IP, portin e rrjetit dhe \u00e7el\u00ebsin e hapur DHT t\u00eb viktim\u00ebs (k\u00ebto t\u00eb dh\u00ebna jan\u00eb n\u00eb dispozicion publikisht n\u00eb DHT, pra, sulmi mund t\u00eb kryhej ndaj \u00e7do p\u00ebrdoruesi ose nyjeje DHT). <\/p>\n

Problemi shfaqej n\u00eb versionet e toxcore nga 0.1.9 deri n\u00eb 0.2.12 dhe \u00ebsht\u00eb eliminuar n\u00eb versionin 0.2.13. Deri m\u00eb tani, vet\u00ebm projekti qTox ka l\u00ebshuar nj\u00eb azhurnim p\u00ebr klient\u00ebt q\u00eb zgjidh k\u00ebt\u00eb vulnerabilitet. Si nj\u00eb zgjidhje alternative p\u00ebr mbrojtje, mund t\u00eb \u00e7aktivizohet p\u00ebrdorimi i UDP, duke l\u00ebn\u00eb mb\u00ebshtetje p\u00ebr TCP. <\/p>\n

Vulnerabiliteti i shkaktuar nga mbushja e bufrit n\u00eb funksionin handle_request(), e cila ndodh p\u00ebr shkak t\u00eb kalkulimit t\u00eb gabuar t\u00eb madh\u00ebsis\u00eb s\u00eb t\u00eb dh\u00ebnave n\u00eb paket\u00ebn rrjet. Konkretisht, gjat\u00ebsia e t\u00eb dh\u00ebnave t\u00eb enkriptuara \u00ebsht\u00eb p\u00ebrcaktuar n\u00eb makron CRYPTO_SIZE, e cila \u00ebsht\u00eb p\u00ebrcaktuar si \"1 + CRYPTO_PUBLIC_KEY_SIZE * 2 + CRYPTO_NONCE_SIZE\", e cila m\u00eb pas u p\u00ebrdor n\u00eb operacionin e zbritjes \"length - CRYPTO_SIZE\". P\u00ebr shkak t\u00eb munges\u00ebs s\u00eb kapanjeve n\u00eb makro, n\u00eb vend t\u00eb zbritjes s\u00eb shum\u00ebs t\u00eb t\u00eb gjitha vlerave, u krye zbritja e 1 dhe lidhja e pjes\u00ebve t\u00eb tjera. P\u00ebr shembull, n\u00eb vend t\u00eb \"length - (1 + 32 * 2 + 24)\", madh\u00ebsia e bufrit u llogarit si \"length - 1 + 32 * 2 + 24\", e cila \u00e7oi n\u00eb mbivendosjen e t\u00eb dh\u00ebnave n\u00eb stack, q\u00eb ndodhen p\u00ebrtej bufrit.
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 Toxcore, \u044d\u0442\u0430\u043b\u043e\u043d\u043d\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 P2P-\u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 \u043e\u0431\u043c\u0435\u043d\u0430 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f\u043c\u0438 Tox, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-44847), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0438\u043d\u0438\u0446\u0438\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e UDP-\u043f\u0430\u043a\u0435\u0442\u0430. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b \u0432\u0441\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u043d\u0430 \u0431\u0430\u0437\u0435 Toxcore, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043d\u0435 \u043e\u0442\u043a\u043b\u044e\u0447\u0451\u043d \u0442\u0440\u0430\u043d\u0441\u043f\u043e\u0440\u0442 UDP. \u0414\u043b\u044f \u0430\u0442\u0430\u043a\u0438 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c UDP-\u043f\u0430\u043a\u0435\u0442, \u0437\u043d\u0430\u044f IP-\u0430\u0434\u0440\u0435\u0441, \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u043f\u043e\u0440\u0442 \u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 DHT-\u043a\u043b\u044e\u0447 \u0436\u0435\u0440\u0442\u0432\u044b (\u0434\u0430\u043d\u043d\u044b\u0435 \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e \u0432 DHT, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102629","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Mbipopullimi i buffers n\u00eb Toxcore, i shfryt\u00ebzuar p\u00ebrmes d\u00ebrgimit t\u00eb nj\u00eb pakete UDP | ProHoster","description":"N\u00eb Toxcore, nj\u00eb implementim referimi i protokollit P2P p\u00ebr shk\u00ebmbim mesazhi Tox, \u00ebsht\u00eb identifikuar nj\u00eb vulnerabilitet (CVE-2021-44847), i cili potencialisht lejon iniciimin e ekzekutimit t\u00eb kodit gjat\u00eb trajtimit t\u00eb nj\u00eb pakete UDP t\u00eb formatuar n\u00eb m\u00ebnyr\u00eb t\u00eb ve\u00e7ant\u00eb.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/perepolnenie-bufera-v-toxcore-ekspluatiruemoe-cherez-otpravku-udp-paketa","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 Toxcore, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u043e\u0435 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 UDP-\u043f\u0430\u043a\u0435\u0442\u0430 | ProHoster","og:description":"\u0412 Toxcore, \u044d\u0442\u0430\u043b\u043e\u043d\u043d\u043e\u0439 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 P2P-\u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 \u043e\u0431\u043c\u0435\u043d\u0430 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f\u043c\u0438 Tox, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-44847), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0438\u043d\u0438\u0446\u0438\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e UDP-\u043f\u0430\u043a\u0435\u0442\u0430.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/perepolnenie-bufera-v-toxcore-ekspluatiruemoe-cherez-otpravku-udp-paketa","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-12-16T01:36:46+00:00","article:modified_time":"2021-12-16T01:36:46+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102629","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-12-16 01:37:03","updated":"2022-10-02 18:35:56","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/102629","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=102629"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/102629\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=102629"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=102629"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=102629"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}