{"id":123495,"date":"2025-04-14T09:05:08","date_gmt":"2025-04-14T07:05:08","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/perepolnenie-bufera-v-perl-svyazannoe-s-obrabotkoj-simvolov"},"modified":"2025-04-14T09:05:08","modified_gmt":"2025-04-14T07:05:08","slug":"perepolnenie-bufera-v-perl-svyazannoe-s-obrabotkoj-simvolov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/perepolnenie-bufera-v-perl-svyazannoe-s-obrabotkoj-simvolov","title":{"rendered":"P\u00ebrmbushja e buferit n\u00eb Perl, e lidhur me p\u00ebrpunimin e simboleve","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Ajan\u00eb n\u00eb dispozicion p\u00ebrdit\u00ebsime korrigjuese t\u00eb interpreterit Perl 5.40.2 dhe 5.38.4, t\u00eb cilat zgjidhin nj\u00eb vulnerabilitet (CVE-2024-56406) q\u00eb \u00e7on n\u00eb mbushjen e tamponit gjat\u00eb transliterimit t\u00eb karaktereve t\u00eb ve\u00e7anta jo-ASCII p\u00ebrmes operatorit «tr\/....\/». Nuk p\u00ebrjashtohet mund\u00ebsia e shfryt\u00ebzimit t\u00eb k\u00ebtij vulnerabiliteti p\u00ebr t\u00eb ekzekutuar kod privat n\u00eb sistem. Problemi shfaqet n\u00eb versionet stabil t\u00eb Perl q\u00eb nga viti 2021 dhe prek deg\u00ebt Perl 5.34, 5.36, 5.38 dhe 5.40. Mund t\u00eb ndiqni zgjidhjen e vulnerabilitetit n\u00eb distribucione t\u00eb ndryshme si: Debian, Ubuntu, Fedora, Arch, FreeBSD. Distribucione t\u00eb bazuara n\u00eb RHEL 9, SUSE 15 dhe openSUSE Leap 15.6 nuk jan\u00eb t\u00eb ndjeshme ndaj vulnerabilitetit, pasi p\u00ebrfshijn\u00eb versionet Perl 5.32 dhe 5.26. <\/p>\n
Vulnerabiliteti ndikon n\u00eb programet q\u00eb p\u00ebrdorin t\u00eb dh\u00ebna t\u00eb pa verifikuara n\u00eb an\u00ebn e majt\u00eb t\u00eb operatorit «tr», ku citohet nj\u00eb variab\u00ebl me t\u00eb dh\u00ebnat p\u00ebr z\u00ebvend\u00ebsimin e karaktereve (p.sh., «$external_string =~ tr\/a\/b\/»). N\u00eb funksionet q\u00eb p\u00ebrpunojn\u00eb operacionin e operatorit S_do_trans_invmap(), gjat\u00eb p\u00ebrpunimit t\u00eb disa bajtave jo-ASCII ndodhin k\u00ebrkesa p\u00ebr kujtes\u00eb jasht\u00eb buffers t\u00eb alokuar. Mbushja ndodh p\u00ebr shkak se disa sekuenca bajtash n\u00eb datasetin origjinal mund t\u00eb konvertohen n\u00eb sekuenca UTF-8, p\u00ebr t\u00eb cilat k\u00ebrkohen dy bajta n\u00eb vend t\u00eb nj\u00eb. <\/p>\n
\u00cbsht\u00eb shqet\u00ebsuese se vulnerabiliteti ndodhi pas ndryshimit t\u00eb shtuar n\u00eb vitin 2020 q\u00eb heq kontrollin shtes\u00eb p\u00ebr alokimin e mjaftuesh\u00ebm t\u00eb kujtes\u00ebs n\u00ebn pretekstin se gjat\u00eb llogaritjes s\u00eb madh\u00ebsis\u00eb \u00ebsht\u00eb e mjaftueshme t\u00eb rroundohet madh\u00ebsia n\u00eb an\u00ebn e madhe. P\u00ebr t\u00eb kontrolluar pranin\u00eb e vulnerabilitetit mund t\u00eb ekzekutoni kodin: perl -e ‘$_ = «\x{FF}» x 1000000; tr\/\xFF\/\x{100}\/;’ D\u00ebshtim i segmentimit (b\u00ebrthama e hedhur) \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"