{"id":54354,"date":"2019-12-24T00:00:00","date_gmt":"2019-12-23T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/uyazvimost-v-sqlite-pozvolyayushhaya-udalyonno-atakovat-chrome-cherez-websql"},"modified":"2020-02-18T14:02:21","modified_gmt":"2020-02-18T11:02:21","slug":"uyazvimost-v-sqlite-pozvolyayushhaya-udalyonno-atakovat-chrome-cherez-websql","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-sqlite-pozvolyayushhaya-udalyonno-atakovat-chrome-cherez-websql","title":{"rendered":"Nj\u00eb vulnerabilitet n\u00eb SQLite, q\u00eb lejon t\u00eb sulmohet ndjem\u00eb p\u00ebrmes WebSQL","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

K\u00ebrkuesit e siguris\u00eb nga kompania kineze Tencent prezantuan<\/a><\/noindex> variasi i ri i dob\u00ebsis\u00eb Magellan<\/a><\/noindex> (CVE-2019-13734<\/a><\/noindex>), q\u00eb mund\u00ebson ekzekutimin e kodit gjat\u00eb p\u00ebrpunimit n\u00eb DBMS SQLite t\u00eb nd\u00ebrtuar n\u00eb nj\u00eb m\u00ebnyr\u00eb t\u00eb caktuar me SQL. Nj\u00eb dob\u00ebsi e ngjashme ishte u publikua<\/a><\/noindex> zbulua nga t\u00eb nj\u00ebjtit k\u00ebrkues nj\u00eb vit m\u00eb par\u00eb. Kjo dob\u00ebsi \u00ebsht\u00eb e njohur p\u00ebr faktin se lejon sulm m\u00eb larg\u00ebsi ndaj shfletuesit Chrome dhe mund\u00ebson marrjen e kontrollit mbi sistemin e p\u00ebrdoruesit kur hapin faqe web q\u00eb kontrollohen nga keqb\u00ebr\u00ebsit. <\/p>\n

Sulmi ndaj Chrome\/Chromium realizohet p\u00ebrmes API-s\u00eb WebSQL, analiza e s\u00eb cil\u00ebs bazohet n\u00eb kodin SQLite. Sulmi ndaj aplikacioneve t\u00eb tjera \u00ebsht\u00eb i mundur vet\u00ebm n\u00ebse ato lejojn\u00eb transferimin n\u00eb SQLite t\u00eb strukturave SQL nga jasht\u00eb, p\u00ebr shembull, n\u00ebse p\u00ebrdorin SQLite si format p\u00ebr shk\u00ebmbimin e t\u00eb dh\u00ebnave. Firefox nuk \u00ebsht\u00eb i ekspozuar ndaj k\u00ebsaj dobie, pasi kompania Mozilla refuzoi<\/a><\/noindex> implementimin e WebSQL n\u00eb p\u00ebrfitim<\/a><\/noindex> API-s\u00eb IndexedDB. <\/p>\n

Google e eliminoi problemin n\u00eb l\u00ebshimin Chrome 79<\/a><\/noindex>. N\u00eb baz\u00ebn e kodit SQLite problemi ishte u rregullua<\/a><\/noindex> 17 N\u00ebntor, dhe n\u00eb baz\u00ebn e kodit t\u00eb Chromium-it \u2014 m\u00eb 21 n\u00ebntor<\/a><\/noindex>.
\nProblemi \u00ebsht\u00eb i pranish\u00ebm n\u00eb kode<\/a><\/noindex> motorin e k\u00ebrkimit t\u00eb plot\u00eb FTS3 dhe p\u00ebrmes manipulimit me tavolat\u00eb p\u00ebrkat\u00ebshe (shadow tables, nj\u00eb lloj i ve\u00e7ant\u00eb tabelash virtuale me mund\u00ebsi shkrimi) mund t\u00eb \u00e7oj\u00eb n\u00eb d\u00ebmtimin e indeksit dhe mbipopullimin e memories. Informacioni gjithnj\u00eb e m\u00eb i detajuar mbi teknik\u00ebn e shfryt\u00ebzimit do t\u00eb publikohet brenda 90 dit\u00ebve.<\/p>\n

L\u00ebshimi i ri i SQLite me riparimin ende nuk \u00ebsht\u00eb formuar<\/a><\/noindex> (pritet<\/a><\/noindex> (31 dhjetor). Si nj\u00eb rrug\u00ebdalje p\u00ebr mbrojtjen duke filluar nga SQLite 3.26.0 mund t\u00eb p\u00ebrdoret moda SQLITE_DBCONFIG_DEFENSIVE, e cila ndalon shkrimin n\u00eb tavollat e p\u00ebrkat\u00ebshe dhe rekomandohet t\u00eb aktivizohet gjat\u00eb p\u00ebrpunimit t\u00eb k\u00ebrkesave SQL nga jasht\u00eb n\u00eb SQLite. N\u00eb shp\u00ebrndarjet dob\u00ebsia n\u00eb bibliotek\u00ebn SQLite ende mbetet e pap\u00ebrmir\u00ebsuar n\u00eb Debian<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, RHEL<\/a><\/noindex>, openSUSE\/SUSE<\/a><\/noindex>, Arch Linux<\/a><\/noindex>, Fedora<\/a><\/noindex>, FreeBSD<\/a><\/noindex>. Chromium \u00ebsht\u00eb p\u00ebrdit\u00ebsuar n\u00eb t\u00eb gjitha shp\u00ebrndarjet dhe nuk \u00ebsht\u00eb i ekspozuar ndaj dob\u00ebsis\u00eb, por problemi mund t\u00eb p\u00ebrfshij\u00eb shfletues t\u00eb ndrysh\u00ebm t\u00eb jasht\u00ebm dhe aplikacione q\u00eb p\u00ebrdorin motorin Chromium, si dhe aplikacione Android mbi baz\u00ebn e Webview.<\/p>\n

P\u00ebr m\u00eb tep\u00ebr, n\u00eb SQLite jan\u00eb identifikuar edhe 4 probleme m\u00eb pak t\u00eb rrezikshme (CVE-2019-13750<\/a><\/noindex>, CVE-2019-13751<\/a><\/noindex>, CVE-2019-13752<\/a><\/noindex>, CVE-2019-13753<\/a><\/noindex>), t\u00eb cilat mund t\u00eb \u00e7ojn\u00eb n\u00eb rrjedhje informacioni dhe kalim t\u00eb kufizimeve (mund t\u00eb p\u00ebrdoren si faktor\u00eb shoq\u00ebrues p\u00ebr nj\u00eb sulm ndaj Chrome). Probleme t\u00eb specifikuara jan\u00eb adresuar n\u00eb kodin SQLite m\u00eb 13 dhjetor. N\u00eb total, problemet lejuan studiuesit t\u00eb p\u00ebrgatisin nj\u00eb eksplot t\u00eb funksionuesh\u00ebm, i cili lejon ekzekutimin e kodit n\u00eb kontekstin e procesit Chromium, p\u00ebrgjegj\u00ebs p\u00ebr p\u00ebrpunimin.<\/p>\n

<\/a><\/noindex><\/p>\n

Burimi: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Tencent \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 Magellan (CVE-2019-13734), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0432 \u0421\u0423\u0411\u0414 SQLite \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 SQL-\u043a\u043e\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0439. \u041f\u043e\u0445\u043e\u0436\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0431\u044b\u043b\u0430 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430 \u0442\u0435\u043c\u0438 \u0436\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 \u0433\u043e\u0434 \u043d\u0430\u0437\u0430\u0434. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u0430 \u0442\u0435\u043c, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u0442\u044c \u0431\u0440\u0430\u0443\u0437\u0435\u0440 Chrome \u0438 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u043d\u0430\u0434 \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u043f\u0440\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0438 \u043f\u043e\u0434\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u043d\u044b\u0445 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 web-\u0441\u0442\u0440\u0430\u043d\u0438\u0446. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-54354","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitet n\u00eb SQLite, i cili lejon sulme t\u00eb larg\u00ebta ndaj Chrome p\u00ebrmes WebSQL | ProHoster","description":"Studiuesit e siguris\u00eb nga kompania kineze Tencent paraqit\u00ebn nj\u00eb variant t\u00eb ri t\u00eb vulnerabilitetit","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-sqlite-pozvolyayushhaya-udalyonno-atakovat-chrome-cherez-websql","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 SQLite, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u0442\u044c Chrome \u0447\u0435\u0440\u0435\u0437 WebSQL | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Tencent \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-sqlite-pozvolyayushhaya-udalyonno-atakovat-chrome-cherez-websql","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-23T21:00:00+00:00","article:modified_time":"2020-02-18T11:02:21+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"54354","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 11:02:28","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:07:25","updated":"2026-01-24 11:02:28","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/54354","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=54354"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/54354\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=54354"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=54354"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=54354"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}