{"id":105445,"date":"2022-11-02T03:36:49","date_gmt":"2022-11-02T01:36:49","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/perepolnenie-bufera-v-openssl-ekspluatiruemoe-pri-proverke-sertifikatov-x-509"},"modified":"2022-11-02T03:36:49","modified_gmt":"2022-11-02T01:36:49","slug":"perepolnenie-bufera-v-openssl-ekspluatiruemoe-pri-proverke-sertifikatov-x-509","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/perepolnenie-bufera-v-openssl-ekspluatiruemoe-pri-proverke-sertifikatov-x-509","title":{"rendered":"Tejmbushje e buferit n\u00eb OpenSSL, e shfryt\u00ebzueshme gjat\u00eb verifikimit t\u00eb certifikatave X.509","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
\u00cbsht\u00eb publikimi i nj\u00eb versioni korrigjues t\u00eb bibliotek\u00ebs kriptografike OpenSSL 3.0.7, ku jan\u00eb eliminuar dy dob\u00ebsi. T\u00eb dyja problemet jan\u00eb shkaktuar nga mbushja e tamponit n\u00eb kodin e verifikimit t\u00eb fush\u00ebs me adres\u00ebn e email-it n\u00eb certifikatat X.509 dhe potencialisht mund t\u00eb \u00e7ojn\u00eb n\u00eb ekzekutimin e kodit gjat\u00eb p\u00ebrpunimit t\u00eb nj\u00eb certifikate t\u00eb formatuar posa\u00e7\u00ebrisht. N\u00eb momentin e publikimit t\u00eb korrigjimeve, zhvilluesit e OpenSSL nuk kishin regjistruar asnj\u00eb rast t\u00eb nj\u00eb eksploati t\u00eb punueshme q\u00eb mund t\u00eb \u00e7onte n\u00eb ekzekutimin e kodit nga sulmuesi. <\/p>\n
Megjith\u00ebse n\u00eb njoftimin e publikuar m\u00eb par\u00eb p\u00ebr versionin e ri p\u00ebrmendej nj\u00eb problem kritik, n\u00eb fakt statusi i dob\u00ebsis\u00eb n\u00eb p\u00ebrdit\u00ebsimin e l\u00ebshuar ishte ulur n\u00eb nivelin e rrezikshm\u00ebris\u00eb, por jo kritik. Sipas rregullave t\u00eb pranuara n\u00eb projekt, ulja e niveleve t\u00eb rrezikshm\u00ebris\u00eb ndodhi n\u00eb rastin e manifestimit t\u00eb problemit n\u00eb konfigurations jo tipike ose n\u00eb rastin e mund\u00ebsis\u00eb s\u00eb ul\u00ebt p\u00ebr shfryt\u00ebzimin e dob\u00ebsis\u00eb n\u00eb praktike. <\/p>\n
N\u00eb rastin n\u00eb fjal\u00eb, niveli i rrezikshm\u00ebris\u00eb u ul pasi gjat\u00eb nj\u00eb analize t\u00eb detajuar t\u00eb dob\u00ebsis\u00eb nga disa organizata u arrit n\u00eb p\u00ebrfundimin se mund\u00ebsia e ekzekutimit t\u00eb kodit gjat\u00eb shfryt\u00ebzimit bllokohet nga mekanizmat e mbrojtjes kund\u00ebr mbushjes s\u00eb tamponit q\u00eb p\u00ebrdoren n\u00eb shum\u00eb platforma. P\u00ebr m\u00eb tep\u00ebr, organizimi i caktuar n\u00eb disa distribucione Linux b\u00ebn\u00eb q\u00eb daljet p\u00ebrtej 4 byte t\u00eb kalonin n\u00eb tamponin e m\u00ebpassh\u00ebm n\u00eb stack q\u00eb nuk \u00ebsht\u00eb akoma n\u00eb p\u00ebrdorim. Sidoqoft\u00eb, nuk p\u00ebrjashtohet mund\u00ebsia q\u00eb t\u00eb ekzistojn\u00eb platforma t\u00eb tilla ku shfryt\u00ebzimi p\u00ebr ekzekutimin e kodit \u00ebsht\u00eb i mundsh\u00ebm. <\/p>\n