{"id":9802,"date":"2016-12-29T12:48:30","date_gmt":"2016-12-29T18:48:30","guid":{"rendered":"https:\/\/la-uno.com\/blog\/?p=9802"},"modified":"2016-12-29T12:51:58","modified_gmt":"2016-12-29T18:51:58","slug":"9802","status":"publish","type":"post","link":"https:\/\/la-uno.com\/blog\/2016\/12\/29\/9802\/","title":{"rendered":"Descubiertas 3 vulnerabilidades criticas en PHP7 &#8211; una sigue sin parchar"},"content":{"rendered":"<p><a href=\"https:\/\/la-uno.com\/blog\/2016\/12\/29\/9802\/imgres-2\/#main\" rel=\"attachment wp-att-9803\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-9803\" src=\"https:\/\/la-uno.com\/blog\/wp-content\/uploads\/2016\/12\/imgres.jpg\" alt=\"\" width=\"271\" height=\"186\" \/><\/a><\/p>\n<p>Hay tres vulnerabilidades descubiertas en el codigo de PHP7 que permiten al atacante tomar control completo del 80 % de los sitios web que corren con la \u00faltima versi\u00f3n del popular lenguaje de programaci\u00f3n.<\/p>\n<p><!--more--><\/p>\n<p>Estas vulnerabilidades residen en el mecanismo de des-serializaci\u00f3n de PHP7 &#8211; el mismo mecanismo fue encontrado vulnerable en PHP5 \u00a0tambi\u00e9n, permitiendo a los atacantes comprometer Drupal, Joomla, Magento, vBulletin y PornHub, asi como otro tanto de sitios web al enviar cookies maliciosas a los clientes.<\/p>\n<p>Mientras que los investigadores encontraron las fallas en el mismo mecanismo, las vulnerabilidades en PHP 7 son diferentes a las de PHP5.<\/p>\n<p>Registradas como\u00a0CVE-2016-7479, CVE-2016-7480, y CVE-2016-7478, las fallas pueden ser explotadas de manera separada.<\/p>\n<ul>\n<li><a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2016-7479\" target=\"_blank\" rel=\"nofollow\">CVE-2016-7479<\/a>\u2014Use-After-Free Code Execution<\/li>\n<li><a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2016-7480\" target=\"_blank\" rel=\"nofollow\">CVE-2016-7480<\/a>\u2014Use of Uninitialized Value Code Execution<\/li>\n<li><a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2016-7478\" target=\"_blank\" rel=\"nofollow\">CVE-2016-7478<\/a>\u2014Remote Denial of Service.<\/li>\n<\/ul>\n<p>Las primeras dos, si se explotan, pueden permitir al atacante tomar control completo del servidor, permitiendo al atacante hacer de todo, desde enviar malware hasta robar datos de clientes o hacer un deface.<\/p>\n<p>La tercera vulnerabilidad puede ser explotada para generar un DoS, permitiendo al atacante colgar el sitio. Sin memoria para consumir y eventualmente tumbar el sistema.<\/p>\n<p>Parches para las dos primeras vulnerabilidades han sido enviadas al equipo de desarrollo de PHP el 13 de octubre y 1ero de Diciembre pero una sigue sin ser parchada.<\/p>\n<p>Para mantener la seguridad de sus servidores es recomendable actualizar a la versi\u00f3n mas reciente de PHP.<\/p>\n<div class=\"pvc_clear\"><\/div>\n<p id=\"pvc_stats_9802\" class=\"pvc_stats all  \" data-element-id=\"9802\" style=\"\"><i class=\"pvc-stats-icon medium\" aria-hidden=\"true\"><svg aria-hidden=\"true\" focusable=\"false\" data-prefix=\"far\" data-icon=\"chart-bar\" role=\"img\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 512 512\" class=\"svg-inline--fa fa-chart-bar fa-w-16 fa-2x\"><path fill=\"currentColor\" d=\"M396.8 352h22.4c6.4 0 12.8-6.4 12.8-12.8V108.8c0-6.4-6.4-12.8-12.8-12.8h-22.4c-6.4 0-12.8 6.4-12.8 12.8v230.4c0 6.4 6.4 12.8 12.8 12.8zm-192 0h22.4c6.4 0 12.8-6.4 12.8-12.8V140.8c0-6.4-6.4-12.8-12.8-12.8h-22.4c-6.4 0-12.8 6.4-12.8 12.8v198.4c0 6.4 6.4 12.8 12.8 12.8zm96 0h22.4c6.4 0 12.8-6.4 12.8-12.8V204.8c0-6.4-6.4-12.8-12.8-12.8h-22.4c-6.4 0-12.8 6.4-12.8 12.8v134.4c0 6.4 6.4 12.8 12.8 12.8zM496 400H48V80c0-8.84-7.16-16-16-16H16C7.16 64 0 71.16 0 80v336c0 17.67 14.33 32 32 32h464c8.84 0 16-7.16 16-16v-16c0-8.84-7.16-16-16-16zm-387.2-48h22.4c6.4 0 12.8-6.4 12.8-12.8v-70.4c0-6.4-6.4-12.8-12.8-12.8h-22.4c-6.4 0-12.8 6.4-12.8 12.8v70.4c0 6.4 6.4 12.8 12.8 12.8z\" class=\"\"><\/path><\/svg><\/i> <img loading=\"lazy\" decoding=\"async\" width=\"16\" height=\"16\" alt=\"Loading\" src=\"https:\/\/la-uno.com\/blog\/wp-content\/plugins\/page-views-count\/ajax-loader-2x.gif\" border=0 \/><\/p>\n<div class=\"pvc_clear\"><\/div>\n","protected":false},"excerpt":{"rendered":"<p>Hay tres vulnerabilidades descubiertas en el codigo de PHP7 que permiten al atacante tomar control completo del 80 % de los sitios web que corren con la \u00faltima versi\u00f3n del popular lenguaje de programaci\u00f3n.<\/p>\n<div class=\"pvc_clear\"><\/div>\n<p id=\"pvc_stats_9802\" class=\"pvc_stats all  \" data-element-id=\"9802\" style=\"\"><i class=\"pvc-stats-icon medium\" aria-hidden=\"true\"><svg aria-hidden=\"true\" focusable=\"false\" data-prefix=\"far\" data-icon=\"chart-bar\" role=\"img\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" viewBox=\"0 0 512 512\" class=\"svg-inline--fa fa-chart-bar fa-w-16 fa-2x\"><path fill=\"currentColor\" d=\"M396.8 352h22.4c6.4 0 12.8-6.4 12.8-12.8V108.8c0-6.4-6.4-12.8-12.8-12.8h-22.4c-6.4 0-12.8 6.4-12.8 12.8v230.4c0 6.4 6.4 12.8 12.8 12.8zm-192 0h22.4c6.4 0 12.8-6.4 12.8-12.8V140.8c0-6.4-6.4-12.8-12.8-12.8h-22.4c-6.4 0-12.8 6.4-12.8 12.8v198.4c0 6.4 6.4 12.8 12.8 12.8zm96 0h22.4c6.4 0 12.8-6.4 12.8-12.8V204.8c0-6.4-6.4-12.8-12.8-12.8h-22.4c-6.4 0-12.8 6.4-12.8 12.8v134.4c0 6.4 6.4 12.8 12.8 12.8zM496 400H48V80c0-8.84-7.16-16-16-16H16C7.16 64 0 71.16 0 80v336c0 17.67 14.33 32 32 32h464c8.84 0 16-7.16 16-16v-16c0-8.84-7.16-16-16-16zm-387.2-48h22.4c6.4 0 12.8-6.4 12.8-12.8v-70.4c0-6.4-6.4-12.8-12.8-12.8h-22.4c-6.4 0-12.8 6.4-12.8 12.8v70.4c0 6.4 6.4 12.8 12.8 12.8z\" class=\"\"><\/path><\/svg><\/i> <img loading=\"lazy\" decoding=\"async\" width=\"16\" height=\"16\" alt=\"Loading\" src=\"https:\/\/la-uno.com\/blog\/wp-content\/plugins\/page-views-count\/ajax-loader-2x.gif\" border=0 \/><\/p>\n<div class=\"pvc_clear\"><\/div>\n","protected":false},"author":1,"featured_media":5718,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_bbp_topic_count":0,"_bbp_reply_count":0,"_bbp_total_topic_count":0,"_bbp_total_reply_count":0,"_bbp_voice_count":0,"_bbp_anonymous_reply_count":0,"_bbp_topic_count_hidden":0,"_bbp_reply_count_hidden":0,"_bbp_forum_subforum_count":0,"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":true,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[37],"tags":[],"class_list":["post-9802","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-seguridad"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"https:\/\/la-uno.com\/blog\/wp-content\/uploads\/2014\/12\/Jarrod_Hacker.jpg","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/s529Uq-9802","jetpack-related-posts":[{"id":5338,"url":"https:\/\/la-uno.com\/blog\/2014\/12\/22\/apple-lanza-importante-actualizacion-de-seguridad\/","url_meta":{"origin":9802,"position":0},"title":"Apple lanza importante actualizaci\u00f3n de seguridad","author":"marco","date":"December 22, 2014","format":false,"excerpt":"Hace unos momentos a trav\u00e9s de su mecanismo de actualizaciones, Apple ha puesto a disposici\u00f3n de todos los usuarios de OS X Yosemite, Mavericks y Mountain Lion una importante actualizaci\u00f3n de seguridad, esta actualizaci\u00f3n resuelve un problema descubierto apenas el viernes pasado. Y es que este problema de seguridad afecta\u2026","rel":"","context":"In &quot;Apple&quot;","block_context":{"text":"Apple","link":"https:\/\/la-uno.com\/blog\/category\/apple\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/la-uno.com\/blog\/wp-content\/uploads\/2014\/12\/apple-seguridad.jpg?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/la-uno.com\/blog\/wp-content\/uploads\/2014\/12\/apple-seguridad.jpg?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/la-uno.com\/blog\/wp-content\/uploads\/2014\/12\/apple-seguridad.jpg?resize=525%2C300&ssl=1 1.5x"},"classes":[]},{"id":7599,"url":"https:\/\/la-uno.com\/blog\/2015\/04\/28\/7599\/","url_meta":{"origin":9802,"position":1},"title":"Una nueva falla de seguridad\u2026","author":"marco","date":"April 28, 2015","format":false,"excerpt":"Una nueva falla de seguridad se ha descubierto, es de tipo XSS,\u00a0y afecta a la ultima versi\u00f3n de WordPress que desde el pasado jueves est\u00e1 disponible, la versi\u00f3n 4.2. Debido a esta falla que tambi\u00e9n afecta a las versiones anteriores, el atacante puede inyectar un c\u00f3digo JavaScript malicioso en los\u2026","rel":"","context":"In &quot;Internet&quot;","block_context":{"text":"Internet","link":"https:\/\/la-uno.com\/blog\/category\/internet\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/la-uno.com\/blog\/wp-content\/uploads\/2015\/04\/wp-light-hi-2048x1536.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/la-uno.com\/blog\/wp-content\/uploads\/2015\/04\/wp-light-hi-2048x1536.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/la-uno.com\/blog\/wp-content\/uploads\/2015\/04\/wp-light-hi-2048x1536.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/la-uno.com\/blog\/wp-content\/uploads\/2015\/04\/wp-light-hi-2048x1536.png?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":8834,"url":"https:\/\/la-uno.com\/blog\/2016\/02\/11\/oracle-anuncia-otro-problema-de-seguridad-en-java\/","url_meta":{"origin":9802,"position":2},"title":"Oracle anuncia otro problema de seguridad en Java","author":"marco","date":"February 11, 2016","format":false,"excerpt":"Oracle acaba de anunciar otra vulnerabilidad que puede permitir a un atacante remoto tomar el control de un sistema Windows. La falla parece ser parte del proceso de instalaci\u00f3n en Java SE 6, 7 y 8 y es potencialmente cr\u00edtica aunque podr\u00eda ser algo dificil de explotar ya que solo\u2026","rel":"","context":"In &quot;Seguridad&quot;","block_context":{"text":"Seguridad","link":"https:\/\/la-uno.com\/blog\/category\/seguridad\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/la-uno.com\/blog\/wp-content\/uploads\/2016\/02\/scaredlady_contentfullwidth-e1448028831798-320x181.jpg?resize=350%2C200","width":350,"height":200},"classes":[]},{"id":5938,"url":"https:\/\/la-uno.com\/blog\/2014\/09\/15\/las-empresas-son-anos-de-retraso-en-materia-de-seguridad\/","url_meta":{"origin":9802,"position":3},"title":"Las empresas son a\u00f1os de retraso en materia de seguridad","author":"marco","date":"September 15, 2014","format":false,"excerpt":"Una investigaci\u00f3n reciente del NTT Communications arroja unos resultados alarmantes: Mientras que las empresas tendr\u00e1n la posibilidad de pensar que est\u00e1n haciendo al d\u00eda en materia de seguridad, son muchos los a\u00f1os de retraso en la detecci\u00f3n y protecci\u00f3n contra las vulnerabilidades. El\u00a0Informe de Inteligencia de amenaza global\u00a0realizado \u00e9ste a\u00f1o\u2026","rel":"","context":"In &quot;Internet&quot;","block_context":{"text":"Internet","link":"https:\/\/la-uno.com\/blog\/category\/internet\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/la-uno.com\/blog\/wp-content\/uploads\/2014\/09\/seguridad_informatica1.jpg?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/la-uno.com\/blog\/wp-content\/uploads\/2014\/09\/seguridad_informatica1.jpg?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/la-uno.com\/blog\/wp-content\/uploads\/2014\/09\/seguridad_informatica1.jpg?resize=525%2C300&ssl=1 1.5x"},"classes":[]},{"id":8241,"url":"https:\/\/la-uno.com\/blog\/2015\/08\/11\/hackeando-dropbox-google-drive-onedrive-y-otros-sin-necesidad-de-saber-nombre-de-usuario-y-contrasena\/","url_meta":{"origin":9802,"position":4},"title":"Hackeando Dropbox, Google Drive, OneDrive y otros sin necesidad de saber nombre de usuario y contrase\u00f1a.","author":"marco","date":"August 11, 2015","format":false,"excerpt":"\u00a0\u00a0 La compa\u00f1\u00eda Imperva ha mostrado un gran fallo de seguridad en Dropbox, GoogleDrive, OneDrive y otros servicios de almacenamiento en la nube que permite al atacante tener acceso a los archivos e incluso instalar malware sin siquiera tener el nombre de usuario y contrase\u00f1a. El problema de seguridad se\u2026","rel":"","context":"In &quot;Internet&quot;","block_context":{"text":"Internet","link":"https:\/\/la-uno.com\/blog\/category\/internet\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/la-uno.com\/blog\/wp-content\/uploads\/2015\/08\/IMG_0553.jpg?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/la-uno.com\/blog\/wp-content\/uploads\/2015\/08\/IMG_0553.jpg?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/la-uno.com\/blog\/wp-content\/uploads\/2015\/08\/IMG_0553.jpg?resize=525%2C300&ssl=1 1.5x"},"classes":[]},{"id":10582,"url":"https:\/\/la-uno.com\/blog\/2017\/10\/16\/que-es-krack-como-es-que-soy-vulnerable-como-me-puedo-proteger\/","url_meta":{"origin":9802,"position":5},"title":"Que es KRACK? como es que soy vulnerable? como me puedo proteger?","author":"marco","date":"October 16, 2017","format":false,"excerpt":"EL dia de ayer se di\u00f3 la noticia sobre la vulnerabilidad presente en pr\u00e1cticamente todo dispositivo que use WiFi, la raz\u00f3n?, es que el protocolo WPA2 que se usa no solo para cifrar la contrase\u00f1a sino todo el tr\u00e1fico entre el Access Point y el cliente (celular, tablet, computadora, smartwatch)\u2026","rel":"","context":"In &quot;Android&quot;","block_context":{"text":"Android","link":"https:\/\/la-uno.com\/blog\/category\/mobile\/android\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/la-uno.com\/blog\/wp-content\/uploads\/2017\/10\/KRACK-attack-780x551.jpg?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/la-uno.com\/blog\/wp-content\/uploads\/2017\/10\/KRACK-attack-780x551.jpg?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/la-uno.com\/blog\/wp-content\/uploads\/2017\/10\/KRACK-attack-780x551.jpg?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/la-uno.com\/blog\/wp-content\/uploads\/2017\/10\/KRACK-attack-780x551.jpg?resize=700%2C400&ssl=1 2x"},"classes":[]}],"_links":{"self":[{"href":"https:\/\/la-uno.com\/blog\/wp-json\/wp\/v2\/posts\/9802","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/la-uno.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/la-uno.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/la-uno.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/la-uno.com\/blog\/wp-json\/wp\/v2\/comments?post=9802"}],"version-history":[{"count":4,"href":"https:\/\/la-uno.com\/blog\/wp-json\/wp\/v2\/posts\/9802\/revisions"}],"predecessor-version":[{"id":9807,"href":"https:\/\/la-uno.com\/blog\/wp-json\/wp\/v2\/posts\/9802\/revisions\/9807"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/la-uno.com\/blog\/wp-json\/wp\/v2\/media\/5718"}],"wp:attachment":[{"href":"https:\/\/la-uno.com\/blog\/wp-json\/wp\/v2\/media?parent=9802"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/la-uno.com\/blog\/wp-json\/wp\/v2\/categories?post=9802"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/la-uno.com\/blog\/wp-json\/wp\/v2\/tags?post=9802"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}