کشف باگ Publisher Spoofing در Installer مایکروسافت ویژوال استودیو توسط محققان
?? ????? ??????? ?????? ???? ???? ????? ?????? ?????? ?????? ?? ??? Publisher Spoofing ? “???????? ????????????????” ?? ????????? ?????????? ?????? ??????? ????? ???????? ?? ???? ??? ???? ?? ?????? ???? ???? ??? ???? ?? ???? ?????? ? ????? ?????????? ??????? ???? ???? ?????????? ???? ????.
Dolev Taler? ???? Varonis? ?? ??? ???? ???[?]: «?? ???? ????? ???????? ??? ?? ???? ????? ???? ? ?? ?????? ??????? ???? ???? ?? ??? ??????? ?? ????? ??? ???? ???. ?????????? ???? ???? ???? ??????? ????? ?????? ?????? ? ????? ??? ?? ????? ???? ?? ????? ??????? ???????.»
??? ?????????? ?? ???????? CVE-2023-28299 ?????? ??????[?] (?????? ?/? ?? ????? CVSS)? ???? ?????????? ???????? ???? ?? ??????????????? ??????????? ??????????[?] ???? ????? ???? ???? ????? ???? ???? ? ?? ?? ???????? ?? ??? ??? ????? ???.
??? ??? ??? ???? Varonis ????? ?? ???? ?????? ?????? ??????? ??? ?? ????? ??? ??????? ??????? ???? ?? ????? ??????.
?? ??? ???? ??? ??? ???????? ?? ??? ?????? ?? ??????? ?? ?? ???????? ??????? ?? ????? ????? «??? ?????» ?? ??? ???? ???? ?????? ??????? ?????? ??????? (VSIX) [?]???????? ?? ???? .ZIP ? ??? ?????????? ???? ?????????? ?? ????[?] ?? ?? «DisplayName» ?? ???? “extension.vsixmanifest” ??? ??????.
?? ????? ?????????? ?? ???? ???? ?? ???? vsixmanifest ? ?????? ??? ???? “????? ???????”? ???? ?? ?? ???????? ????? ?? ??? ????? ???????? ?????? ?? ??????? ???????? ????? ??? ? ?? ????? ??????????? ?? ???? ??? ?? ?? ?? ??? ???.
?? ?? ??????? ???? ????? ?? ?????? ?? ???????? ?? ?????????? ?? ???????? ?? ??????????? ????????? ??????? ?? ????? ?????? ???? ????? ???? VSIX ????? ??? ? ?? ?? ???? ??? ???? ?? ?????? ??????? ???? ???.
??? ?? ??? ?????? ??????? ??????? ???????? ?????????? ???? ???????????? ????? ??????? ???? ? ????? ???? ??????? ???? ??????? ???.
Taler ?? ??? ???? ???: “??????? ?? ? ???????? ????????? ???? ??? ??? ???????? ?? ???? ??????. ?????? ????? ????????? ?? ??? ?????????? ???? ?????? ?????????? ??????? ???? ???? ?????? ?? ??? ??????? ???????? ??????? ????.”
?????
[?] https://www.varonis.com/blog/visual-studio-bug
[?] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28299
[?] https://apa.aut.ac.ir/?p=9589
[?] https://learn.microsoft.com/en-us/visualstudio/extensibility/vsix-extension-schema-2-0-reference
[?] https://en.wikipedia.org/wiki/Newline
[?] https://thehackernews.com/2023/06/researchers-uncover-publisher-spoofing.html
??????? :
???? ??????
???? :
????????? ???? ??????? ????? ???? ????
