{"id":74131,"date":"2020-03-14T14:42:14","date_gmt":"2020-03-14T11:42:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/obnovite-routeros-na-vashem-mikrotik"},"modified":"2020-03-14T14:42:14","modified_gmt":"2020-03-14T11:42:14","slug":"obnovite-routeros-na-vashem-mikrotik","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/obnovite-routeros-na-vashem-mikrotik","title":{"rendered":"Aktualizujte RouterOS na va\u0161em MikroTik","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Aktualizujte
\nVe\u010der 10. b\u0159ezna za\u010dala z\u00e1kaznick\u00e1 podpora Mail.ru dost\u00e1vat st\u00ed\u017enosti od u\u017eivatel\u016f na nemo\u017enost p\u0159ipojen\u00ed k IMAP\\\/SMTP server\u016fm Mail.ru prost\u0159ednictv\u00edm po\u0161tovn\u00edch program\u016f. N\u011bkter\u00e9 p\u0159ipojen\u00ed neproch\u00e1zely, jin\u00e9 ukazovaly chybu certifik\u00e1tu. Chyba byla zp\u016fsobena t\u00edm, \u017ee \u00abserver\u00bb vyd\u00e1val samopodepsan\u00fd certifik\u00e1t TLS.
\n<\/a><\/noindex>\u00a0
\n\"Aktualizujte
\nZa dva dny p\u0159i\u0161lo v\u00edce ne\u017e 10 st\u00ed\u017enost\u00ed od u\u017eivatel\u016f z r\u016fzn\u00fdch s\u00edt\u00ed a s r\u016fzn\u00fdmi za\u0159\u00edzen\u00edmi, co\u017e \u010dinilo m\u00e1lo pravd\u011bpodobn\u00fdm, \u017ee by probl\u00e9m byl v s\u00edti n\u011bjak\u00e9ho jednoho poskytovatele. Podrobn\u011bj\u0161\u00ed anal\u00fdza probl\u00e9mu odhalila, \u017ee doch\u00e1z\u00ed k podvr\u017een\u00ed serveru imap.mail.ru (a tak\u00e9 dal\u0161\u00edch po\u0161tovn\u00edch server\u016f a slu\u017eeb) na \u00farovni DNS. D\u00e1le, p\u0159i aktivn\u00ed pomoci na\u0161ich u\u017eivatel\u016f, jsme zjistili, \u017ee p\u0159\u00ed\u010dina spo\u010d\u00edv\u00e1 v nespr\u00e1vn\u00e9m z\u00e1znamu v cache jejich routeru, kter\u00fd z\u00e1rove\u0148 slou\u017e\u00ed jako lok\u00e1ln\u00ed DNS resolver, a kter\u00fdm ve mnoha (ale ne ve v\u0161ech) p\u0159\u00edpadech bylo za\u0159\u00edzen\u00ed MikroTik, velmi obl\u00edben\u00e9 v mal\u00fdch firemn\u00edch s\u00edt\u00edch a u mal\u00fdch poskytovatel\u016f Internetu.<\/p>\n

Jak\u00fd je probl\u00e9m<\/h2>\n

\nV z\u00e1\u0159\u00ed 2019 v\u00fdzkumn\u00edci objevili <\/a><\/noindex>n\u011bkolik zranitelnost\u00ed v MikroTik RouterOS (CVE-2019-3976, CVE-2019-3977, CVE-2019-3978, CVE-2019-3979), kter\u00e9 umo\u017e\u0148ovaly prov\u00e1d\u011bn\u00ed \u00fatoku DNS cache poisoning, tzn. mo\u017enost podvr\u017een\u00ed DNS z\u00e1znam\u016f v DNS cache routeru, p\u0159i\u010dem\u017e CVE-2019-3978 umo\u017e\u0148uje \u00fato\u010dn\u00edkovi ne\u010dekat, a\u017e se n\u011bkdo z vnit\u0159n\u00ed s\u00edt\u011b obr\u00e1t\u00ed na jeho DNS server, aby otr\u00e1vil cache resolveru, a iniciovat takov\u00fd po\u017eadavek s\u00e1m p\u0159es port 8291 (UDP a TCP). Zranitelnost byla opravena MikroTik ve verz\u00edch RouterOS 6.45.7 (stable) a 6.44.6 (long-term) 28. \u0159\u00edjna 2019, av\u0161ak podle v\u00fdzkum\u016f <\/a><\/noindex>v\u011bt\u0161ina u\u017eivatel\u016f v sou\u010dasnosti neinstalovala opravy.<\/p>\n

Je z\u0159ejm\u00e9, \u017ee se tato probl\u00e9m v sou\u010dasn\u00e9 dob\u011b aktivn\u011b zneu\u017e\u00edv\u00e1 \u201ev re\u00e1ln\u00e9m \u010dase\u201c.<\/p>\n

\u010c\u00edm je to nebezpe\u010dn\u00e9<\/h2>\n

\n\u00dato\u010dn\u00edk m\u016f\u017ee podvrhnout DNS z\u00e1znam jak\u00e9hokoli hostitele, na kter\u00fd se u\u017eivatel vnit\u0159n\u00ed s\u00edt\u011b obrac\u00ed, a t\u00edm odchytit provoz k n\u011bmu. Pokud se citliv\u00e9 informace p\u0159en\u00e1\u0161ej\u00ed bez \u0161ifrov\u00e1n\u00ed (nap\u0159\u00edklad p\u0159es http:\\\/\\\/ bez TLS) nebo u\u017eivatel souhlas\u00ed s p\u0159ijet\u00edm fale\u0161n\u00e9ho certifik\u00e1tu, \u00fato\u010dn\u00edk m\u016f\u017ee z\u00edskat v\u0161echny \u00fadaje, kter\u00e9 se p\u0159en\u00e1\u0161ej\u00ed prost\u0159ednictv\u00edm p\u0159ipojen\u00ed, nap\u0159\u00edklad u\u017eivatelsk\u00e9 jm\u00e9no nebo heslo. Bohu\u017eel praxe ukazuje, \u017ee pokud m\u00e1 u\u017eivatel mo\u017enost p\u0159ijmout fale\u0161n\u00fd certifik\u00e1t, pak ji vyu\u017eije.<\/p>\n

Pro\u010d pr\u00e1v\u011b servery SMTP a IMAP, a co chr\u00e1nilo u\u017eivatele<\/h2>\n

\nPro\u010d \u00fato\u010dn\u00edci zkou\u0161eli odchytit pr\u00e1v\u011b SMTP\/IMAP provoz e-mailov\u00fdch aplikac\u00ed, a ne webov\u00fd provoz, i kdy\u017e v\u011bt\u0161ina u\u017eivatel\u016f p\u0159istupuje k e-mailu p\u0159es prohl\u00ed\u017ee\u010d pomoc\u00ed HTTPS?<\/p>\n

Ne v\u0161echny e-mailov\u00e9 programy, kter\u00e9 pracuj\u00ed s protokoly SMTP a IMAP\/POP3, chr\u00e1n\u00ed u\u017eivatele p\u0159ed chybami t\u00edm, \u017ee mu neumo\u017en\u00ed poslat p\u0159ihla\u0161ovac\u00ed jm\u00e9no a heslo p\u0159es nezabezpe\u010den\u00e9 nebo kompromitovan\u00e9 spojen\u00ed, i kdy\u017e podle standardu RFC 8314<\/a><\/noindex>, p\u0159ijat\u00e9ho u\u017e v roce 2018 (a implementovan\u00e9ho v Mail.ru mnohem d\u0159\u00edve), by m\u011bly chr\u00e1nit u\u017eivatele p\u0159ed odchytem hesla p\u0159es jak\u00e9koli nezabezpe\u010den\u00e9 spojen\u00ed. Nav\u00edc se v e-mailov\u00fdch klientech velmi z\u0159\u00eddka pou\u017e\u00edv\u00e1 protokol OAuth (podporuje ho e-mailov\u00e9 servery Mail.ru), a bez n\u011bj se p\u0159ihla\u0161ovac\u00ed jm\u00e9no a heslo p\u0159ed\u00e1vaj\u00ed v ka\u017ed\u00e9 relaci.<\/p>\n

Prohl\u00ed\u017ee\u010de mohou b\u00fdt trochu l\u00e9pe chr\u00e1n\u011bny p\u0159ed \u00fatoky typu Man-in-the-Middle. Na v\u0161ech kritick\u00fdch dom\u00e9n\u00e1ch mail.ru je krom\u011b HTTPS nav\u00edc implementov\u00e1na politika HSTS (HTTP strict transport security). P\u0159i zapnut\u00e9m HSTS modern\u00ed prohl\u00ed\u017ee\u010d u\u017eivateli ned\u00e1v\u00e1 jednoduchou mo\u017enost p\u0159ijmout pad\u011blen\u00fd certifik\u00e1t, i kdy\u017e by to u\u017eivatel cht\u011bl. Krom\u011b HSTS u\u017eivatele chr\u00e1nilo tak\u00e9 to, \u017ee od roku 2017 servery SMTP, IMAP a POP3 Mail.ru zakazuj\u00ed p\u0159enos hesla p\u0159es nezabezpe\u010den\u00e9 spojen\u00ed, v\u0161ichni na\u0161i u\u017eivatel\u00e9 pou\u017e\u00edvali TLS pro p\u0159\u00edstup p\u0159es SMTP, POP3 a IMAP, a proto lze p\u0159ihla\u0161ovac\u00ed jm\u00e9no a heslo odchytit jen tehdy, pokud se u\u017eivatel s\u00e1m rozhodne p\u0159ijmout pozm\u011bn\u011bn\u00fd certifik\u00e1t.<\/p>\n

Pro mobiln\u00ed u\u017eivatele v\u017edy doporu\u010dujeme pou\u017e\u00edvat aplikace Mail.ru pro p\u0159\u00edstup k e-mailu, proto\u017ee pr\u00e1ce s e-mailem v nich je bezpe\u010dn\u011bj\u0161\u00ed ne\u017e v prohl\u00ed\u017ee\u010d\u00edch nebo integrovan\u00fdch SMTP\/IMAP klientech.<\/p>\n

Co je pot\u0159eba ud\u011blat<\/h2>\n

\nJe t\u0159eba aktualizovat firmware MikroTik RouterOS na bezpe\u010dnou verzi. Pokud to z n\u011bjak\u00e9ho d\u016fvodu nen\u00ed mo\u017en\u00e9, je nutn\u00e9 filtrovat provoz na portu 8291 (tcp a udp), co\u017e zt\u00ed\u017e\u00ed vyu\u017e\u00edv\u00e1n\u00ed probl\u00e9mu, i kdy\u017e to neodstran\u00ed mo\u017enost pasivn\u00ed injekce do DNS cache. Internetov\u00ed poskytovatel\u00e9 by m\u011bli filtrovat tento port na sv\u00fdch s\u00edt\u00edch, aby chr\u00e1nili firemn\u00ed u\u017eivatele.\u00a0<\/p>\n

V\u0161em u\u017eivatel\u016fm, kte\u0159\u00ed p\u0159ijali pozm\u011bn\u011bn\u00fd certifik\u00e1t, se doporu\u010duje okam\u017eit\u011b zm\u011bnit heslo k e-mailu a dal\u0161\u00edm slu\u017eb\u00e1m, pro kter\u00e9 byl tento certifik\u00e1t p\u0159ijat. Z na\u0161\u00ed strany upozorn\u00edme u\u017eivatele, kte\u0159\u00ed se p\u0159ihla\u0161uj\u00ed k e-mailu p\u0159es zraniteln\u00e9 za\u0159\u00edzen\u00ed.<\/p>\n

P.S. Existuje tak\u00e9 souvisej\u00edc\u00ed zranitelnost popsan\u00e1 v p\u0159\u00edsp\u011bvku LukaSafonov<\/a><\/noindex> "Backport zranitelnosti v RouterOS ohro\u017euje stovky tis\u00edc za\u0159\u00edzen\u00ed<\/a><\/noindex>.
\n
Zdroj: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412\u0435\u0447\u0435\u0440\u043e\u043c 10 \u043c\u0430\u0440\u0442\u0430 \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 Mail.ru \u043d\u0430\u0447\u0430\u043b\u0430 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u0436\u0430\u043b\u043e\u0431\u044b \u043e\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043d\u0430 \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a IMAP\/SMTP \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c Mail.ru \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0447\u0430\u0441\u0442\u044c \u043a\u043e\u043d\u043d\u0435\u043a\u0442\u043e\u0432 \u043d\u0435 \u043f\u0440\u043e\u0445\u043e\u0434\u0438\u043b\u0430, \u0430 \u0447\u0430\u0441\u0442\u044c \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u044e\u0442 \u043e\u0448\u0438\u0431\u043a\u0443 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430. \u041e\u0448\u0438\u0431\u043a\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u0442\u0435\u043c, \u0447\u0442\u043e \u00ab\u0441\u0435\u0440\u0432\u0435\u0440\u00bb \u043e\u0442\u0434\u0430\u0435\u0442 \u0441\u0430\u043c\u043e\u043f\u043e\u0434\u043f\u0438\u0441\u0430\u043d\u044b\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 TLS. \u00a0 \u0417\u0430 \u0434\u0432\u0430 \u0434\u043d\u044f \u043f\u0440\u0438\u0448\u043b\u043e \u0431\u043e\u043b\u0435\u0435 10 \u0436\u0430\u043b\u043e\u0431 \u043e\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0441\u0430\u043c\u044b\u0445 \u0440\u0430\u0437\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":74132,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-74131","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Aktualizujte RouterOS na va\u0161em MikroTik | ProHoster","description":"Ve\u010der 10. b\u0159ezna zah\u00e1jila technick\u00e1 podpora Mail.ru.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/obnovite-routeros-na-vashem-mikrotik","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0431\u043d\u043e\u0432\u0438\u0442\u0435 RouterOS \u043d\u0430 \u0432\u0430\u0448\u0435\u043c MikroTik | ProHoster","og:description":"\u0412\u0435\u0447\u0435\u0440\u043e\u043c 10 \u043c\u0430\u0440\u0442\u0430 \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 Mail.ru \u043d\u0430\u0447\u0430\u043b\u0430.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/obnovite-routeros-na-vashem-mikrotik","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-14T11:42:14+00:00","article:modified_time":"2020-03-14T11:42:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"74131","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:20:27","updated":"2022-09-30 20:30:09","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/74131","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=74131"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/74131\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/74132"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=74131"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=74131"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=74131"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}