{"id":105445,"date":"2022-11-02T03:36:49","date_gmt":"2022-11-02T01:36:49","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/perepolnenie-bufera-v-openssl-ekspluatiruemoe-pri-proverke-sertifikatov-x-509"},"modified":"2022-11-02T03:36:49","modified_gmt":"2022-11-02T01:36:49","slug":"perepolnenie-bufera-v-openssl-ekspluatiruemoe-pri-proverke-sertifikatov-x-509","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/perepolnenie-bufera-v-openssl-ekspluatiruemoe-pri-proverke-sertifikatov-x-509","title":{"rendered":"Shfryt\u00ebzimi i tepric\u00ebs n\u00eb OpenSSL, i shfryt\u00ebzuar gjat\u00eb verifikimit t\u00eb certifikatave X.509","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
\u00cbsht\u00eb publikuar nj\u00eb version korrigjues i bibliotek\u00ebs kriptografike OpenSSL 3.0.7, n\u00eb t\u00eb cilin jan\u00eb eliminuar dy dob\u00ebsi. T\u00eb dy problemet shkaktohen nga mbushja e tamponit n\u00eb kodin q\u00eb kontrollon fush\u00ebn e adres\u00ebs s\u00eb emailit n\u00eb certifikatat X.509 dhe potencialisht mund t\u00eb \u00e7ojn\u00eb n\u00eb ekzekutimin e kodit gjat\u00eb p\u00ebrpunimit t\u00eb nj\u00eb certifikate t\u00eb formuar n\u00eb m\u00ebnyr\u00eb t\u00eb ve\u00e7ant\u00eb. N\u00eb momentin e publikimit t\u00eb rregullimeve, zhvilluesit e OpenSSL nuk kishin regjistruar ndonj\u00eb fakt t\u00eb ekzistenc\u00ebs s\u00eb nj\u00eb eksploituesi funksional q\u00eb mund t\u00eb \u00e7onte n\u00eb ekzekutimin e kodit t\u00eb sulmuesit. <\/p>\n
Megjith\u00ebse n\u00eb nj\u00eb njoftim t\u00eb publikuar m\u00eb par\u00eb p\u00ebr versionin e ri u p\u00ebrmend ekzistenca e nj\u00eb problemi kritik, faktikisht n\u00eb p\u00ebrdit\u00ebsimin e l\u00ebshuar statusi i dob\u00ebsis\u00eb u ul n\u00eb nivelin e nj\u00eb dob\u00ebsie t\u00eb rrezikshme, por jo kritike. Sipas rregullave t\u00eb pranuara n\u00eb projekt, ulja e nivelit t\u00eb rrezikshm\u00ebris\u00eb b\u00ebhet n\u00eb rastin e shfaqjes s\u00eb problemit n\u00eb konfigurime jo tipike apo n\u00eb rastin e nj\u00eb probabiliteti t\u00eb ul\u00ebt p\u00ebr shfryt\u00ebzimin e dob\u00ebsis\u00eb n\u00eb praktik\u00eb. <\/p>\n
N\u00eb rastin e shqyrtuar, niveli i rrezikut u ul, pasi n\u00ebp\u00ebrmjet nj\u00eb analize t\u00eb detajuar t\u00eb dob\u00ebsive, disa organizata p\u00ebrfunduan se mund\u00ebsia e ekzekutimit t\u00eb kodit gjat\u00eb shfryt\u00ebzimit \u00ebsht\u00eb bllokuar nga mekanizmat e mbrojtjes kund\u00ebr mbushjes s\u00eb stack-ut q\u00eb aplikohen n\u00eb shum\u00eb platforma. P\u00ebr m\u00eb tep\u00ebr, aranzhimi i rrjetit t\u00eb aplikuar n\u00eb disa shp\u00ebrndarje t\u00eb Linux-it b\u00ebn q\u00eb dalja jasht\u00eb kufijve t\u00eb 4 byte-ve t\u00eb p\u00ebrplaset me buffer-in e ardhsh\u00ebm n\u00eb stack, q\u00eb ende nuk \u00ebsht\u00eb p\u00ebrdorur. Megjithat\u00eb, nuk p\u00ebrjashtohet mund\u00ebsia q\u00eb t\u00eb ekzistojn\u00eb platforma t\u00eb tjera, n\u00eb t\u00eb cilat \u00ebsht\u00eb e mundur shfryt\u00ebzimi p\u00ebr ekzekutimin e kodit. <\/p>\n