{"id":100059,"date":"2021-04-29T10:22:42","date_gmt":"2021-04-29T08:22:42","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/obnovlenie-dns-servera-bind-c-ustraneniem-uyazvimosti-dopuskayushhej-udalyonnoe-vypolnenie-koda"},"modified":"2021-04-29T10:22:42","modified_gmt":"2021-04-29T08:22:42","slug":"obnovlenie-dns-servera-bind-c-ustraneniem-uyazvimosti-dopuskayushhej-udalyonnoe-vypolnenie-koda","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/obnovlenie-dns-servera-bind-c-ustraneniem-uyazvimosti-dopuskayushhej-udalyonnoe-vypolnenie-koda","title":{"rendered":"Opdatering af DNS-server BIND med rettelse af en s\u00e5rbarhed, der tillader fjernkodeudf\u00f8relse","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Der er offentliggjort rettende opdateringer til de stabile versioner af DNS-serveren BIND 9.11.31 og 9.16.15, samt til den eksperimentelle udviklingsversion 9.17.12. I de nye udgivelser er tre s\u00e5rbarheder blevet rettet, hvoraf en (CVE-2021-25216) kan f\u00f8re til et buffer-overl\u00f8b. P\u00e5 32-bit systemer kan s\u00e5rbarheden udnyttes til fjernudf\u00f8relse af ondsindet kode ved at sende en specielt udformet GSS-TSIG-anmodning. P\u00e5 64-bit systemer begr\u00e6nser problemet sig til nedbrud af named-processen.      <\/p>\n<p>Problemet opst\u00e5r kun, n\u00e5r GSS-TSIG-mekanismen er aktiveret via indstillingerne tkey-gssapi-keytab og tkey-gssapi-credential. GSS-TSIG er deaktiveret i standardkonfigurationen og anvendes typisk i blandede milj\u00f8er, hvor BIND interagerer med Active Directory-dom\u00e6nekontrollere, eller ved integration med Samba.       <\/p>\n<p>S\u00e5rbarheden skyldes en fejl i implementeringen af SPNEGO (Simple and Protected GSSAPI Negotiation Mechanism), der anvendes i GSSAPI til at forhandle de anvendte klient- og serversystemer. <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/da\/server\/dts-prohoster\/\"   title=\"serveren\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"3007\">serveren<\/a> beskyttelsesmetoder. GSSAPI anvendes som en h\u00f8j-niveau protokol til sikker n\u00f8gleudveksling ved hj\u00e6lp af udvidelsen GSS-TSIG, der anvendes i autentificeringsprocessen for dynamiske opdateringer af DNS-zoner.         <\/p>\n<p>Da kritiske s\u00e5rbarheder i den indbyggede implementering af SPNEGO tidligere er blevet opdaget, er implementeringen af denne protokol fjernet fra BIND 9's kodebase. Brugere, der har brug for st\u00f8tte til SPNEGO, anbefales at anvende en ekstern implementering leveret af systembiblioteket GSSAPI (tilg\u00e6ngelig i MIT Kerberos og Heimdal Kerberos).     <\/p>\n<p>Brugere af gamle versioner af BIND kan som en midlertidig l\u00f8sning p\u00e5 blokering af problemet deaktivere GSS-TSIG i indstillingerne (parametrene tkey-gssapi-keytab og tkey-gssapi-credential) eller genkompilere BIND uden underst\u00f8ttelse af SPNEGO-mekanismen (valgmuligheden &#171;&#8212;disable-isc-spnego&#187; i skriptet &#171;configure&#187;). Du kan f\u00f8lge med i opdateringer i distributionerne p\u00e5 f\u00f8lgende sider: Debian, SUSE, Ubuntu, Fedora, Arch Linux, FreeBSD, NetBSD. RHEL- og ALT Linux-pakkerne bygges uden indbygget underst\u00f8ttelse af SPNEGO.              <\/p>\n<p>Derudover er yderligere to s\u00e5rbarheder blevet rettet i de n\u00e6vnte opdateringer af BIND:  <\/p>\n<ul>\n<li class=\"l\"> CVE-2021-25215 &#8212; nedbrud af named-processen ved behandling af DNAME-poster (omdirigering af behandling af dele af underdom\u00e6ner), som f\u00f8rer til tilf\u00f8jelse af duplikater i ANSWER-sektionen. For at udnytte s\u00e5rbarheden p\u00e5 autoritative DNS-servere kr\u00e6ves der \u00e6ndringer i de behandlede DNS-zoner, og for rekursive <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/da\/server\/\"   title=\"servere\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"1576\">servere<\/a> kan den problematiske post opn\u00e5s efter henvendelse til en autoritativ server.\n<li class=\"l\"> CVE-2021-25214 &#8212; nedbrud af named-processen ved behandling af specielt formaterede indg\u00e5ende IXFR-anmodninger (bruges til inkrementel overf\u00f8rsel af \u00e6ndringer mellem DNS-servere i zoner). Problemet p\u00e5virker kun systemer, der har tilladt overf\u00f8rsel af DNS-zoner fra den angrebne server (normalt bruges zonetransmission til synkronisering mellem master- og slave-servere og tillades kun for betroede servere). Som en midlertidig l\u00f8sning kan st\u00f8tte til IXFR deaktiveres ved hj\u00e6lp af indstillingen &#171;request-ixfr no;&#187;.    <\/ul>\n<p>Kilde: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=55042\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u044b\u0445 \u0432\u0435\u0442\u043e\u043a DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 BIND 9.11.31 \u0438 9.16.15, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043d\u0430\u0445\u043e\u0434\u044f\u0449\u0435\u0439\u0441\u044f \u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 9.17.12. \u0412 \u043d\u043e\u0432\u044b\u0445 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0442\u0440\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043e\u0434\u043d\u0430 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 (CVE-2021-25216) \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u0431\u0443\u0444\u0435\u0440\u0430. \u041d\u0430 32-\u0440\u0430\u0437\u0440\u044f\u0434\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0437\u0430\u043f\u0440\u043e\u0441\u0430 GSS-TSIG. \u041d\u0430 64-\u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043a\u0440\u0430\u0445\u043e\u043c [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-100059","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u044b\u0445 \u0432\u0435\u0442\u043e\u043a DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 BIND 9.11.31 \u0438 9.16.15, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043d\u0430\u0445\u043e\u0434\u044f\u0449\u0435\u0439\u0441\u044f \u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 9.17.12.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/da\/blog\/news\/obnovlenie-dns-servera-bind-c-ustraneniem-uyazvimosti-dopuskayushhej-udalyonnoe-vypolnenie-koda\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"da_DK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 BIND c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0435\u0439 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u044b\u0445 \u0432\u0435\u0442\u043e\u043a DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 BIND 9.11.31 \u0438 9.16.15, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043d\u0430\u0445\u043e\u0434\u044f\u0449\u0435\u0439\u0441\u044f \u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 9.17.12.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/da\/blog\/news\/obnovlenie-dns-servera-bind-c-ustraneniem-uyazvimosti-dopuskayushhej-udalyonnoe-vypolnenie-koda\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2021-04-29T08:22:42+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2021-04-29T08:22:42+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Opdatering af DNS-serveren BIND med afhj\u00e6lpning af en s\u00e5rbarhed, der tillader fjernk\u00f8rsel af kode | ProHoster","description":"Der er udgivet korrigerende opdateringer til stabile versioner af DNS-serveren BIND 9.11.31 og 9.16.15, samt til den under udvikling eksperimentelle version 9.17.12.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/obnovlenie-dns-servera-bind-c-ustraneniem-uyazvimosti-dopuskayushhej-udalyonnoe-vypolnenie-koda","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 BIND c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0435\u0439 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u044b\u0445 \u0432\u0435\u0442\u043e\u043a DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 BIND 9.11.31 \u0438 9.16.15, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043d\u0430\u0445\u043e\u0434\u044f\u0449\u0435\u0439\u0441\u044f \u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 9.17.12.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/obnovlenie-dns-servera-bind-c-ustraneniem-uyazvimosti-dopuskayushhej-udalyonnoe-vypolnenie-koda","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-04-29T08:22:42+00:00","article:modified_time":"2021-04-29T08:22:42+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"100059","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-04-29 08:30:36","updated":"2026-02-09 21:46:37","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/100059","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=100059"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/100059\/revisions"}],"predecessor-version":[{"id":160288,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/100059\/revisions\/160288"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=100059"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=100059"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=100059"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}