Skupina v\u00fdzkumn\u00edk\u016f z Kalifornsk\u00e9 univerzity v Riverside publikovala novou variantu \u00fatoku SAD DNS (CVE-2021-20322), kter\u00fd funguje i p\u0159es ochranu p\u0159idanou minul\u00fd rok za \u00fa\u010delem zablokov\u00e1n\u00ed zranitelnosti CVE-2020-25705. Nov\u00e1 metoda je v z\u00e1sad\u011b podobn\u00e1 lo\u0148sk\u00e9 zranitelnosti a li\u0161\u00ed se pouze pou\u017eit\u00edm jin\u00e9ho typu ICMP paket\u016f k ov\u011b\u0159ov\u00e1n\u00ed aktivn\u00edch UDP port\u016f. Navrhovan\u00fd \u00fatok umo\u017e\u0148uje substituci fale\u0161n\u00fdch dat do cache DNS serveru, co\u017e lze vyu\u017e\u00edt k nahrazen\u00ed IP adresy libovoln\u00e9 dom\u00e9ny v cache a p\u0159esm\u011brov\u00e1n\u00ed \u017e\u00e1dost\u00ed na dom\u00e9nu na server \u00fato\u010dn\u00edka. <\/p>\n
Navrhovan\u00e1 metoda je funk\u010dn\u00ed pouze v s\u00ed\u0165ov\u00e9m stacku Linuxu kv\u016fli vazb\u011b na specifickou vlastnost mechanismu zpracov\u00e1n\u00ed ICMP paket\u016f v Linuxu, kter\u00fd je zdrojem \u00fanik\u016f dat, usnad\u0148uj\u00edc\u00edch identifikaci \u010d\u00edsla UDP portu, kter\u00fd byl pou\u017eit serverem<\/a> pro odesl\u00e1n\u00ed extern\u00edho po\u017eadavku. Zm\u011bny, kter\u00e9 blokuj\u00ed \u00fanik informac\u00ed, byly p\u0159id\u00e1ny do j\u00e1dra Linuxu na konci srpna (oprava byla zahrnuta ve verzi j\u00e1dra 5.15 a z\u00e1\u0159ijov\u00fdch aktualizac\u00edch LTS v\u011btv\u00ed j\u00e1dra). Oprava spo\u010d\u00edv\u00e1 v p\u0159echodu na pou\u017e\u00edv\u00e1n\u00ed algoritmu hashov\u00e1n\u00ed SipHash m\u00edsto Jenkins Hash v s\u00ed\u0165ov\u00fdch cache. Status odstran\u011bn\u00ed zranitelnosti v distribuc\u00edch lze posoudit na t\u011bchto str\u00e1nk\u00e1ch: Debian, RHEL, Fedora, SUSE, Ubuntu. <\/p>\n Podle \u00fadaj\u016f, kter\u00e9 zjistili v\u00fdzkumn\u00edci, je zranitelnosti vystaveno p\u0159ibli\u017en\u011b 38 % otev\u0159en\u00fdch resolver\u016f v s\u00edti, v\u010detn\u011b popul\u00e1rn\u00edch DNS slu\u017eeb, jako jsou OpenDNS a Quad9 (9.9.9.9). Co se t\u00fd\u010de serverov\u00e9ho softwaru, \u00fatok m\u016f\u017ee b\u00fdt proveden pomoc\u00ed na Linuxov\u00e9m serveru takov\u00fdch bal\u00ed\u010dk\u016f, jako jsou BIND, Unbound a dnsmasq. Na DNS serverech spu\u0161t\u011bn\u00fdch pomoc\u00ed syst\u00e9m\u016f Windows a BSD se probl\u00e9m neprojevuje. Pro \u00fasp\u011b\u0161n\u00e9 proveden\u00ed \u00fatoku je nezbytn\u00e9 pou\u017e\u00edt spoofing IP, tj. je pot\u0159eba, aby poskytovatel \u00fato\u010dn\u00edka neblokoval pakety s fale\u0161nou v\u00fdchoz\u00ed IP adresou. <\/p>\n P\u0159ipom\u00edn\u00e1me, \u017ee \u00fatok SAD DNS umo\u017e\u0148uje obej\u00edt ochranu, kter\u00e1 byla p\u0159id\u00e1na do DNS server\u016f za \u00fa\u010delem zablokov\u00e1n\u00ed klasick\u00e9 metody otravy mezipam\u011bt\u00ed DNS, navr\u017een\u00e9 v roce 2008 Danem Kaminsk\u00fdm. Kaminsk\u00e9ho metoda manipuluje s malou velikost\u00ed pole s identifika\u010dn\u00edm \u010d\u00edslem DNS dotazu, kter\u00e9 m\u00e1 pouze 16 bit\u016f. K vyhled\u00e1n\u00ed spr\u00e1vn\u00e9ho identifik\u00e1toru DNS transakce pot\u0159ebn\u00e9ho pro spoofing n\u00e1zvu hostitele sta\u010d\u00ed odeslat p\u0159ibli\u017en\u011b 7000 dotaz\u016f a simulovat asi 140 tis\u00edc fale\u0161n\u00fdch odpov\u011bd\u00ed. \u00datok spo\u010d\u00edv\u00e1 v odes\u00edl\u00e1n\u00ed velk\u00e9ho mno\u017estv\u00ed paket\u016f k DNS resolveru s fale\u0161nou vazbou na IP a s r\u016fzn\u00fdmi identifik\u00e1tory DNS transakce. Aby se p\u0159ede\u0161lo mezipam\u011b\u0165ov\u00e1n\u00ed prvn\u00ed odpov\u011bdi, v ka\u017ed\u00e9 fale\u0161n\u00e9 odpov\u011bdi je uvedeno m\u00edrn\u011b pozm\u011bn\u011bn\u00e9 jm\u00e9no dom\u00e9ny (1.example.com, 2.example.com, 3.example.com atd.). <\/p>\n Pro ochranu p\u0159ed t\u00edmto typem \u00fatoku v\u00fdrobci DNS server\u016f implementovali n\u00e1hodn\u00e9 rozd\u011blen\u00ed \u010d\u00edsel v\u00fdchoz\u00edch s\u00ed\u0165ov\u00fdch port\u016f, ze kter\u00fdch se odes\u00edlaj\u00ed dotazy na rozli\u0161en\u00ed, co\u017e kompenzovalo nedostate\u010dn\u011b velkou velikost identifik\u00e1toru. Po implementaci ochrany nav\u00edc k odhadu 16bitov\u00e9ho identifik\u00e1toru bylo t\u0159eba tak\u00e9 vybrat jeden ze 64 tis\u00edc port\u016f, co\u017e zv\u00fd\u0161ilo po\u010det mo\u017enost\u00ed pro odhad na 2^32. <\/p>\n Metoda SAD DNS umo\u017e\u0148uje radik\u00e1ln\u011b zjednodu\u0161it ur\u010den\u00ed \u010d\u00edsla s\u00ed\u0165ov\u00e9ho portu a p\u0159iv\u00e9st \u00fatok k tradi\u010dn\u00edmu zp\u016fsobu Kaminga. \u00dato\u010dn\u00edk m\u016f\u017ee zjistit p\u0159\u00edstup k nevyu\u017e\u00edvan\u00fdm a aktivn\u00edm UDP port\u016fm d\u00edky \u00faniku informac\u00ed o aktivit\u011b s\u00ed\u0165ov\u00fdch port\u016f p\u0159i zpracov\u00e1n\u00ed odpov\u011bdn\u00edch ICMP paket\u016f. Metoda umo\u017e\u0148uje sn\u00ed\u017eit po\u010det mo\u017enost\u00ed p\u0159i testov\u00e1n\u00ed o 4 \u0159\u00e1dy \u2014 2^16+2^16 nam\u00edsto 2^32 (131_072 nam\u00edsto 4_294_967_296). \u00danik informac\u00ed, kter\u00fd umo\u017e\u0148uje rychle zjistit aktivn\u00ed UDP porty, je zp\u016fsoben nedostatkem v k\u00f3du zpracov\u00e1n\u00ed ICMP paket\u016f s po\u017eadavky na fragmentaci (flag ICMP Fragmentation Needed) nebo p\u0159esm\u011brov\u00e1n\u00ed (flag ICMP Redirect). Odesl\u00e1n\u00ed takov\u00fdch paket\u016f m\u011bn\u00ed stav cache v s\u00ed\u0165ov\u00e9m z\u00e1sobn\u00edku, co\u017e umo\u017e\u0148uje na z\u00e1klad\u011b reakce serveru zjistit, kter\u00fd z UDP port\u016f je aktivn\u00ed a kter\u00fd nikoli. <\/p>\n Sc\u00e9n\u00e1\u0159 \u00fatoku: Kdy\u017e DNS resolver se pokou\u0161\u00ed ur\u010dit dom\u00e9nov\u00e9 jm\u00e9no, ode\u0161le UDP dotaz na obsluhuj\u00edc\u00ed dom\u00e9nov\u00fd DNS server. V okam\u017eiku, kdy resolver o\u010dek\u00e1v\u00e1 odpov\u011b\u010f, m\u016f\u017ee \u00fato\u010dn\u00edk rychle zjistit \u010d\u00edslo p\u016fvodn\u00edho portu, kter\u00e9 bylo pou\u017eito k odesl\u00e1n\u00ed dotazu, a poslat na n\u011bj fale\u0161nou odpov\u011b\u010f, vyd\u00e1vaje se za obsluhuj\u00edc\u00ed dom\u00e9nov\u00fd DNS server prost\u0159ednictv\u00edm spoofingu. IP adres<\/a>DNS resolver ulo\u017e\u00ed do cache informace p\u0159enesen\u00e9 v fale\u0161n\u00e9 odpov\u011bdi a n\u011bjakou dobu na v\u0161echny ostatn\u00ed DNS dotazy dom\u00e9nov\u00e9ho jm\u00e9na bude vracet podstr\u010denou IP adresu \u00fato\u010dn\u00edka. \u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u041a\u0430\u043b\u0438\u0444\u043e\u0440\u043d\u0438\u0439\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0432 \u0420\u0438\u0432\u0435\u0440\u0441\u0430\u0439\u0434\u0435 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u043d\u043e\u0432\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0430\u0442\u0430\u043a\u0438 SAD DNS (CVE-2021-20322), \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0439 \u043d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0437\u0430\u0449\u0438\u0442\u0443, \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u043d\u0443\u044e \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u0433\u043e\u0434\u0443 \u0434\u043b\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2020-25705. \u041d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0432 \u0446\u0435\u043b\u043e\u043c \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u0435\u043d \u043f\u0440\u043e\u0448\u043b\u043e\u0433\u043e\u0434\u043d\u0435\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438 \u043e\u0442\u043b\u0438\u0447\u0430\u0435\u0442\u0441\u044f \u043b\u0438\u0448\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0434\u0440\u0443\u0433\u043e\u0433\u043e \u0442\u0438\u043f\u0430 ICMP-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0445 UDP-\u043f\u043e\u0440\u0442\u043e\u0432. \u041f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u043d\u0430\u044f \u0430\u0442\u0430\u043a\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0442\u044c \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u0444\u0438\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u043a\u044d\u0448 DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u0430, \u0447\u0442\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102308","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Nov\u00e1 varianta \u00fatoku SAD DNS pro vkl\u00e1d\u00e1n\u00ed fale\u0161n\u00fdch dat do DNS cache | ProHoster","description":"Skupina v\u00fdzkumn\u00edk\u016f z Kalifornsk\u00e9 univerzity v Riverside publikovala novou variantu \u00fatoku SAD DNS (CVE-2021-20322), kter\u00e1 funguje navzdory ochran\u011b p\u0159idan\u00e9 minul\u00fd rok za \u00fa\u010delem zablokov\u00e1n\u00ed zranitelnosti.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/novyj-variant-ataki-sad-dns-dlya-podstanovki-fiktivnyh-dannyh-v-kesh-dns","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041d\u043e\u0432\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0430\u0442\u0430\u043a\u0438 SAD DNS \u0434\u043b\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0444\u0438\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u043a\u044d\u0448 DNS | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u041a\u0430\u043b\u0438\u0444\u043e\u0440\u043d\u0438\u0439\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0432 \u0420\u0438\u0432\u0435\u0440\u0441\u0430\u0439\u0434\u0435 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u043d\u043e\u0432\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0430\u0442\u0430\u043a\u0438 SAD DNS (CVE-2021-20322), \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0439 \u043d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0437\u0430\u0449\u0438\u0442\u0443, \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u043d\u0443\u044e \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u0433\u043e\u0434\u0443 \u0434\u043b\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/novyj-variant-ataki-sad-dns-dlya-podstanovki-fiktivnyh-dannyh-v-kesh-dns","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-11-17T19:36:54+00:00","article:modified_time":"2021-11-17T19:36:54+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102308","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-11-17 19:38:17","updated":"2026-02-09 21:46:42","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/102308","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=102308"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/102308\/revisions"}],"predecessor-version":[{"id":160307,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/102308\/revisions\/160307"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=102308"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=102308"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=102308"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"