 Óÿçâèìîñòè âî Flash |
Çäðàâñòâóéòå, ãîñòü ( Âõîä | Ðåãèñòðàöèÿ )
Flash Zone Forum > Flash Zone Team > MustLive/BPG Collections of Fun - Êîëëåêöèè ïðèêîëîâ > MustLive Security  |
  8.03.2013 - 00:38
Ñîîáùåíèå
#1
|
|
|
Âåòåðàí êîíôåðåíöèè  Ãðóïïà: Flash Zone Team Ñîîáùåíèé: 4977 Ðåãèñòðàöèÿ: 10.03.2005 Èç: Êèåâ Ïîëüçîâàòåëü ¹: 5  |
 ýòîé òåìå ÿ ðàññêàæó îá óÿçâèìîñòÿõ âî Flash.
Âî ôëåø ïëååðå (ïëàãèíå è ñòàöèîíàðíîì ïëååðå) ðåãóëÿðíî íàõîäÿò óÿçâèìîñòè. Î ðàçëè÷íûõ äûðàõ âî Flash ïëååðå, à èíîãäà è â ðåäàêòîðå, ÿ ðåãóëÿðíî ïèøó â íîâîñòÿõ (ñðåäè ïðîäóêòîâ Adobe, òàêæå ðåãóëÿðíî íàõîäÿò óÿçâèìîñòè â Shockwave Player è äðóãîì ÏÎ). À ñåé÷àñ ðàññêàæó î òåõ óÿçâèìîñòÿõ âî ôëåøå, êîòîðûå íàø¸ë ÿ. ×òîáû ñëåäèòü çà áåçîïàñíîñòüþ, âû ìîæåòå çàêàçàòü àóäèò áåçîïàñíîñòè ñâîèõ âåá ñàéòîâ è âåá ïðèëîæåíèé. Ïåðâóþ óÿçâèìîñòü âî Flash ÿ íàø¸ë â äåêàáðå 2007. Î ÷¸ì íàïèñàë â íà÷àëå 2008 ãîäà. XSS óÿçâèìîñòü â Invision Power Board. È ïåðâûé ïðèìåð èñïîëüçîâàíèÿ ýòîé óÿçâèìîñòè ÿ íàø¸ë â äâèæêå IPB, êîòîðûé èñïîëüçóåòñÿ íà íàøåì ôîðóìå (óÿçâèìû IPB 1.x è IPB 2.x). Ïàò÷è äëÿ äàííîé óÿçâèìîñòè â ðàçëè÷íûõ âåðñèÿõ IPB ÿ ïîìåñòè â ñâîé Security Pack â íà÷àëå ìàðòà 2008 ãîäà. Ñîáñòâåííî íà ïðèìåðå äâèæêà ôîðóìà ÿ ïîêàçàë ýòó óÿçâèìîñòü. Âíà÷àëå ÿ ðàññìàòðèâàë ýòî êàê îñîáåííîñòü ôëåøà, ò.ê. äàííûé óÿçâèìûé àëãîðèòì ðàáîòû Àäîá ñäåëàëà óìûøëåííî è îá ýòîì çàÿâèëà â îôèöèàëüíîé äîêóìåíòàöèè ïî ìîäåëè áåçîïàñíîñòè ôëåøà (ÿ ðåøèë, ÷òî Àäîá íå óâèäåëà â ýòîì ðèñêà, è ÷òî òîëüêî ÿ îáðàòèë íà ýòî âíèìàíèå, ïîýòîìó íå ñòàë ñîîáùàòü îá ýòîì Àäîáó). Íî ïîçæå Àäîáó îá ýòîì ÿâíî êòî-òî ñîîáùèë, ò.ê. îíè èñïðàâèëè ýòó óÿçâèìîñòü íà óðîâíå ôëåøà â 2009 ãîäó (÷òîáû âñåì âåá ðàçðàáîò÷èêàì, ÷üè ïðîãðàììû óÿçâèìû ê äàííîé àòàêå, íå ïðèøëîñü ïèñàòü èñïðàâëåíèÿ, ïîäîáíûå òåì ïàò÷àì, ÷òî ÿ ñäåëàë äëÿ IPB). -------------------- Best wishes & regards,
MustLive Àäìèíèñòðàòîð ñàéòà http://mlfun.org.ua |
 |
 
|
|
8.03.2013 - 01:48
Ñîîáùåíèå
#2
|
|
|
Âåòåðàí êîíôåðåíöèè Ãðóïïà: Flash Zone Team Ñîîáùåíèé: 4977 Ðåãèñòðàöèÿ: 10.03.2005 Èç: Êèåâ Ïîëüçîâàòåëü ¹: 5 |
Î÷åðåäíóþ óÿçâèìîñòü âî ôëåøå ÿ íàø¸ë 11.06.2011.
Ýòî DoS óÿçâèìîñòü âî Flash ïëàãèíå (memory corruption). Îíà ïðîÿâëÿåòñÿ âî ôëåø ïëàãèíå 10.3 è âûøå, è êàñàåòñÿ ðàáîòû â ñòàðûõ áðàóçåðàõ, ÷àñòíîñòè íà äâèæêå Gecko îò Mozilla. Êîãäà â ñòàðûõ áðàóçåðàõ ïðè óñòàíîâëåííîì ôëåøå âåðñèè 10.3 (è ïîñëåäóþùèõ) ïðîèñõîäèò âûáèâàíèå áðàóçåðà íà ëþáûõ ôëåøêàõ (äàæå ñàìîì ïðîñòîì swf-ôàéëå). Ïîñëå ïðîâåðêè â èþíå 2011 ãîäà, ÿ ïðîâåðèë åù¸ â äåêàáðå 2012 è âûÿñíèë, ÷òî DoS îäèíàêîâî ðàáîòàåò êàê â 10.3 r183, òàê è â 11.4 r402 (êàê è îæèäàëîñü). Àäîá íå ñòàëà èñïðàâëÿòü ýòó óÿçâèìîñòü ïîñëå ìîåãî óâåäîìëåíèÿ, ò.ê. ïî ñëîâàì êîìïàíèè - ýòî çàïëàíèðîâàííàÿ ðàáîòà ôëåø ïëàãèíà. È 31.12.2012 ÿ âûëîæèë âèäåî, êîòîðîå äåìîíñòðèðóåò ýòó DoS óÿçâèìîñòü âî Flash ïëàãèíå (access violation). Adobe Flash DoS -------------------- Best wishes & regards,
MustLive Àäìèíèñòðàòîð ñàéòà http://mlfun.org.ua |
|
|
|
|
9.03.2013 - 00:55
Ñîîáùåíèå
#3
|
|
|
Âåòåðàí êîíôåðåíöèè Ãðóïïà: Flash Zone Team Ñîîáùåíèé: 4977 Ðåãèñòðàöèÿ: 10.03.2005 Èç: Êèåâ Ïîëüçîâàòåëü ¹: 5 |
Î÷åðåäíóþ óÿçâèìîñòü âî ôëåøå ÿ íàø¸ë 27.01.2013.
Ýòî DoS óÿçâèìîñòü âî Flash (memory corruption), êîòîðàÿ ïðèâîäèò ê âûáèâàíèþ ÎÑ - ê "ñèíåìó ýêðàíó ñìåðòè" (BSOD). Îá ýòîé óÿçâèìîñòè ÿ ñîîáùèë Àäîáó åù¸ â ÿíâàðå, íî îíè äî ñèõ ïîð èññëåäóþò å¸. Äåòàëüíóþ èíôîðìàöèþ î íåé ÿ îïóáëèêóþ ïîñëå òîãî, êàê Àäîá çàâåðøèò ñâîè èññëåäîâàíèÿ. Ñåãîäíÿ ÿ âûëîæèë íà Þòþá âèäåî (÷òî ÿ ðàíåå ïîêàçûâàë Àäîáó è äðóãèì ðàçðàáîò÷èêàì, ïðîãðàììû êîòîðûõ ñâÿçàíû ñ ýòîé BSOD), êîòîðîå äåìîíñòðèðóåò ýòó DoS óÿçâèìîñòü âî Flash. Adobe Flash DoS BSOD Îïèñàíèå óÿçâèìîñòè: Denial of Service óðàçëèâ³ñòü â Adobe Flash -------------------- Best wishes & regards,
MustLive Àäìèíèñòðàòîð ñàéòà http://mlfun.org.ua |
|
|
|
|
11.01.2014 - 15:52
Ñîîáùåíèå
#4
|
|
|
Âåòåðàí êîíôåðåíöèè Ãðóïïà: Flash Zone Team Ñîîáùåíèé: 4977 Ðåãèñòðàöèÿ: 10.03.2005 Èç: Êèåâ Ïîëüçîâàòåëü ¹: 5 |
Î÷åðåäíóþ óÿçâèìîñòü âî ôëåøå ÿ íàø¸ë â íà÷àëå äåêàáðÿ.
Ýòî DoS óÿçâèìîñòü âî Flash (memory corruption), êîòîðàÿ ïðèâîäèò ê çàâèñàíèþ ÎÑ èëè ê âûáèâàíèþ ÎÑ - ê "ñèíåìó ýêðàíó ñìåðòè" (BSOD).  äåêàáðå ÿ âûëîæèë íà Þòþá âèäåî, êîòîðîå äåìîíñòðèðóåò ýòó DoS óÿçâèìîñòü âî Flash. DoS in Adobe Flash (BSOD) Îïèñàíèå óÿçâèìîñòè: DoS óðàçëèâ³ñòü â Adobe Flash -------------------- Best wishes & regards,
MustLive Àäìèíèñòðàòîð ñàéòà http://mlfun.org.ua |
|
|
|
|
1 ÷åë. ÷èòàþò ýòó òåìó (ãîñòåé: 1, ñêðûòûõ ïîëüçîâàòåëåé: 0)
Ïîëüçîâàòåëåé: 0
|
Òåêñòîâàÿ âåðñèÿ | Ñåé÷àñ: 18.03.2015 - 03:14 |
Ðóññêàÿ âåðñèÿ IP.Board
© 2015 IPS, Inc.