{"id":107077,"date":"2023-03-03T12:48:24","date_gmt":"2023-03-03T10:48:24","guid":{"rendered":"https:\/\/prohoster.info\/?p=107077"},"modified":"2023-03-05T11:49:19","modified_gmt":"2023-03-05T09:49:19","slug":"uyazvimost-v-strongswan-ipsec-dopuskayushhaya-udalyonnoe-vypolnenie-koda","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-strongswan-ipsec-dopuskayushhaya-udalyonnoe-vypolnenie-koda","title":{"rendered":"Uuendus, mis on seotud strongSwan IPsec'iga, v\u00f5imaldab kaugt\u00e4idetud koodi","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

On r\u00f5hukohane strongSwan 5.9.10, avatud pakett IPSec-protokolli p\u00f5hjal VPN-\u00fchenduste loomiseks, mis on kasutusel Linuxis, Androidis, FreeBSD-s ja macOS-is. Uues versioonis on k\u00f5rvaldatud ohtlik haavatavus (CVE-2023-26463), mida saab kasutada autentimise v\u00e4ltimiseks, kuid see v\u00f5ib potentsiaalselt viia ka r\u00fcndaja koodi t\u00e4itmiseni serveri v\u00f5i kliendipoolsel poolel. Probleem esineb spetsiaalselt vormindatud sertifikaatide kontrollimisel EAP (Extensible Authentication Protocol) autentimismeetodites, mis p\u00f5hinevad TLS-il. <\/p>\n

Haavatavus tuleneb sellest, et TLS-i t\u00f6\u00f6tleja aktsepteerib valesti avatud v\u00f5tmed naaber\u00f5lile (peer) sertifikaadist, pidades neid usaldusv\u00e4\u00e4rseks, isegi kui sertifikaati ei saa edukalt verifitseerida. Eriti, kui kutsuda v\u00e4lja funktsiooni tls_find_public_key(), usaldusv\u00e4\u00e4rsete sertifikaatide m\u00e4\u00e4ramiseks kasutatakse valikut avatud v\u00f5tme t\u00fc\u00fcbi p\u00f5hjal. Probleem seisneb selles, et muutuja, mida kasutatakse v\u00f5tme t\u00fc\u00fcbi m\u00e4\u00e4ratlemiseks otsingutegevuseks, seadistatakse igal juhul, isegi kui sertifikaat ei ole usaldusv\u00e4\u00e4rne. <\/p>\n

Veelgi enam, v\u00f5tme manipuleerimise kaudu on v\u00f5imalik saavutada viidete loendi arvu v\u00e4hendamine (kui sertifikaat ei ole usaldusv\u00e4\u00e4rne, vabastatakse objekti viide p\u00e4rast v\u00f5tme t\u00fc\u00fcbi m\u00e4\u00e4ratlemist) ja m\u00e4luruumi vabastamine veel kasutatava v\u00f5tmega objekti jaoks. Kirjeldatud puudus ei v\u00e4lista eksploiteerimise loomist teabe lekke korraldamiseks m\u00e4lust ja oma koodi t\u00e4itmiseks. <\/p>\n

R\u00fcnnak server<\/a> toimub, kui klient saadab enesekeelelise sertifikaadi kliendi autentimiseks, kasutades EAP-TLS, EAP-TTLS, EAP-PEAP ja EAP-TNC meetodeid. R\u00fcnnakut kliendi vastu saab teostada, tagastades serverilt<\/a> spetsiaalselt vormindatud sertifikaadi. Haavatavus ilmneb versioonides strongSwan 5.9.8 ja 5.9.9. Pakettide versioonide avaldamist jaotustes saab j\u00e4lgida lehtedel: Debian, Ubuntu, Gentoo, RHEL, SUSE, Arch, FreeBSD, NetBSD.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0414\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u0432\u044b\u043f\u0443\u0441\u043a strongSwan 5.9.10, \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0430\u043a\u0435\u0442\u0430 \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f VPN-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439 \u043d\u0430 \u0431\u0430\u0437\u0435 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 IPSec, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0433\u043e \u0432 Linux, Android, FreeBSD \u0438 macOS. \u0412 \u043d\u043e\u0432\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u043e\u043f\u0430\u0441\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2023-26463), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u043d\u043e \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0442\u0430\u043a\u0436\u0435 \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u0433\u043e \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0438\u043b\u0438 \u043a\u043b\u0438\u0435\u043d\u0442\u0430. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u0440\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-107077","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Haavatavus strongSwan IPsec, mis v\u00f5imaldab kaugelt koodi t\u00e4itmist | ProHoster","description":"On r\u00f5hukohane strongSwan 5.9.10, avatud pakett IPSec-protokolli p\u00f5hjal VPN-\u00fchenduste loomiseks, mis on kasutusel Linuxis, Androidis, FreeBSD-s ja macOS-is.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-strongswan-ipsec-dopuskayushhaya-udalyonnoe-vypolnenie-koda","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 strongSwan IPsec, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0430\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 | ProHoster","og:description":"\u0414\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u0432\u044b\u043f\u0443\u0441\u043a strongSwan 5.9.10, \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0430\u043a\u0435\u0442\u0430 \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f VPN-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439 \u043d\u0430 \u0431\u0430\u0437\u0435 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 IPSec, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0433\u043e \u0432 Linux, Android, FreeBSD \u0438 macOS.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-strongswan-ipsec-dopuskayushhaya-udalyonnoe-vypolnenie-koda","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-03-03T10:48:24+00:00","article:modified_time":"2023-03-05T09:49:19+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"107077","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-09 21:46:34","updated":"2026-02-09 21:46:34","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/107077","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=107077"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/107077\/revisions"}],"predecessor-version":[{"id":172813,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/107077\/revisions\/172813"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=107077"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=107077"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=107077"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}