{"id":104866,"date":"2022-08-17T09:36:49","date_gmt":"2022-08-17T07:36:49","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-ustrojstvah-na-baze-soc-realtek-pozvolyayushhaya-vypolnit-kod-cherez-otpravku-udp-paketa"},"modified":"2022-08-17T09:36:49","modified_gmt":"2022-08-17T07:36:49","slug":"uyazvimost-v-ustrojstvah-na-baze-soc-realtek-pozvolyayushhaya-vypolnit-kod-cherez-otpravku-udp-paketa","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimost-v-ustrojstvah-na-baze-soc-realtek-pozvolyayushhaya-vypolnit-kod-cherez-otpravku-udp-paketa","title":{"rendered":"S\u00e5rbarhed i enheder baseret p\u00e5 Realtek SoC, der muligg\u00f8r udf\u00f8relse af kode ved at sende en UDP-pakke","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Forskere fra Faraday Security pr\u00e6senterede detaljer om udnyttelsen af en kritisk s\u00e5rbarhed (CVE-2022-27255) i SDK'en til Realtek RTL819x chips p\u00e5 DEFCON-konferencen. S\u00e5rbarheden muligg\u00f8r udf\u00f8relse af brugerdefineret kode p\u00e5 enheden ved at sende et specielt formateret UDP-pakke. S\u00e5rbarheden er bem\u00e6rkelsesv\u00e6rdig, da den tillader angreb p\u00e5 enheder, hvor adgangen til webgr\u00e6nsefladen for eksterne netv\u00e6rk er deaktiveret \u2014 det er tilstr\u00e6kkeligt at sende blot \u00e9n UDP-pakke.    <\/p>\n<p>S\u00e5rbarheden p\u00e5virker enheder, der bruger s\u00e5rbare versioner af Realtek SDK, herunder eCos RSDK 1.5.7p1 og MSDK 4.9.4p1. Opdateringer af eCos SDK, der fjerner s\u00e5rbarheden, blev offentliggjort af Realtek den 25. marts. Det er endnu uklart, hvilke specifikke enheder der er ber\u00f8rt \u2014 SoC'en Realtek RTL819x anvendes i netv\u00e6rksroutere, adgangspunkter, Wi-Fi-forst\u00e6rkere, IP-kameraer, Internet of Things-enheder og andre netv\u00e6rksenheder fra mere end 60 producenter, herunder Asus, A-Link, Beeline, Belkin, Buffalo, D-Link, Edison, Huawei, LG, Logitec, MT-Link, Netgear, Smartlink, UPVEL, ZTE og Zyxel.     <\/p>\n<p>Eksempler p\u00e5 exploits til at opn\u00e5 fjernadgang til enheden og udf\u00f8re egne kommandoer ved angreb p\u00e5 Nexxt Nebula 300 Plus-routeren er allerede blevet offentliggjort. Derudover er der offentliggjort v\u00e6rkt\u00f8jer til at analysere firmware for s\u00e5rbarheder.     <\/p>\n<p>I betragtning af problemerne med forberedelse og levering samt opdateringer af firmwares til allerede udgivne enheder, forventes det, at automatiserede angreb og orme, der rammer s\u00e5rbare netv\u00e6rksenheder, vil dukke op snart. Efter et vellykket angreb kan de ber\u00f8rte enheder bruges af ondsindede akt\u00f8rer, eksempelvis til at danne botnets, implementere bagd\u00f8re for at efterlade en indgang til virksomhedens interne netv\u00e6rk, opsnappe transittrafik eller omdirigere den til en ekstern v\u00e6rt.    <\/p>\n<p>S\u00e5rbarheden skyldes buffer overflow i modulet \u00abSIP ALG\u00bb (SIP Application Layer Gateway), der bruges til at etablere videresendelse af SIP-pakker bag en NAT. Problemet opstod p\u00e5 grund af mangel p\u00e5 kontrol af den faktiske st\u00f8rrelse af de modtagne data, hvilket medf\u00f8rer overskrivning af hukommelsesomr\u00e5det uden for den faste buffer ved kald af strcpy-funktionen under behandlingen af SIP-pakker. Et angreb kan udf\u00f8res ved at sende en UDP-pakke med ugyldige v\u00e6rdier i felterne i SDP-data blocken eller SIP-protokolheaderen. Det er tilstr\u00e6kkeligt at sende \u00e9n pakke til en vilk\u00e5rlig UDP-port p\u00e5 WAN-interfacet.      <center>  <video controls=\"\" style=\"width: 700px; height: 400px; max-width:100%\"><source src=\"https:\/\/github.com\/infobyte\/cve-2022-27255\/raw\/main\/DEFCON\/poc.mp4\" type=\"video\/mp4\"><\/video>  <\/center>    <\/p>\n<p>Som en midlertidig sikkerhedsforanstaltning anbefales det at blokere UDP-pakker med SIP-beskeden \u00abINVITE\u00bb, linjen \u00abm=audio\u00bb og st\u00f8rre st\u00f8rrelse end 128 byte i firewall'en eller i systemet til forebyggelse af netv\u00e6rksindtr\u00e6ngen. Eksempel p\u00e5 regel for identificering af udnyttelsesfors\u00f8g i IDS Snort 3: alert udp any any -&gt; any any (sid:1000000; msg:\u00abRealtek eCOS SDK SIP Traffic Exploit CVE-2022-27255\u00bb; content: \u00abinvite\u00bb; depth: 6; nocase; content: \u00abm=audio \u00bb; isdataat: 128,relative; content:!\u00ab|0d|\u00bb; within: 128;)<br \/>\n<br \/>Kilde: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=57645\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Faraday Security \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0438 \u043d\u0430 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 DEFCON \u0434\u0435\u0442\u0430\u043b\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2022-27255) \u0432 SDK \u0434\u043b\u044f \u0447\u0438\u043f\u043e\u0432 Realtek RTL819x, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0441\u0432\u043e\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e UDP-\u043f\u0430\u043a\u0435\u0442\u0430. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u0430 \u0442\u0435\u043c, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u0442\u044c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043e\u0442\u043a\u043b\u044e\u0447\u0451\u043d \u0434\u043e\u0441\u0442\u0443\u043f \u0432 web-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 \u0434\u043b\u044f \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0441\u0435\u0442\u0435\u0439 &#8212; \u0434\u043b\u044f \u0430\u0442\u0430\u043a\u0438 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043f\u0440\u043e\u0441\u0442\u043e \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u043e\u0434\u0438\u043d UDP-\u043f\u0430\u043a\u0435\u0442. [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-104866","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Faraday Security \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0438 \u043d\u0430 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 DEFCON \u0434\u0435\u0442\u0430\u043b\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2022-27255) \u0432 SDK \u0434\u043b\u044f \u0447\u0438\u043f\u043e\u0432 Realtek RTL819x, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0441\u0432\u043e\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimost-v-ustrojstvah-na-baze-soc-realtek-pozvolyayushhaya-vypolnit-kod-cherez-otpravku-udp-paketa\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"da_DK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 \u043d\u0430 \u0431\u0430\u0437\u0435 SoC Realtek, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 UDP-\u043f\u0430\u043a\u0435\u0442\u0430 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Faraday Security \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0438 \u043d\u0430 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 DEFCON \u0434\u0435\u0442\u0430\u043b\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2022-27255) \u0432 SDK \u0434\u043b\u044f \u0447\u0438\u043f\u043e\u0432 Realtek RTL819x, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0441\u0432\u043e\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimost-v-ustrojstvah-na-baze-soc-realtek-pozvolyayushhaya-vypolnit-kod-cherez-otpravku-udp-paketa\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2022-08-17T07:36:49+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2022-08-17T07:36:49+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47S\u00e5rbarhed i enheder baseret p\u00e5 SoC Realtek, der muligg\u00f8r udf\u00f8relse af kode ved at sende en UDP-pakke | ProHoster","description":"Forskere fra Faraday Security pr\u00e6senterede detaljer om udnyttelsen af en kritisk s\u00e5rbarhed (CVE-2022-27255) i SDK'et til Realtek RTL819x chips p\u00e5 DEFCON-konferencen, som muligg\u00f8r udf\u00f8relse af egen kode p\u00e5 enheden.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimost-v-ustrojstvah-na-baze-soc-realtek-pozvolyayushhaya-vypolnit-kod-cherez-otpravku-udp-paketa","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 \u043d\u0430 \u0431\u0430\u0437\u0435 SoC Realtek, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 UDP-\u043f\u0430\u043a\u0435\u0442\u0430 | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Faraday Security \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0438 \u043d\u0430 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 DEFCON \u0434\u0435\u0442\u0430\u043b\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2022-27255) \u0432 SDK \u0434\u043b\u044f \u0447\u0438\u043f\u043e\u0432 Realtek RTL819x, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0441\u0432\u043e\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimost-v-ustrojstvah-na-baze-soc-realtek-pozvolyayushhaya-vypolnit-kod-cherez-otpravku-udp-paketa","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-08-17T07:36:49+00:00","article:modified_time":"2022-08-17T07:36:49+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"104866","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-08-17 07:37:54","updated":"2022-09-28 09:36:11","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/104866","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=104866"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/104866\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=104866"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=104866"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=104866"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}