{"id":113594,"date":"2024-02-14T22:02:42","date_gmt":"2024-02-14T20:02:42","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-keytrap-i-nsec3-zatragivayushhie-bolshinstvo-realizaczij-dnssec"},"modified":"2024-02-14T22:02:42","modified_gmt":"2024-02-14T20:02:42","slug":"uyazvimosti-keytrap-i-nsec3-zatragivayushhie-bolshinstvo-realizaczij-dnssec","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-keytrap-i-nsec3-zatragivayushhie-bolshinstvo-realizaczij-dnssec","title":{"rendered":"KeyTrap ja NSEC3 haavatavused, mis m\u00f5jutavad enamikku DNSSEC-i rakendustest","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>DNSSEC-protokolli erinevates rakendustes on tuvastatud kaks haavatavust, mis m\u00f5jutavad BIND, PowerDNS, dnsmasq, Knot Resolver ja Unbound DNS-resolvoreid. Need haavatavused v\u00f5ivad p\u00f5hjustada teenuse keeldu DNS-resolvoreides, mis teevad validatsiooni DNSSEC-i abil, kuna need tekitavad k\u00f5rget CPU-koormust, mis takistab muude p\u00e4ringute t\u00f6\u00f6tlemist. R\u00fcnnaku teostamiseks on piisav saata DNS-resolverile, mis kasutab DNSSEC-i, p\u00e4ring, mille tulemusel p\u00f6\u00f6rdutakse r\u00fcndaja hallatavasse DNS-ala.      <\/p>\n<p>Tuvastatud probleemid:  <\/p>\n<ul>\n<li class=\"l\"> CVE-2023-50387 (koodnimi KeyTrap) \u2014 p\u00f6\u00f6rdumine spetsiaalselt vormistatud DNS-\u00fchtede poole p\u00f5hjustab teenuse katkestamist, kuna see genereerib m\u00e4rkimisv\u00e4\u00e4rset koormust CPU-le ja pikendab DNSSEC-i kontrollimise t\u00e4itmise aega. R\u00fcnnaku teostamiseks on vajalik, et r\u00fcndaja kontrolli all olev DNS-server sisaldaks domeenitsooni, millel on pahatahtlikud seadistused, samuti tuleb saavutada, et rekursiivne DNS-server p\u00f6\u00f6rduks selle domeeni poole, mille teenuse katkestamise saavutab r\u00fcndaja.\n<p>Pahatahtlikud seadistused seisnevad konfliktsete v\u00f5tmete, RRSET-i ja digiallkirjade kombinatsiooni kasutamises alal. Kontrollimise katse nende v\u00f5tmete abil viib pikaajaliste ressursimahukate toiminguteni, mis v\u00f5ivad t\u00e4ielikult koormata CPU-d ja takistada muude p\u00e4ringute t\u00f6\u00f6tlemist (n\u00e4iteks v\u00e4idetakse, et BIND-ile korraldatud r\u00fcnnaku jooksul suudeti peatada teiste p\u00e4ringute t\u00f6\u00f6tlemine 16 tunniks).      <\/p>\n<li class=\"l\"> CVE-2023-50868 (koodnimi NSEC3) \u2014 teenuse katkestamine seet\u00f5ttu, et NSEC3 (Next Secure v3) salvestuste hashide arvutamine n\u00f5uab m\u00e4rkimisv\u00e4\u00e4rseid arvutusi spetsiaalselt vormistatud DNSSEC vastuste t\u00f6\u00f6tlemisel. R\u00fcnnaku meetod sarnaneb esimese haavatavuse omaga, erinedes sellest, et r\u00fcndaja DNS-serveris luuakse spetsiaalselt vormistatud NSEC3 RRSET-i salvestuste kogum.      <\/ul>\n<p>T m\u00e4rgiti, et eespool kirjeldatud haavatavuste ilmnemine on p\u00f5hjustatud DNSSEC-i spetsiifikas m\u00e4\u00e4ratud v\u00f5imalusest, et DNS-server saadab k\u00f5ik saadaval olevad kr\u00fcptograafilised v\u00f5tmed, samas kui resolverid peavad t\u00f6\u00f6tlema k\u00f5ik saadud v\u00f5tmed, kuni kontrollimine ei \u00f5nnestu v\u00f5i k\u00f5iki saadud v\u00f5tmeid ei ole kontrollitud.    <\/p>\n<p>V\u00f5rreldes haavatavuste blokeerimise meetmetega on DNSSEC-i usaldusketi koostamiseks kaasatud piiratud hulk v\u00f5tmeid ning NSEC3 jaoks on piiratud ka hash-kalkulatsioonide maksimaalne arv, samuti on iga RRSETi (v\u00f5tmete ja allkirjade kombinatsioonid) ja iga vastuse kontrollimiskordade kogus piiratud. <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/et\/server\/dts-los-angeles\/\"   title=\"serverilt\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"3614\">serverilt<\/a>.     <\/p>\n<p>Haavatavused on k\u00f5rvaldatud Unbound'i (1.19.1), PowerDNS Recursor'i (4.8.6, 4.9.3, 5.0.2), Knot Resolver'i (5.7.1), dnsmasq'i (2.90) ja BIND'i (9.16.48, 9.18.24 ja 9.19.21) v\u00e4rskendustes. Haavatavuste k\u00f5rvaldamise staatust erinevates distributsioonides saab hinnata sellistel lehtedel: Debian, Ubuntu, SUSE, RHEL, Fedora, Arch Linux, Gentoo, Slackware, NetBSD, FreeBSD.            <\/p>\n<p>DNS-serveri BIND versioonides 9.16.48, 9.18.24 ja 9.19.21 on t\u00e4iendavalt k\u00f5rvaldatud veel mitmed haavatavused:  <\/p>\n<ul>\n<li class=\"l\"> CVE-2023-4408 \u2014 suurte DNS-s\u00f5numite anal\u00fc\u00fcs v\u00f5ib p\u00f5hjustada k\u00f5rge koormuse teket CPU-le.\n<li class=\"l\"> CVE-2023-5517 \u2014 spetsiaalselt vormistatud tagasiv\u00f5tu tsooni p\u00e4ring v\u00f5ib viia kokkuvarisemiseni, kuna toimub assert-kontrolli aktiveerimine. Probleem ilmneb ainult konfiguratsioonides, kus on lubatud seade \u201enxdomain-redirect\u201c.\n<li class=\"l\"> CVE-2023-5679 \u2014 rekursiivne hosti m\u00e4\u00e4ramine v\u00f5ib viia kokkuvarisemiseni, kuna s\u00fcsteemid, kus on lubatud DNS64 tugi ja \u201eserve-stale\u201c (seaded stale-cache-enable ja stale-answer-enable), aktiveerivad assert-kontrolli.\n<li class=\"l\"> CVE-2023-6516 \u2014 spetsiaalselt vormistatud rekursiivsed p\u00e4ringud v\u00f5ivad viia protsessi m\u00e4lus olevate ressursside ammendumiseni.    <\/ul>\n<p>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=60599\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 DNSSEC \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0435 DNS-\u0440\u0435\u0437\u043e\u043b\u0432\u0435\u0440\u044b BIND, PowerDNS, dnsmasq, Knot Resolver \u0438 Unbound. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043e\u0442\u043a\u0430\u0437\u0430 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438 DNS-\u0440\u0435\u0437\u043e\u043b\u0432\u0435\u0440\u043e\u0432, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u044e\u0449\u0438\u0445 \u0432\u0430\u043b\u0438\u0434\u0430\u0446\u0438\u044e \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 DNSSEC, \u0438\u0437-\u0437\u0430 \u0432\u043e\u0437\u043d\u0438\u043a\u043d\u043e\u0432\u0435\u043d\u0438\u044f \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043d\u0430 CPU, \u043c\u0435\u0448\u0430\u044e\u0449\u0435\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0434\u0440\u0443\u0433\u0438\u0445 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432. \u0414\u043b\u044f \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u043d\u0430 DNS-\u0440\u0435\u0437\u043e\u043b\u0432\u0435\u0440, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0439 DNSSEC, \u0437\u0430\u043f\u0440\u043e\u0441, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0438\u0439 \u043a \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044e \u043a \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0439 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-113594","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 DNSSEC \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0435 DNS-\u0440\u0435\u0437\u043e\u043b\u0432\u0435\u0440\u044b BIND, PowerDNS, dnsmasq, Knot Resolver \u0438 Unbound.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-keytrap-i-nsec3-zatragivayushhie-bolshinstvo-realizaczij-dnssec\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 KeyTrap \u0438 NSEC3, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0435 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0439 DNSSEC | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 DNSSEC \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0435 DNS-\u0440\u0435\u0437\u043e\u043b\u0432\u0435\u0440\u044b BIND, PowerDNS, dnsmasq, Knot Resolver \u0438 Unbound.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-keytrap-i-nsec3-zatragivayushhie-bolshinstvo-realizaczij-dnssec\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2024-02-14T20:02:42+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2024-02-14T20:02:42+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Haavatavused KeyTrap ja NSEC3, mis m\u00f5jutavad enamiku DNSSEC rakendusi | ProHoster","description":"DNSSEC protokolli erinevates rakendustes on tuvastatud kaks haavatavust, mis m\u00f5jutavad BIND'i, PowerDNS'i, dnsmasq'i, Knot Resolver'i ja Unbound'i DNS-resolvrid.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-keytrap-i-nsec3-zatragivayushhie-bolshinstvo-realizaczij-dnssec","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 KeyTrap \u0438 NSEC3, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0435 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0439 DNSSEC | ProHoster","og:description":"\u0412 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 DNSSEC \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0435 DNS-\u0440\u0435\u0437\u043e\u043b\u0432\u0435\u0440\u044b BIND, PowerDNS, dnsmasq, Knot Resolver \u0438 Unbound.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-keytrap-i-nsec3-zatragivayushhie-bolshinstvo-realizaczij-dnssec","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-02-14T20:02:42+00:00","article:modified_time":"2024-02-14T20:02:42+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"113594","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-22 15:29:23","updated":"2026-02-22 15:29:23","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/113594","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=113594"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/113594\/revisions"}],"predecessor-version":[{"id":162142,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/113594\/revisions\/162142"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=113594"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=113594"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=113594"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}