هک با یک کلیک روی برنامههای دسکتاپ معروف کشف شد، آیا شما از آنها استفاده میکنید؟
????? ?????????? ?? ?? ???? ?? ????? ?????????? ?????????? ????? ??? ??? ??? ?? ?? ?? ????? ????? ?????? ?????? ?????? ?? ?????? ?? ??? ????????? ???? ??? ???? ???.
??? ????? ???? ?????? Positive Security ???? ?????? ??????? ? ????? ????? ??? ??? ? ??? ??????????? ????? ??????? Nextcloud ? VLC ? LibreOffice ? OpenOffice? ??? ??? Bitcoin/Dogecoin ? Wireshark ? Mumble ????? ????????.
?????? ?????????? ?????[?] [?]: “?????????? ??????? ?? URL ??? ????????? ???? ????? ?? ???? ??? ???? ???? ?????????? ????? ???????? ???? ?? ???? ?????????? ????? ?? ?? ????? ????? ???? ?????. ????? ?? ???????? ?? ?? ??? ?? ???: ????????? ?? URL ?? ?? ?? ???? ?????????? ???? (.desktop ? .jar ? .exe ? ????) ????? ??????? ??? ?????? ? ?? ????? ??? ?? ???? ?? ?????? ???????? ??????????? ?? ??????? (nfs ? webdav ? smb ? ????) ??????? ??????? ?? ?? ?? ?????????? ????? ?? ?????? ?????? URI handler ??????????? ??????.”
??? ?????? ?? ?????? ???? ?????? ????? URL ???? ?????? ?? ??? ?? ??? ?????????? ???? ??? ???? ???? ?? ????? ???? ?? ???? ???? ??????.
???????????? Positive Security ???? ??? ?? ?????? ?? ????????? ????????? URL ?? ?? ????? ????? ??????? ?? ?? ????? ????? ?????? ?? ????? ??? ????????? ?? ???? ??? ?? ?? ?? ???? ?? ???? ????? ???? ? ??????? ?? ?? ??? ??? ???? ??????.
?? ????? ????? ??? ?????????????? ???? ????????? ???????? ?? ???? ??? ????? ????? ????????:
- Nextcloud– Fixed in version 3.1.3 of Desktop Client released on February 24 (CVE-2021-22879)
- Telegram – Issue reported on January 11 and subsequently fixed via a server-side change on (or slightly before) February 10
- VLC Player– Issue reported on January 18, with patched version 3.0.13 set for release next week
- OpenOffice – To be fixed in the upcoming 4.1.10 release (CVE-2021-30245)
- LibreOffice– Addressed in Windows, but vulnerable in Xubuntu (CVE-2021-25631)
- Mumble– Fixed in version 1.3.4 released on February 10 (CVE-2021-27229)
- Dogecoin– Fixed in version 1.14.3 released on February 28
- Bitcoin ABC– Fixed in version 0.22.15 released on March 9
- Bitcoin Cash– Fixed in version 23.0.0 (currently in release process)
- Wireshark– Fixed in version 3.4.4 released on March 10 (CVE-2021-22191)
- WinSCP– Fixed in version 5.17.10 released on January 26 (CVE-2021-3331)
?????? ?????????? ?????: “??? ????? ????? ???? ?? ?? ?????? ??????? ????? ??? ???? ??????? ???????? ???? ???????? ??? ??????????? ???? ??? ?? ????? ?? ?? ????? ????? ???? ? ?? ????? ??? ?????????? ??????? ????????? ???? ????.”
“??????????? ?? ???? ???? ????????? ???????????? ? ????? ???????? ?????? ????? ??? ??? ?? ?? ?? ?? ????? ????? ?????? ??????? ?? ??????? ? ??? ??? ?? ?? ???? ??????? ????????? ???? ????.” ????? ?????? ???? URL ? ??????? ?? mount ??? ??????? ?????? ?? ??? ???.
?????
[?] https://positive.security/blog/url-open-rce
[?] https://thehackernews.com/2021/04/1-click-hack-found-in-popular-desktop.html
??????? :
???? ??????
