{"id":85612,"date":"2020-06-17T19:42:36","date_gmt":"2020-06-17T17:42:36","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/19-udalyonno-ekspluatiruemyh-uyazvimostej-v-tcp-ip-steke-treck"},"modified":"2020-06-17T19:42:36","modified_gmt":"2020-06-17T17:42:36","slug":"19-udalyonno-ekspluatiruemyh-uyazvimostej-v-tcp-ip-steke-treck","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/19-udalyonno-ekspluatiruemyh-uyazvimostej-v-tcp-ip-steke-treck","title":{"rendered":"19 vzd\u00e1len\u011b zneu\u017eiteln\u00fdch zranitelnost\u00ed v TCP\/IP stacku Treck.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V propriet\u00e1rn\u00edm TCP\/IP stacku Treck<\/a><\/noindex> odhaleno<\/a><\/noindex> 19 zranitelnost\u00ed<\/a><\/noindex>, kter\u00e9 jsou zneu\u017eiteln\u00e9 zasl\u00e1n\u00edm speci\u00e1ln\u011b upraven\u00fdch paket\u016f. Zranitelnost nese k\u00f3dov\u00e9 jm\u00e9no Ripple20<\/a><\/noindex>. N\u011bkter\u00e9 zranitelnosti se tak\u00e9 projevuj\u00ed v TCP\/IP stacku KASAGO od spole\u010dnosti Zuken Elmic (Elmic Systems), kter\u00fd m\u00e1 spole\u010dn\u00e9 ko\u0159eny s Treckem. Stack Treck se pou\u017e\u00edv\u00e1 v mnoha pr\u016fmyslov\u00fdch, l\u00e9ka\u0159sk\u00fdch, komunika\u010dn\u00edch, vestav\u011bn\u00fdch a spot\u0159ebitelsk\u00fdch za\u0159\u00edzen\u00edch (od chytr\u00fdch \u017e\u00e1rovek po tisk\u00e1rny a z\u00e1lo\u017en\u00ed zdroje), stejn\u011b jako v energetick\u00e9m, dopravn\u00edm, leteck\u00e9m, obchodn\u00edm a t\u011b\u017eebn\u00edm za\u0159\u00edzen\u00ed. <\/p>\n

\"19<\/a><\/noindex><\/center><\/p>\n

Mezi v\u00fdznamn\u00e9 c\u00edle \u00fatok\u016f, ve kter\u00fdch je vyu\u017e\u00edv\u00e1n TCP\/IP stack Treck, pat\u0159\u00ed s\u00ed\u0165ov\u00e9 tisk\u00e1rny HP a \u010dipy Intel. Mezi nimi byly probl\u00e9my v TCP\/IP stacku Treck p\u0159\u00ed\u010dinou ned\u00e1vn\u00fdch vzd\u00e1len\u00fdch zranitelnost\u00ed<\/a><\/noindex> v subsyst\u00e9mech Intel AMT a ISM, kter\u00e9 jsou zneu\u017eiteln\u00e9 zasl\u00e1n\u00edm s\u00ed\u0165ov\u00e9ho paketu. Existenci zranitelnost\u00ed potvrdili v\u00fdrobci Intel, HP, Hewlett Packard Enterprise, Baxter, Caterpillar, Digi, Rockwell Automation a Schneider Electric. Dal\u0161\u00edch
\n66 v\u00fdrobc\u016f<\/a><\/noindex>, jejich\u017e produkty vyu\u017e\u00edvaj\u00ed TCP\/IP stack Treck, zat\u00edm na probl\u00e9my nereagovalo. 5 v\u00fdrobc\u016f, mezi kter\u00fdmi je AMD, prohl\u00e1silo, \u017ee jejich produkty nejsou t\u011bmito probl\u00e9my dot\u010deny.<\/p>\n

\"19<\/a><\/noindex><\/center><\/p>\n

Probl\u00e9my byly nalezeny v implementaci protokol\u016f IPv4, IPv6, UDP, DNS, DHCP, TCP, ICMPv4 a ARP, a byly zp\u016fsobeny nespr\u00e1vn\u00fdm zpracov\u00e1n\u00edm parametr\u016f s velikost\u00ed dat (pou\u017eit\u00ed pole o velikosti bez kontroly skute\u010dn\u00e9 velikosti dat), chybami v ov\u011b\u0159ov\u00e1n\u00ed vstupn\u00edch informac\u00ed, duplikovan\u00fdm uvoln\u011bn\u00edm pam\u011bti, \u010dten\u00edm z oblasti mimo buffer, celocifern\u00edm p\u0159ete\u010den\u00edm, nespr\u00e1vnou kontrolou p\u0159\u00edstupu a probl\u00e9my p\u0159i zpracov\u00e1n\u00ed \u0159et\u011bzc\u016f s nulov\u00fdm odd\u011blova\u010dem. <\/p>\n

Dv\u011b nejnebezpe\u010dn\u011bj\u0161\u00ed probl\u00e9my (CVE-2020-11896, CVE-2020-11897), kter\u00fdm byl p\u0159id\u011blen \u00farove\u0148 CVSS 10, umo\u017e\u0148uj\u00ed prov\u00e9st vlastn\u00ed k\u00f3d na za\u0159\u00edzen\u00ed zasl\u00e1n\u00edm ur\u010dit\u00fdm zp\u016fsobem upraven\u00fdch paket\u016f IPv4\/UDP nebo IPv6. Prvn\u00ed kritick\u00fd probl\u00e9m se projevuje na za\u0159\u00edzen\u00edch s podporou IPv4 tunel\u016f, zat\u00edmco druh\u00fd na verz\u00edch vydan\u00fdch p\u0159ed 04.06.2009 s podporou IPv6. Dal\u0161\u00ed kritick\u00e1 zranitelnost (CVSS 9) je p\u0159\u00edtomna v DNS resolveru (CVE-2020-11901) a umo\u017e\u0148uje prov\u00e9st k\u00f3d zasl\u00e1n\u00edm speci\u00e1ln\u011b upraven\u00e9ho DNS dotazu (probl\u00e9m byl pou\u017eit k demonstraci hacku Schneider Electric APC UPS a projevuje se na za\u0159\u00edzen\u00edch s podporou DNS).<\/p>\n

Dal\u0161\u00ed zranitelnosti CVE-2020-11898, CVE-2020-11899, CVE-2020-11902, CVE-2020-11903, CVE-2020-11905 umo\u017e\u0148uj\u00ed zjistit obsah pam\u011b\u0165ov\u00fdch oblast\u00ed syst\u00e9mu prost\u0159ednictv\u00edm odes\u00edl\u00e1n\u00ed speci\u00e1ln\u011b form\u00e1tovan\u00fdch paket\u016f IPv4\/ICMPv4, IPv6OverIPv4, DHCP, DHCPv6 nebo IPv6. Dal\u0161\u00ed probl\u00e9my mohou v\u00e9st k nedostupnosti slu\u017eby nebo \u00faniku zbytkov\u00fdch dat ze syst\u00e9mov\u00fdch vyrovn\u00e1vac\u00edch pam\u011bt\u00ed.<\/p>\n

V\u011bt\u0161ina zranitelnost\u00ed byla odstran\u011bna ve verzi Treck 6.0.1.67 (probl\u00e9m CVE-2020-11897 byl vy\u0159e\u0161en ve verzi 5.0.1.35, CVE-2020-11900 ve verzi 6.0.1.41, CVE-2020-11903 ve verzi 6.0.1.28, CVE-2020-11908 ve verzi 4.7.1.27). Vzhledem k tomu, \u017ee p\u0159\u00edprava aktualizac\u00ed firmwaru pro konkr\u00e9tn\u00ed za\u0159\u00edzen\u00ed m\u016f\u017ee trvat dlouho nebo m\u016f\u017ee b\u00fdt nemo\u017en\u00e1 (stack Treck je dod\u00e1v\u00e1n v\u00edce ne\u017e 20 let, mnoho za\u0159\u00edzen\u00ed z\u016fstalo bez podpory nebo je obt\u00ed\u017en\u00e9 je aktualizovat), se doporu\u010duje administr\u00e1tor\u016fm izolovat problematick\u00e1 za\u0159\u00edzen\u00ed a nastavit na syst\u00e9mech pro inspekci paket\u016f, firewallech nebo sm\u011brova\u010d\u00edch normalizaci nebo blokov\u00e1n\u00ed fragmentovan\u00fdch paket\u016f, zablokovat IP tunely (IPv6-in-IPv4 a IP-in-IP), zablokovat \u201esource routing\u201c, aktivovat inspekci nespr\u00e1vn\u00fdch voleb v TCP paketech, blokovat nepou\u017e\u00edvan\u00e9 ICMP kontroln\u00ed zpr\u00e1vy (MTU Update a Address Mask), zak\u00e1zat IPv6 multicast a p\u0159esm\u011brovat DNS dotazy na zabezpe\u010den\u00fd rekurzivn\u00ed DNS server.<\/p>\n


\n
\r\n \"P\u0159ehr\u00e1t\r\n
<\/div>\r\n <\/div><\/center><\/p>\n

<\/a><\/noindex><\/p>\n

Zdroj: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043f\u0440\u043e\u043f\u0440\u0438\u0435\u0442\u0430\u0440\u043d\u043e\u043c TCP\/IP \u0441\u0442\u0435\u043a\u0435 Treck \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 19 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u043e \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f Ripple20. \u041d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0442\u0430\u043a\u0436\u0435 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u0432 TCP\/IP-\u0441\u0442\u0435\u043a\u0435 KASAGO \u043e\u0442 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Zuken Elmic (Elmic Systems), \u0438\u043c\u0435\u044e\u0449\u0435\u043c \u043e\u0431\u0449\u0438\u0435 \u043a\u043e\u0440\u043d\u0438 c Treck. \u0421\u0442\u0435\u043a Treck \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u0432\u043e \u043c\u043d\u043e\u0433\u0438\u0445 \u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u044b\u0445, \u043c\u0435\u0434\u0438\u0446\u0438\u043d\u0441\u043a\u0438\u0445, \u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445, \u0432\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0438 \u043f\u043e\u0442\u0440\u0435\u0431\u0438\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 (\u043e\u0442 \u0443\u043c\u043d\u044b\u0445 \u043b\u0430\u043c\u043f \u0434\u043e \u043f\u0440\u0438\u043d\u0442\u0435\u0440\u043e\u0432 \u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":85613,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-85612","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd4719 vzd\u00e1len\u011b zneu\u017eiteln\u00fdch zranitelnost\u00ed v TCP\/IP z\u00e1sobn\u00edku Treck | ProHoster","description":"Byla zji\u0161t\u011bna zranitelnost v propriet\u00e1rn\u00edm TCP\/IP z\u00e1sobn\u00edku Treck.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/19-udalyonno-ekspluatiruemyh-uyazvimostej-v-tcp-ip-steke-treck","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd4719 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 TCP\/IP-\u0441\u0442\u0435\u043a\u0435 Treck | ProHoster","og:description":"\u0412 \u043f\u0440\u043e\u043f\u0440\u0438\u0435\u0442\u0430\u0440\u043d\u043e\u043c TCP\/IP \u0441\u0442\u0435\u043a\u0435 Treck \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/19-udalyonno-ekspluatiruemyh-uyazvimostej-v-tcp-ip-steke-treck","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-17T17:42:36+00:00","article:modified_time":"2020-06-17T17:42:36+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"85612","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 13:55:50","updated":"2022-09-28 01:40:49","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/85612","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=85612"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/85612\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/85613"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=85612"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=85612"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=85612"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}