{"id":73151,"date":"2020-03-07T14:42:03","date_gmt":"2020-03-07T11:42:03","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-pppd-i-lwip-pozvolyayushhaya-udalyonno-vypolnit-kod-s-pravami-root"},"modified":"2020-03-07T14:42:03","modified_gmt":"2020-03-07T11:42:03","slug":"uyazvimost-v-pppd-i-lwip-pozvolyayushhaya-udalyonno-vypolnit-kod-s-pravami-root","status":"publish","type":"post","link":"https:\/\/prohoster.info\/es\/blog\/news\/uyazvimost-v-pppd-i-lwip-pozvolyayushhaya-udalyonno-vypolnit-kod-s-pravami-root","title":{"rendered":"Una vulnerabilidad en pppd y lwIP permite la ejecuci\u00f3n remota de c\u00f3digo con privilegios de root","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

En el paquete pppd se ha detectado<\/a><\/noindex> vulnerabilidad<\/a><\/noindex> (CVE-2020-8597<\/a><\/noindex>), que permite ejecutar su propio c\u00f3digo mediante el env\u00edo de solicitudes de autenticaci\u00f3n especialmente formateadas a sistemas que utilizan el protocolo PPP (Protocolo Punto a Punto) o PPPoE (PPP sobre Ethernet). Estos protocolos son com\u00fanmente utilizados por los proveedores para establecer conexiones a trav\u00e9s de Ethernet o DSL, y tambi\u00e9n se utilizan en algunas VPN (por ejemplo, pptpd y openfortivpn<\/a><\/noindex>). Para verificar la vulnerabilidad de sus sistemas ante este problema preparado<\/a><\/noindex> prototipo de exploit.<\/p>\n

La vulnerabilidad es causada por un desbordamiento de b\u00fafer en la implementaci\u00f3n del protocolo de autenticaci\u00f3n EAP (Protocolo de Autenticaci\u00f3n Extensible). El ataque puede llevarse a cabo en la etapa previa a la autenticaci\u00f3n al enviar un paquete de tipo EAPT_MD5CHAP, que incluye un nombre de host muy largo que no cabe en el b\u00fafer asignado. Debido a un error en la verificaci\u00f3n del tama\u00f1o del campo rhostname, el atacante puede sobrescribir datos m\u00e1s all\u00e1 del b\u00fafer en la pila, logrando as\u00ed la ejecuci\u00f3n remota de su c\u00f3digo con privilegios de root. La vulnerabilidad se manifiesta tanto del lado del servidor como del cliente, es decir, no solo el servidor puede ser atacado, sino tambi\u00e9n el cliente que intenta conectarse a un servidor controlado por el atacante (por ejemplo, un atacante puede primero comprometer el servidor a trav\u00e9s de la vulnerabilidad y luego comenzar a afectar a los clientes que se conectan).<\/p>\n

El problema afecta a las versiones pppd<\/a><\/noindex> desde la 2.4.2 hasta la 2.4.8 inclusive y se ha corregido en forma de parche<\/a><\/noindex>. La vulnerabilidad tambi\u00e9n afecta<\/a><\/noindex> la pila lwIP<\/a><\/noindex>, pero en la configuraci\u00f3n predeterminada de lwIP el soporte para EAP no est\u00e1 habilitado.<\/p>\n

El estado de la resoluci\u00f3n del problema en las distribuciones se puede consultar en las siguientes p\u00e1ginas: Debian<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, RHEL<\/a><\/noindex>, Fedora<\/a><\/noindex>, SUSE<\/a><\/noindex>, OpenWRT<\/a><\/noindex>, Arch<\/a><\/noindex>, NetBSD<\/a><\/noindex>. En RHEL, OpenWRT y SUSE, el paquete pppd se compila con la protecci\u00f3n de \"Stack Smashing Protection\" (modo \"-fstack-protector\" en gcc), lo que limita la explotaci\u00f3n de fallos. Adem\u00e1s de las distribuciones, la vulnerabilidad tambi\u00e9n se ha confirmado en algunos productos. Cisco<\/a><\/noindex> (CallManager), TP-LINK<\/a><\/noindex> y Synology (DiskStation Manager, VisualStation VS960HD y Router Manager), que utilizan el c\u00f3digo pppd o lwIP.<\/p>\n

<\/a><\/noindex><\/p>\n

Fuente: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043f\u0430\u043a\u0435\u0442\u0435 pppd \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-8597), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0441\u0432\u043e\u0439 \u043a\u043e\u0434 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u043d\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u043a \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u043c \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b PPP (Point-to-Point Protocol) \u0438\u043b\u0438 PPPoE (PPP over Ethernet). \u0414\u0430\u043d\u043d\u044b\u0435 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u044b \u043e\u0431\u044b\u0447\u043d\u043e \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u044e\u0442\u0441\u044f \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u0430\u043c\u0438 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0447\u0435\u0440\u0435\u0437 Ethernet \u0438\u043b\u0438 DSL, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0432 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 VPN (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, pptpd \u0438 openfortivpn). \u0414\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u043d\u043e\u0441\u0442\u0438 \u0441\u0432\u043e\u0438\u0445 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-73151","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilidad en pppd y lwIP que permite la ejecuci\u00f3n remota de c\u00f3digo con privilegios de root | ProHoster","description":"Se ha detectado una vulnerabilidad en el paquete pppd.","canonical_url":"https:\/\/prohoster.info\/es\/blog\/news\/uyazvimost-v-pppd-i-lwip-pozvolyayushhaya-udalyonno-vypolnit-kod-s-pravami-root","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"es_ES","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 pppd \u0438 lwIP, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root | ProHoster","og:description":"\u0412 \u043f\u0430\u043a\u0435\u0442\u0435 pppd \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c.","og:url":"https:\/\/prohoster.info\/es\/blog\/news\/uyazvimost-v-pppd-i-lwip-pozvolyayushhaya-udalyonno-vypolnit-kod-s-pravami-root","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-07T11:42:03+00:00","article:modified_time":"2020-03-07T11:42:03+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"73151","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:38:40","updated":"2022-09-28 04:48:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts\/73151","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/comments?post=73151"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts\/73151\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/media?parent=73151"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/categories?post=73151"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/tags?post=73151"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}