California University Riverside'i teadlaste r\u00fchm avaldas uue SAD DNS r\u00fcnnaku variandi (CVE-2021-20322), mis t\u00f6\u00f6tab vaatamata eelmisel aastal lisatud kaitsele, mis pidi blokeerima haavatavuse CVE-2020-25705. Uus meetod on oma olemuselt sarnane eelmisel aastal avastatud haavatavusele ja erineb ainult selle poolest, et kasutatakse teistsuguseid ICMP-pakette aktiivsete UDP-portide kontrollimiseks. Pakutud r\u00fcnnak v\u00f5imaldab sisestada valeandmeid DNS-serveri vahem\u00e4lesse, mida saab kasutada juhusliku domeeni IP-aadressi asendamiseks vahem\u00e4les ja suunamiseks domeeni p\u00e4ringud r\u00fcndaja serverisse. <\/p>\n
Pakutud meetod on toimiv ainult Linuxi v\u00f5rgustikustiku t\u00f5ttu, sest see s\u00f5ltub Linuxi ICMP-pakettide t\u00f6\u00f6tlemise mehhanismi omadustest, mis on andmelekkimise allikaks, mis lihtsustab UDP-pordi numbri m\u00e4\u00e4ramist, mida on kasutatud serverilt<\/a> v\u00e4lise p\u00e4ringu saatmiseks. Tehingud, mis blokeerivad teabe leket, v\u00f5eti Linuxi kernelisse vastu augusti l\u00f5pus (parandus lisati kernelisse 5.15 ja septembri LTS-kernelite uuendustesse). Parandus seisneb selles, et v\u00f5rgu vahem\u00e4ludes hakatakse kasutama SipHash h\u00e4singu algoritmi Jenkins Hashi asemel. Haavatavuse k\u00f5rvaldamise staatust jaotustes saab hinnata nende lehtede kaudu: Debian, RHEL, Fedora, SUSE, Ubuntu. <\/p>\n R\u00fcnnaku avastavate teadlaste andmetel on haavatav umbes 38% v\u00f5rkus olevatest avatud resolvijatest, sealhulgas populaarsetest DNS-teenustest nagu OpenDNS ja Quad9 (9.9.9.9). Mis puudutab serveri tarkvara, siis r\u00fcnnakut saab teostada Linuxi serveris selliste paketiga nagu BIND, Unbound ja dnsmasq. Windowsi ja BSD-s\u00fcsteemide kasutamisel t\u00f6\u00f6tavad DNS-serverid selle probleemiga ei ole kokku puutunud. R\u00fcnnaku edukaks sooritamiseks on vajalik IP-spoofing, s.o r\u00fcndaja teenusepakkuja ei tohi blokeerida valeallika IP-aadressiga pakette. <\/p>\n Tuletame meelde, et SAD DNS r\u00fcnnak v\u00f5imaldab \u00fcletada kaitset, mis on lisatud DNS-serveritesse klassikalise DNS-i vahem\u00e4lu m\u00fcrgitamise meetodi blokeerimiseks, mille pakkus v\u00e4lja Dan Kaminsky 2008. aastal. Kaminsky meetod manipuleerib DNS-p\u00e4ringu identifikaatori v\u00e4ga v\u00e4ikese v\u00e4lja suurusega, mis on vaid 16 bitti. Korraliku DNS-tehingu identifikaatori leidmiseks, mis on vajalik hostinime valeandmete edastamiseks, piisab umbes 7000 p\u00e4ringu saatmisest ja umbes 140 000 valevastuse simuleerimisest. R\u00fcnnak seisneb suure hulga pakettide saatmises DNS-resolvendile vale IP-aadressiga ja erinevate DNS-tehingu identifikaatoritega. Esmase vastuse vahem\u00e4llu salvestamise v\u00e4ltimiseks sisaldab iga valevastus veidi muudetud domeeninime (1.example.com, 2.example.com, 3.example.com jne). <\/p>\n Selle r\u00fcnnaku t\u00fc\u00fcbi vastu on DNS-serverite tootjad rakendanud juhuslikku l\u00e4hteportide numbrite jaotust, kust saadetakse resolvendi p\u00e4ringud, mis kompenseerib identifikaatori liiga v\u00e4ikest suurust. P\u00e4rast kaitse rakendamist on valevastuse saatmiseks lisaks 16-bitise identifikaatori leidmisele olnud vajalik leida ka \u00fcks 64 000 porti, mis suurendab katsete arvu kuni 2^32. <\/p>\n SAD DNS meetod v\u00f5imaldab drastiliselt lihtsustada v\u00f5rguporti numbri m\u00e4\u00e4ramist ja viib r\u00fcnnaku tagasi klassikalise Kaminsky meetodi juurde. R\u00fcndaja saab tuvastada ligip\u00e4\u00e4su kasutamata ja aktiivsetele UDP-portidele, kasutades teavet v\u00f5rguportide tegevuse lekke kohta ICMP-pakettide vastuste t\u00f6\u00f6tlemisel. Meetod v\u00f5imaldab v\u00e4hendada proovide arvu 4 korda \u2014 2^16 + 2^16 asemel 2^32 (131_072 asemel 4_294_967_296). Lekke teave, mis v\u00f5imaldab kiiresti m\u00e4\u00e4rata aktiivsed UDP-portid, on tingitud puudusest ICMP-pakettide t\u00f6\u00f6tlemise koodis fragmentide p\u00e4ringute (ICMP Fragmentation Needed lipp) v\u00f5i edasisaatmise (ICMP Redirect lipp) osas. Selliste paketide saatmine muudab v\u00f5rgu pinu vahem\u00e4lu olekut, v\u00f5imaldades serveri reaktsiooni p\u00f5hjal kindlaks teha, milline UDP-port on aktiivne ja milline mitte. <\/p>\n R\u00fcnnakuskeem: Kui DNS-resolver \u00fcritab m\u00e4\u00e4rata domeeninime, saadab ta UDP-p\u00e4ringu DNS-teenindavale domeeniserverile. Sel hetkel, kui resolver ootab vastust, saab r\u00fcndaja kiiresti kindlaks teha algse portaandi ja saata sellele vale vastuse, esitades end DNS-teenindava domeeniserverina, kasutades petmist. IP-aadressid<\/a>DNS-resolver salvestab vale vastuse kaudu edastatud andmed vahem\u00e4llu ja m\u00f5nda aega tagastab k\u00f5ikidele muudele DNS-p\u00e4ringutele sama domeeninimega r\u00fcndaja m\u00e4\u00e4ratud IP-aadressi. \u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u041a\u0430\u043b\u0438\u0444\u043e\u0440\u043d\u0438\u0439\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0432 \u0420\u0438\u0432\u0435\u0440\u0441\u0430\u0439\u0434\u0435 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u043d\u043e\u0432\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0430\u0442\u0430\u043a\u0438 SAD DNS (CVE-2021-20322), \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0439 \u043d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0437\u0430\u0449\u0438\u0442\u0443, \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u043d\u0443\u044e \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u0433\u043e\u0434\u0443 \u0434\u043b\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2020-25705. \u041d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0432 \u0446\u0435\u043b\u043e\u043c \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u0435\u043d \u043f\u0440\u043e\u0448\u043b\u043e\u0433\u043e\u0434\u043d\u0435\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438 \u043e\u0442\u043b\u0438\u0447\u0430\u0435\u0442\u0441\u044f \u043b\u0438\u0448\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0434\u0440\u0443\u0433\u043e\u0433\u043e \u0442\u0438\u043f\u0430 ICMP-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0445 UDP-\u043f\u043e\u0440\u0442\u043e\u0432. \u041f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u043d\u0430\u044f \u0430\u0442\u0430\u043a\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0442\u044c \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u0444\u0438\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u043a\u044d\u0448 DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u0430, \u0447\u0442\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102308","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Uus variand SAD DNS r\u00fcnnakust valeandmete sisestamiseks DNS vahem\u00e4lus | ProHoster","description":"California \u00dclikooli Riverside'i teadlaste grupp avaldas uue variandi SAD DNS r\u00fcnnakust (CVE-2021-20322), mis t\u00f6\u00f6tab hoolimata eelmisel aastal rakendatud kaitsemeetmetest, mis olid m\u00f5eldud haavatavuse blokeerimiseks.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/novyj-variant-ataki-sad-dns-dlya-podstanovki-fiktivnyh-dannyh-v-kesh-dns","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041d\u043e\u0432\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0430\u0442\u0430\u043a\u0438 SAD DNS \u0434\u043b\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0444\u0438\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u043a\u044d\u0448 DNS | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u041a\u0430\u043b\u0438\u0444\u043e\u0440\u043d\u0438\u0439\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0432 \u0420\u0438\u0432\u0435\u0440\u0441\u0430\u0439\u0434\u0435 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u043d\u043e\u0432\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0430\u0442\u0430\u043a\u0438 SAD DNS (CVE-2021-20322), \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0439 \u043d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0437\u0430\u0449\u0438\u0442\u0443, \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u043d\u0443\u044e \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u0433\u043e\u0434\u0443 \u0434\u043b\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/novyj-variant-ataki-sad-dns-dlya-podstanovki-fiktivnyh-dannyh-v-kesh-dns","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-11-17T19:36:54+00:00","article:modified_time":"2021-11-17T19:36:54+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102308","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-11-17 19:38:17","updated":"2026-02-09 21:46:42","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/102308","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=102308"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/102308\/revisions"}],"predecessor-version":[{"id":160307,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/102308\/revisions\/160307"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=102308"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=102308"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=102308"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"