{"id":99712,"date":"2021-04-13T16:22:45","date_gmt":"2021-04-13T14:22:45","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-vo-freebsd-ipnet-i-nucleus-net-svyazannye-s-oshibkami-pri-realizaczii-szhatiya-v-dns"},"modified":"2021-04-13T16:22:45","modified_gmt":"2021-04-13T14:22:45","slug":"uyazvimosti-vo-freebsd-ipnet-i-nucleus-net-svyazannye-s-oshibkami-pri-realizaczii-szhatiya-v-dns","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimosti-vo-freebsd-ipnet-i-nucleus-net-svyazannye-s-oshibkami-pri-realizaczii-szhatiya-v-dns","title":{"rendered":"Vulnerabilities in FreeBSD, IPnet, and Nucleus NET related to compression implementation errors in DNS","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>The research groups Forescout Research Labs and JSOF Research published the results of their joint investigation into the security of various implementations of compression schemes used for packing duplicate names in DNS, mDNS, DHCP, and IPv6 RA messages (packing duplicate parts of domains in messages that include multiple names). The study identified nine vulnerabilities, summarized under the code name NAME:WRECK.     <\/p>\n<p>Issues were found in FreeBSD, as well as in the IPnet, Nucleus NET, and NetX networking subsystems, which are prevalent in real-time operating systems such as VxWorks, Nucleus, and ThreadX, used in automation devices, storage systems, medical devices, avionics, printers, and consumer electronics. It is estimated that at least 100 million devices are affected by these vulnerabilities.      <\/p>\n<ul>\n<li class=\"l\"> The vulnerability in FreeBSD (CVE-2020-7461) allowed for remote code execution through the sending of a specially crafted DHCP packet by an attacker within the same local network as the victim. Processing this packet by a vulnerable DHCP client led to a buffer overflow. The issue was mitigated by the fact that the dhclient process, which contained the vulnerability, ran with reduced privileges in a Capsicum isolated environment, from which an additional vulnerability would need to be discovered to escape.\n<p>The essence of the error lies in the incorrect validation of parameters in the packet returned by the DHCP server, which includes the DHCP option 119, allowing the transmission of a \"domain search\" list for the resolver. An incorrect calculation of the buffer size needed to accommodate the unpacked data. <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/en\/domain\/\"   title=\"domain names\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"908\">domain names<\/a>In FreeBSD, the problem was resolved back in September of last year. The vulnerability can only be exploited with access to the local network.          <\/p>\n<li class=\"l\"> The vulnerability in the embedded networking stack IPnet, used in the RTOS VxWorks, potentially allows code execution on the DNS client side due to incorrect handling of DNS message compression. It turned out that this vulnerability was first identified by Exodus back in 2016, but it was never fixed. A new inquiry to Wind River also went unanswered, leaving devices with IPnet vulnerable.\n<li class=\"l\"> In the TCP\/IP stack Nucleus NET, supported by Siemens, 6 vulnerabilities have been identified, two of which could lead to remote code execution, while four could initiate a denial of service. The first critical issue is related to an error in unpacking compressed DNS messages, and the second is due to improper parsing of domain name labels. Both issues result in a buffer overflow when processing specially crafted DNS responses.\n<p>To exploit these vulnerabilities, an attacker merely needs to send a specially crafted response to any legitimate request made from a vulnerable device, for example, by conducting a MITM attack and injecting into the traffic between the DNS server and the victim. If the attacker has access to the local network, they can launch a DNS server that attempts to attack the problematic devices by sending mDNS requests in broadcast mode.    <\/p>\n<li class=\"l\"> A vulnerability in the NetX network stack (Azure RTOS NetX), developed for ThreadX RTOS and made open after being acquired by Microsoft in 2019, was limited to denial of service. The issue arises from an error in parsing compressed DNS messages in the resolver implementation.      <\/ul>\n<p>Among the checked network stacks that did not show vulnerabilities associated with the compression of repeated data in DNS messages are the lwIP, Nut\/Net, Zephyr, uC\/TCP-IP, FreeRTOS+TCP, OpenThread, and FNET projects. Notably, the first two (Nut\/Net and lwIP) do not support compression in DNS messages at all, while the others implement this operation without errors. Additionally, it is noted that the same researchers had previously identified similar vulnerabilities in the Treck, uIP, and PicoTCP stacks.<br \/>\n<br \/>Source: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=54961\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0435 \u0433\u0440\u0443\u043f\u043f\u044b Forescout Research Labs \u0438 JSOF Research \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u0433\u043e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0439 \u0441\u0445\u0435\u043c\u044b \u0441\u0436\u0430\u0442\u0438\u044f, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0439 \u0434\u043b\u044f \u0443\u043f\u0430\u043a\u043e\u0432\u043a\u0438 \u043f\u043e\u0432\u0442\u043e\u0440\u044f\u044e\u0449\u0438\u0445\u0441\u044f \u0438\u043c\u0451\u043d \u0432 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f\u0445 DNS, mDNS, DHCP \u0438 IPv6 RA (\u0443\u043f\u0430\u043a\u043e\u0432\u043a\u0430 \u0434\u0443\u0431\u043b\u0438\u0440\u0443\u044e\u0449\u0438\u0445\u0441\u044f \u0447\u0430\u0441\u0442\u0435\u0439 \u0434\u043e\u043c\u0435\u043d\u043e\u0432 \u0432 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f\u0445, \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0449\u0438\u0445 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0438\u043c\u0451\u043d). \u0412 \u0445\u043e\u0434\u0435 \u043f\u0440\u043e\u0432\u0435\u0434\u0451\u043d\u043d\u043e\u0439 \u0440\u0430\u0431\u043e\u0442\u044b \u0431\u044b\u043b\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 9 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043e\u0431\u043e\u0431\u0449\u0435\u043d\u044b \u043f\u043e\u0434 \u043a\u043e\u0434\u043e\u0432\u044b\u043c \u0438\u043c\u0435\u043d\u0435\u043c NAME:WRECK. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-99712","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0435 \u0433\u0440\u0443\u043f\u043f\u044b Forescout Research Labs \u0438 JSOF Research \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u0433\u043e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0439 \u0441\u0445\u0435\u043c\u044b \u0441\u0436\u0430\u0442\u0438\u044f, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0439 \u0434\u043b\u044f \u0443\u043f\u0430\u043a\u043e\u0432\u043a\u0438 \u043f\u043e\u0432\u0442\u043e\u0440\u044f\u044e\u0449\u0438\u0445\u0441\u044f \u0438\u043c\u0451\u043d \u0432.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimosti-vo-freebsd-ipnet-i-nucleus-net-svyazannye-s-oshibkami-pri-realizaczii-szhatiya-v-dns\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432\u043e FreeBSD, IPnet \u0438 Nucleus NET, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438 \u043f\u0440\u0438 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u0436\u0430\u0442\u0438\u044f \u0432 DNS | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0435 \u0433\u0440\u0443\u043f\u043f\u044b Forescout Research Labs \u0438 JSOF Research \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u0433\u043e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0439 \u0441\u0445\u0435\u043c\u044b \u0441\u0436\u0430\u0442\u0438\u044f, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0439 \u0434\u043b\u044f \u0443\u043f\u0430\u043a\u043e\u0432\u043a\u0438 \u043f\u043e\u0432\u0442\u043e\u0440\u044f\u044e\u0449\u0438\u0445\u0441\u044f \u0438\u043c\u0451\u043d \u0432.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimosti-vo-freebsd-ipnet-i-nucleus-net-svyazannye-s-oshibkami-pri-realizaczii-szhatiya-v-dns\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2021-04-13T14:22:45+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2021-04-13T14:22:45+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilities in FreeBSD, IPnet, and Nucleus NET related to errors in the implementation of compression in DNS | ProHoster","description":"The Forescout Research Labs and JSOF Research teams published the results of a joint study on the security of various implementations of the compression scheme used for packaging duplicate names in DNS.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimosti-vo-freebsd-ipnet-i-nucleus-net-svyazannye-s-oshibkami-pri-realizaczii-szhatiya-v-dns","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432\u043e FreeBSD, IPnet \u0438 Nucleus NET, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438 \u043f\u0440\u0438 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u0436\u0430\u0442\u0438\u044f \u0432 DNS | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0435 \u0433\u0440\u0443\u043f\u043f\u044b Forescout Research Labs \u0438 JSOF Research \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u0433\u043e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0439 \u0441\u0445\u0435\u043c\u044b \u0441\u0436\u0430\u0442\u0438\u044f, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0439 \u0434\u043b\u044f \u0443\u043f\u0430\u043a\u043e\u0432\u043a\u0438 \u043f\u043e\u0432\u0442\u043e\u0440\u044f\u044e\u0449\u0438\u0445\u0441\u044f \u0438\u043c\u0451\u043d \u0432.","og:url":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimosti-vo-freebsd-ipnet-i-nucleus-net-svyazannye-s-oshibkami-pri-realizaczii-szhatiya-v-dns","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-04-13T14:22:45+00:00","article:modified_time":"2021-04-13T14:22:45+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"99712","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-04-13 14:26:03","updated":"2026-02-08 20:56:09","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/99712","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=99712"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/99712\/revisions"}],"predecessor-version":[{"id":158099,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/99712\/revisions\/158099"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=99712"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=99712"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=99712"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}