{"id":110745,"date":"2023-10-11T21:10:17","date_gmt":"2023-10-11T19:10:17","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/perepolnenie-bufera-v-curl-i-libcurl-proyavlyayushheesya-pri-obrashhenii-cherez-socks5-proksi"},"modified":"2023-10-11T21:10:17","modified_gmt":"2023-10-11T19:10:17","slug":"perepolnenie-bufera-v-curl-i-libcurl-proyavlyayushheesya-pri-obrashhenii-cherez-socks5-proksi","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/perepolnenie-bufera-v-curl-i-libcurl-proyavlyayushheesya-pri-obrashhenii-cherez-socks5-proksi","title":{"rendered":"Buffertspill i curl och libcurl, som uppst\u00e5r vid anv\u00e4ndning av SOCKS5-proxy","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

I verktyget f\u00f6r att skicka och ta emot data \u00f6ver n\u00e4tverket, curl, samt i den parallellt utvecklade biblioteket libcurl, har en s\u00e5rbarhet identifierats (CVE-2023-38545) som kan leda till buffert\u00f6verskridning och potentiellt till exekvering av en angripares kod p\u00e5 klientsidan n\u00e4r man med hj\u00e4lp av curl eller ett program som anv\u00e4nder libcurl kontaktar en HTTPS-server kontrollerad av en illavarslande part. Problemet uppst\u00e5r endast om curl har tillg\u00e5ng till SOCKS5-proxy. Vid direkt kontakt utan proxy upptr\u00e4der s\u00e5rbarheten inte. S\u00e5rbarheten har \u00e5tg\u00e4rdats i curl version 8.4.0. Forskaren som uppt\u00e4ckte felet erh\u00f6ll en bel\u00f6ning p\u00e5 $4660 genom Internet Bug Bounty-initiativet p\u00e5 Hackerone. <\/p>\n

S\u00e5rbarheten orsakas av ett fel i koden f\u00f6r namnuppl\u00f6sning innan man kontaktar SOCKS5-proxyn. N\u00e4r v\u00e4rdnamnet \u00e4r upp till 256 tecken l\u00e5ngt skickar curl omedelbart namnet till SOCKS5-proxyn f\u00f6r uppl\u00f6sning p\u00e5 dess sida, medan om namnet \u00f6verskrider 255 tecken v\u00e4xlar det till en lokal resolver och \u00f6verf\u00f6r redan ett definierat adress till SOCKS5. P\u00e5 grund av ett kodfel kan flaggan som indikerar behovet av lokal uppl\u00f6sning under den l\u00e5ngsamma f\u00f6rhandlingen av anslutningen genom SOCKS5 ha satts till fel v\u00e4rde, vilket ledde till att det l\u00e5nga v\u00e4rdnamnet skrevs till en buffert avsedd f\u00f6r att h\u00e5lla IP-adresser<\/a> eller ett namn som inte \u00f6verskrider 255 tecken. <\/p>\n

\u0412\u043b\u0430\u0434\u0435\u043b\u0435\u0446 \u0441\u0430\u0439\u0442\u0430, \u043a \u043a\u043e\u0442\u043e\u0440\u043e\u043c\u0443 curl \u043e\u0431\u0440\u0430\u0449\u0430\u0435\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 SOCKS5-\u043f\u0440\u043e\u043a\u0441\u0438, \u043c\u043e\u0436\u0435\u0442 \u0438\u043d\u0438\u0446\u0438\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 \u043a\u043b\u0438\u0435\u043d\u0442\u0430, \u0432\u0435\u0440\u043d\u0443\u0432 \u0432 \u043e\u0442\u0432\u0435\u0442 \u043a\u043e\u0434 \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0437\u0430\u043f\u0440\u043e\u0441\u0430 (HTTP 30x) \u0438 \u0432\u044b\u0441\u0442\u0430\u0432\u0438\u0432 \u0432 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0435 «Location:» URL \u0441 \u0438\u043c\u0435\u043d\u0435\u043c \u0445\u043e\u0441\u0442\u0430, \u0440\u0430\u0437\u043c\u0435\u0440 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u0432 \u0434\u0438\u0430\u043f\u0430\u0437\u043e\u043d\u0435 \u043e\u0442 16 \u0434\u043e 64 \u041a\u0411 (\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 16 \u041a\u0411 \u043e\u0431\u0443\u0441\u043b\u043e\u0432\u043b\u0435\u043d\u043e \u043c\u0438\u043d\u0438\u043c\u0430\u043b\u044c\u043d\u044b\u043c \u0440\u0430\u0437\u043c\u0435\u0440\u043e\u043c, \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u044b\u043c \u0434\u043b\u044f \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0431\u0443\u0444\u0435\u0440\u0430, \u0430 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 65 \u041a\u0411 \u0441\u0432\u044f\u0437\u0430\u043d\u043e \u0441 \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u043e \u0440\u0430\u0437\u0440\u0435\u0448\u0451\u043d\u043d\u043e\u0439 \u0434\u043b\u0438\u043d\u043e\u0439 \u0438\u043c\u0435\u043d\u0438 \u0445\u043e\u0441\u0442\u0430 \u0432 URL). \u0415\u0441\u043b\u0438 \u0432 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430\u0445 libcurl \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u043e \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0439 SOCKS5-\u043f\u0440\u043e\u043a\u0441\u0438 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043c\u0435\u0434\u043b\u0435\u043d\u043d\u044b\u0439, \u0442\u043e \u0438\u043c\u044f \u0434\u043b\u0438\u043d\u043d\u043e\u0435 \u0445\u043e\u0441\u0442\u0430 \u0431\u0443\u0434\u0435\u0442 \u0437\u0430\u043f\u0438\u0441\u0430\u043d\u043e \u0432 \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u043e\u0439 \u0431\u0443\u0444\u0435\u0440, \u0437\u0430\u0432\u0435\u0434\u043e\u043c\u043e \u043c\u0435\u043d\u044c\u0448\u0435\u0433\u043e \u0440\u0430\u0437\u043c\u0435\u0440\u0430. <\/p>\n

\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u043c \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u043d\u0430 \u0431\u0430\u0437\u0435 libcurl \u0438 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u0443\u0442\u0438\u043b\u0438\u0442\u0435 curl \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u043e\u043f\u0446\u0438\u0438 «—limit-rate» \u0441\u043e \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435\u043c, \u043c\u0435\u043d\u044c\u0448\u0435 65541 — \u0432 libcurl \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0432\u044b\u0434\u0435\u043b\u044f\u0435\u0442\u0441\u044f \u0431\u0443\u0444\u0435\u0440, \u0440\u0430\u0437\u043c\u0435\u0440\u043e\u043c 16 \u041a\u0411, \u0430 \u0432 \u0443\u0442\u0438\u043b\u0438\u0442\u0435 curl — 100 \u041a\u0411, \u043d\u043e \u044d\u0442\u043e\u0442 \u0440\u0430\u0437\u043c\u0435\u0440 \u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u0432 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0442 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430 «—limit-rate». <\/p>\n

Daniel Stenberg, projektets skapare, n\u00e4mnde att s\u00e5rbarheten hade f\u00f6rblivit ouppt\u00e4ckt i 1315 dagar. Det rapporterades ocks\u00e5 att 41 % av de tidigare identifierade s\u00e5rbarheterna i curl sannolikt skulle ha kunnat undvikas om curl hade skrivits p\u00e5 ett spr\u00e5k som s\u00e4kerst\u00e4ller s\u00e4ker minneshantering, men det finns inga planer p\u00e5 att skriva om curl p\u00e5 ett annat spr\u00e5k inom \u00f6versk\u00e5dlig framtid. F\u00f6r att \u00f6ka s\u00e4kerheten i kodbasen f\u00f6resl\u00e5s det att ut\u00f6ka verktygen f\u00f6r att testa koden och att mer aktivt anv\u00e4nda beroenden skrivna p\u00e5 programmeringsspr\u00e5k som s\u00e4kerst\u00e4ller s\u00e4ker minneshantering. Det \u00f6verv\u00e4gs ocks\u00e5 en gradvis ers\u00e4ttning av delar av curl med alternativ skrivna p\u00e5 s\u00e4kra spr\u00e5k, s\u00e5som den experimentella HTTP-backenden Hyper, implementerad i Rust.
\n
K\u00e4lla: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0443\u0442\u0438\u043b\u0438\u0442\u0435 \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u043e \u0441\u0435\u0442\u0438 curl \u0438 \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0435\u0439\u0441\u044f \u043f\u0430\u0440\u0430\u043b\u043b\u0435\u043b\u044c\u043d\u043e \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 libcurl \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-38545), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u0431\u0443\u0444\u0435\u0440\u0430 \u0438 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u0433\u043e \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 \u043a\u043b\u0438\u0435\u043d\u0442\u0430 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u0438 \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u0443\u0442\u0438\u043b\u0438\u0442\u044b curl \u0438\u043b\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0435\u0433\u043e libcurl, \u043a HTTPS-\u0441\u0435\u0440\u0432\u0435\u0440\u0443, \u043f\u043e\u0434\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u043d\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0432 curl […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-110745","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Buffert\u00f6verskridning i curl och libcurl, som uppst\u00e5r vid anv\u00e4ndning av SOCKS5-proxy | ProHoster","description":"I verktyget curl f\u00f6r att h\u00e4mta och skicka data \u00f6ver n\u00e4tverket samt i det parallellt utvecklande biblioteket libcurl har en s\u00e5rbarhet (CVE-2023-38545) identifierats, som kan leda till buffert\u00f6verskridning och potentiellt exekvering.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/perepolnenie-bufera-v-curl-i-libcurl-proyavlyayushheesya-pri-obrashhenii-cherez-socks5-proksi","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 curl \u0438 libcurl, \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u044e\u0449\u0435\u0435\u0441\u044f \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 SOCKS5-\u043f\u0440\u043e\u043a\u0441\u0438 | ProHoster","og:description":"\u0412 \u0443\u0442\u0438\u043b\u0438\u0442\u0435 \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u043e \u0441\u0435\u0442\u0438 curl \u0438 \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0435\u0439\u0441\u044f \u043f\u0430\u0440\u0430\u043b\u043b\u0435\u043b\u044c\u043d\u043e \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 libcurl \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-38545), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u0431\u0443\u0444\u0435\u0440\u0430 \u0438 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e.","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/perepolnenie-bufera-v-curl-i-libcurl-proyavlyayushheesya-pri-obrashhenii-cherez-socks5-proksi","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-10-11T19:10:17+00:00","article:modified_time":"2023-10-11T19:10:17+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"110745","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-08 20:24:09","updated":"2026-02-08 20:24:09","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/110745","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=110745"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/110745\/revisions"}],"predecessor-version":[{"id":157908,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/110745\/revisions\/157908"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=110745"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=110745"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=110745"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}