{"id":94683,"date":"2020-09-20T01:42:01","date_gmt":"2020-09-19T23:42:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-firefox-dlya-android-pozvolyayushhaya-upravlyat-brauzerom-cherez-obshhij-wi-fi"},"modified":"2020-09-20T01:42:01","modified_gmt":"2020-09-19T23:42:01","slug":"uyazvimost-v-firefox-dlya-android-pozvolyayushhaya-upravlyat-brauzerom-cherez-obshhij-wi-fi","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/uyazvimost-v-firefox-dlya-android-pozvolyayushhaya-upravlyat-brauzerom-cherez-obshhij-wi-fi","title":{"rendered":"En s\u00e5rbarhet i Firefox f\u00f6r Android som m\u00f6jligg\u00f6r kontroll av webbl\u00e4saren via ett gemensamt Wi-Fi","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

I Firefox f\u00f6r Android uppt\u00e4cktes<\/a><\/noindex> allvarlig s\u00e5rbarhet<\/a><\/noindex> i implementeringen av protokollet SSDP<\/a><\/noindex>, som anv\u00e4nds f\u00f6r att uppt\u00e4cka n\u00e4tverkstj\u00e4nster i det lokala n\u00e4tverket. S\u00e5rbarheten till\u00e5ter en angripare, som befinner sig i samma lokala eller tr\u00e5dl\u00f6sa n\u00e4tverk, att svara p\u00e5 verifieringsfr\u00e5gor fr\u00e5n Firefox med ett UPnP XML-meddelande «LOCATION» med intent-kommandon<\/a><\/noindex>, som kan \u00f6ppna en godtycklig URI i webbl\u00e4saren eller anropa hanterare f\u00f6r andra applikationer. <\/p>\n

Problemet visar sig \u00e4nda fram till versionen Firefox f\u00f6r Android 68.11.0<\/a><\/noindex> och har \u00e5tg\u00e4rdats i versionen Firefox f\u00f6r Android 79, det vill s\u00e4ga \u00e4ldre klassiska versioner av Firefox f\u00f6r Android \u00e4r s\u00e5rbara och f\u00f6r att l\u00f6sa problemet kr\u00e4vs en uppgradering till den nya versionen<\/a><\/noindex> av webbl\u00e4saren (Fenix), som anv\u00e4nder motorn GeckoView, byggd p\u00e5 teknologier fr\u00e5n Firefox Quantum, och en upps\u00e4ttning bibliotek Mozilla Android Components<\/a><\/noindex>. Problemet p\u00e5verkar inte versioner av Firefox f\u00f6r station\u00e4ra system.<\/p>\n

F\u00f6r att testa s\u00e5rbarheten f\u00f6rberedd<\/a><\/noindex> en fungerande prototyp av en exploaterare. Attacken utf\u00f6rs utan n\u00e5gra \u00e5tg\u00e4rder fr\u00e5n anv\u00e4ndarens sida, det r\u00e4cker att den s\u00e5rbara webbl\u00e4saren Firefox f\u00f6r Android k\u00f6rs p\u00e5 den mobila enheten och att offret befinner sig i samma n\u00e4tverkssegment som angriparens SSDP-server. <\/p>\n

Firefox f\u00f6r Android skickar regelbundet i broadcast-l\u00e4ge (multicast UDP) SSDP-meddelanden f\u00f6r att uppt\u00e4cka n\u00e4rvarande enheter i det lokala n\u00e4tverket, s\u00e5som mediaplayrar och smarta TV-apparater. Alla enheter i det lokala n\u00e4tverket tar emot dessa meddelanden och har m\u00f6jlighet att svara. I normala fall returnerar enheten en l\u00e4nk till platsen f\u00f6r XML-filen med information om enheten som st\u00f6djer UPnP. Vid en attack kan ist\u00e4llet f\u00f6r l\u00e4nken till XML en URI med intent-kommandon f\u00f6r Android \u00f6verf\u00f6ras. <\/p>\n

Genom intent-kommandon kan anv\u00e4ndaren omdirigeras till phishing-webbplatser eller f\u00e5 en l\u00e4nk till en xpi-fil (webbl\u00e4saren kommer att f\u00f6resl\u00e5 att installera ett till\u00e4gg). Eftersom angriparens svar inte \u00e4r begr\u00e4nsade kan han f\u00f6rs\u00f6ka \u00f6verv\u00e4ldiga webbl\u00e4saren med erbjudanden om installation eller skadliga webbplatser i hopp om att anv\u00e4ndaren ska g\u00f6ra ett misstag och klicka p\u00e5 installationen av det skadliga paketet. Ut\u00f6ver att \u00f6ppna godtyckliga l\u00e4nkar i sj\u00e4lva webbl\u00e4saren kan intent-kommandon anv\u00e4ndas f\u00f6r att bearbeta inneh\u00e5ll i andra Android-appar, till exempel kan man \u00f6ppna en e-postmall i e-postklienten (URI mailto:) eller starta ett gr\u00e4nssnitt f\u00f6r att ringa ett telefonsamtal (URI tel:).<\/p>\n


\n

<\/a><\/noindex><\/p>\n

K\u00e4lla: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 Firefox \u0434\u043b\u044f Android \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0441\u0435\u0440\u044c\u0451\u0437\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 SSDP, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u0434\u043b\u044f \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432 \u0432 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443, \u043d\u0430\u0445\u043e\u0434\u044f\u0449\u0435\u043c\u0443\u0441\u044f \u0432 \u0442\u043e\u0439 \u0436\u0435 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043b\u0438 \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u043e\u0439 \u0441\u0435\u0442\u0438, \u043e\u0442\u0432\u0435\u0442\u0438\u0442\u044c \u043d\u0430 \u043f\u0440\u043e\u0432\u0435\u0440\u043e\u0447\u043d\u044b\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u044b Firefox \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0435\u043c UPnP XML «LOCATION» \u0441 intent-\u043a\u043e\u043c\u0430\u043d\u0434\u0430\u043c\u0438, \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043c\u043e\u0436\u043d\u043e \u043e\u0442\u043a\u0440\u044b\u0442\u044c \u0432 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0435 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 URI \u0438\u043b\u0438 \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-94683","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47S\u00e5rbarhet i Firefox f\u00f6r Android som m\u00f6jligg\u00f6r kontroll av webbl\u00e4saren via offentlig Wi-Fi | ProHoster","description":"En allvarlig","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/uyazvimost-v-firefox-dlya-android-pozvolyayushhaya-upravlyat-brauzerom-cherez-obshhij-wi-fi","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Firefox \u0434\u043b\u044f Android, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043e\u043c \u0447\u0435\u0440\u0435\u0437 \u043e\u0431\u0449\u0438\u0439 Wi-Fi | ProHoster","og:description":"\u0412 Firefox \u0434\u043b\u044f Android \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0441\u0435\u0440\u044c\u0451\u0437\u043d\u0430\u044f","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/uyazvimost-v-firefox-dlya-android-pozvolyayushhaya-upravlyat-brauzerom-cherez-obshhij-wi-fi","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-09-19T23:42:01+00:00","article:modified_time":"2020-09-19T23:42:01+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"94683","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 11:21:10","updated":"2022-10-02 05:53:14","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/94683","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=94683"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/94683\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=94683"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=94683"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=94683"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}