{"id":40697,"date":"2020-02-03T14:36:04","date_gmt":"2020-02-03T11:36:04","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/obnovlenie-openwrt-19-07-1-s-ustraneniem-uyazvimosti-dopuskayushhej-podmenu-paketov"},"modified":"2020-02-03T14:36:04","modified_gmt":"2020-02-03T11:36:04","slug":"obnovlenie-openwrt-19-07-1-s-ustraneniem-uyazvimosti-dopuskayushhej-podmenu-paketov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/obnovlenie-openwrt-19-07-1-s-ustraneniem-uyazvimosti-dopuskayushhej-podmenu-paketov","title":{"rendered":"P\u00ebrdit\u00ebsimi OpenWrt 19.07.1 me rregullimin e nj\u00eb dob\u00ebsie q\u00eb lejon z\u00ebvend\u00ebsimin e pakove.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Shtesat korrektuese t\u00eb shp\u00ebrndarjes OpenWrt jan\u00eb publikuar 18.06.7<\/a><\/noindex> dhe 19.07.1<\/a><\/noindex>, n\u00eb t\u00eb cilat \u00ebsht\u00eb adresuar ndryshim i rreziksh\u00ebm<\/a><\/noindex> (CVE-2020-7982) n\u00eb menaxherin e paketave opkg<\/a><\/noindex>, i cili lejon realizimin e nj\u00eb sulmi MITM dhe ndryshimin e p\u00ebrmbajtjes s\u00eb paket\u00ebs q\u00eb merret nga repository. P\u00ebr shkak t\u00eb nj\u00eb gabimi n\u00eb kodin e verifikimit t\u00eb checksums, sulmuesi mund t\u00eb krijoj\u00eb kushte ku checksums SHA-256, t\u00eb pranish\u00ebm n\u00eb indeksin e paketave t\u00eb n\u00ebnshkruar me n\u00ebnshkrimin digjital, do t\u00eb injorohen, e cila jep mund\u00ebsin\u00eb t\u00eb kaloj\u00eb mekanizmat e verifikimit t\u00eb integritetit t\u00eb burimeve ipk q\u00eb po shkarkohen.<\/p>\n

Problemi shfaqet q\u00eb nga shkurt 2017, pas shtesave<\/a><\/noindex> kodit p\u00ebr t\u00eb injoruar hap\u00ebsirat fillestare q\u00eb vijojn\u00eb pas kontrollit t\u00eb checksum. P\u00ebr shkak t\u00eb nj\u00eb gabimi gjat\u00eb kalimit t\u00eb hap\u00ebsirave, treguesi nuk l\u00ebviz n\u00eb poziten n\u00eb varg dhe cikli i dekodimit t\u00eb sekuenc\u00ebs s\u00eb gjasht\u00ebmb\u00ebdhjet\u00eb \u00ebsht\u00eb menj\u00ebher\u00eb kthyer dhe ka dh\u00ebn\u00eb nj\u00eb checksum me gjat\u00ebsi zero. <\/p>\n

Duke menaxheri i paketave opkg n\u00eb OpenWrt ekzekutohet me t\u00eb drejtat root, n\u00eb rastin e nj\u00eb sulmi MITM, nj\u00eb sulmues ka mund\u00ebsin\u00eb t\u00eb b\u00ebj\u00eb ndryshime pa u v\u00ebn\u00eb re n\u00eb paket\u00ebn ipk q\u00eb ngarkohet nga repositori gjat\u00eb ekzekutimit t\u00eb komand\u00ebs \"opkg install\" nga p\u00ebrdoruesi, dhe t\u00eb organizoj\u00eb ekzekutimin e kodit t\u00eb tij me t\u00eb drejta root duke shtuar n\u00eb paket\u00eb skenar\u00ebt e tij t\u00eb p\u00ebrpunimit q\u00eb thirren gjat\u00eb instalimit. P\u00ebr t\u00eb shfryt\u00ebzuar k\u00ebt\u00eb vulnerabilitet, sulmuesi gjithashtu duhet t\u00eb organizoj\u00eb z\u00ebvend\u00ebsimin e indeksit t\u00eb paketave t\u00eb sakt\u00eb dhe t\u00eb n\u00ebnshkruar (p\u00ebr shembull, ai q\u00eb jepet nga downloads.openwrt.org). Madh\u00ebsia e paket\u00ebs s\u00eb ndryshuar duhet t\u00eb p\u00ebrputhet me madh\u00ebsin\u00eb origjinale t\u00eb p\u00ebrcaktuar n\u00eb indeks.<\/p>\n

N\u00eb situat\u00ebn kur \u00ebsht\u00eb e nevojshme t\u00eb kalojm\u00eb pa p\u00ebrdit\u00ebsuar t\u00ebr\u00eb firmware-n, mund t\u00eb p\u00ebrdit\u00ebsohet vet\u00ebm menaxheri i paketave opkg, duke ekzekutuar komandat e m\u00ebposhtme:<\/p>\n

cd \/tmp
\n opkg update
\n opkg download opkg
\n zcat .\/opkg-lists\/openwrt_base | grep -A10 \"Paket\u00eb: opkg\" | grep SHA256sum
\n sha256sum .\/opkg_2020-01-25-c09fe209-1_*.ipk<\/p>\n

Pastaj duhet t\u00eb krahasohen checksumet e treguara dhe n\u00ebse ato p\u00ebrputhen, t\u00eb ekzekutohet:<\/p>\n

opkg install .\/opkg_2020-01-25-c09fe209-1_*.ipk<\/p>\n

N\u00eb versionet e reja \u00ebsht\u00eb eliminuar gjithashtu nj\u00eb vulnerabiliteti<\/a><\/noindex> n\u00eb bibliotek\u00ebn libubox<\/a><\/noindex>, e cila mund t\u00eb \u00e7oj\u00eb n\u00eb mbip\u00ebrshkrim t\u00eb tamponit gjat\u00eb p\u00ebrpunimit n\u00eb funksionin blobmsg_format_json<\/a><\/noindex> t\u00eb t\u00eb dh\u00ebnave t\u00eb dizajnuara posa\u00e7\u00ebrisht t\u00eb serializuara binare ose t\u00eb dh\u00ebna n\u00eb formatin JSON. Biblioteca p\u00ebrdoret n\u00eb komponente t\u00eb shp\u00ebrndarjes si netifd, procd, ubus, rpcd dhe uhttpd, si dhe n\u00eb paket\u00ebn auc<\/a><\/noindex> (CLI p\u00ebr p\u00ebrdit\u00ebsimin e sistemit). Teprica e tamponit ndodh gjat\u00eb d\u00ebrgimit n\u00eb blloqet blob t\u00eb atributeve numerike t\u00eb m\u00ebdha me tipin \"double\". T\u00eb kontrollosh n\u00ebse sistemi \u00ebsht\u00eb i cenuesh\u00ebm nga kjo vulnerabilitet mund t\u00eb b\u00ebhet duke ekzekutuar komand\u00ebn:<\/p>\n

$ ubus call luci getFeatures \\
\n '{ \"banik\": 00192200197600198000198100200400.1922 }'<\/p>\n

P\u00ebrve\u00e7 eliminimit t\u00eb vulnerabiliteteve dhe korrigjimit t\u00eb gabimeve t\u00eb akumuluara n\u00eb versionin OpenWrt 19.07.1, gjithashtu u p\u00ebrdit\u00ebsua versione e kernelit Linux (nga 4.14.162 n\u00eb 4.14.167), jan\u00eb zgjidhur problemet me performanc\u00ebn kur p\u00ebrdoren frekuencat 5GHz, \u00ebsht\u00eb p\u00ebrmir\u00ebsuar mb\u00ebshtetje p\u00ebr pajisjet Ubiquiti Rocket M Titanium, Netgear WN2500RP v1,
\n Zyxel NSA325, Netgear WNR3500 V2, Archer C6 v2, Ubiquiti EdgeRouter-X, Archer C20 v4, Archer C50 v4, Archer MR200, TL-WA801ND v5, HiWiFi HC5962, Xiaomi Mi Router 3 Pro dhe Netgear R6350.<\/p>\n

<\/a><\/noindex><\/p>\n

Burimi: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430 OpenWrt 18.06.7 \u0438 19.07.1, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u043e\u043f\u0430\u0441\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-7982) \u0432 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u043c \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0435 opkg, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0442\u044c MITM-\u0430\u0442\u0430\u043a\u0443 \u0438 \u043f\u043e\u0434\u043c\u0435\u043d\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u043c\u043e\u0433\u043e \u0438\u0437 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u0430. \u0418\u0437-\u0437\u0430 \u043e\u0448\u0438\u0431\u043a\u0438 \u0432 \u043a\u043e\u0434\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u043d\u044b\u0445 \u0441\u0443\u043c\u043c, \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043c\u043e\u0436\u0435\u0442 \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u0443\u0441\u043b\u043e\u0432\u0438\u044f, \u043f\u0440\u0438 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u043d\u044b\u0435 \u0441\u0443\u043c\u043c\u044b SHA-256, \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u0432 \u0437\u0430\u0432\u0435\u0440\u0435\u043d\u043d\u043e\u043c \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u044c\u044e \u0438\u043d\u0434\u0435\u043a\u0441\u0435 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0431\u0443\u0434\u0443\u0442 \u0438\u0433\u043d\u043e\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u044b, \u0447\u0442\u043e \u0434\u0430\u0451\u0442 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-40697","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 P\u00ebrdit\u00ebsimi OpenWrt 19.07.1 me eliminimin e vulnerabilitetit q\u00eb i lejon z\u00ebvend\u00ebsimin e paketave | ProHoster","description":"Jan\u00eb publikuar versione korrigjuese t\u00eb distribucionit OpenWrt 18.06.7 dhe","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/obnovlenie-openwrt-19-07-1-s-ustraneniem-uyazvimosti-dopuskayushhej-podmenu-paketov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 OpenWrt 19.07.1 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0435\u0439 \u043f\u043e\u0434\u043c\u0435\u043d\u0443 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430 OpenWrt 18.06.7 \u0438","og:url":"https:\/\/prohoster.info\/sq\/blog\/obnovlenie-openwrt-19-07-1-s-ustraneniem-uyazvimosti-dopuskayushhej-podmenu-paketov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-03T11:36:04+00:00","article:modified_time":"2020-02-03T11:36:04+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"40697","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 00:32:41","updated":"2022-09-30 04:43:23","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/40697","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=40697"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/40697\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=40697"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=40697"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=40697"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}