{"id":114452,"date":"2024-03-20T12:25:49","date_gmt":"2024-03-20T10:25:49","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-na-nekotorye-protokoly-na-osnove-udp-privodyashhaya-k-zacziklivaniyu-obmena-paketami"},"modified":"2024-03-20T12:25:49","modified_gmt":"2024-03-20T10:25:49","slug":"ataka-na-nekotorye-protokoly-na-osnove-udp-privodyashhaya-k-zacziklivaniyu-obmena-paketami","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/ataka-na-nekotorye-protokoly-na-osnove-udp-privodyashhaya-k-zacziklivaniyu-obmena-paketami","title":{"rendered":"R\u00fcnnak m\u00f5nede UDP-p\u00f5histe protokollide vastu, mis p\u00f5hjustab pakettide ringluse.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Koordineerimiskeskus CERT (arvutiteadete erakorralise reageerimise grupp) avaldas hoiatuse mitmete haavatavuste kohta erinevate rakendusprotokollide rakendustes, mis kasutavad transportprotokollina UDP-d. Haavatavusi saab kasutada teenuse keelamisr\u00fcnnakute korraldamiseks, kuna esineb v\u00f5imalus pakettide vahetuse ts\u00fckliliseks muutmiseks kahe hosti vahel. N\u00e4iteks saavad r\u00fcndajad saavutada v\u00f5rgu kergenduse kurnamise, blokeerida v\u00f5rgu teenuste t\u00f6\u00f6 (nt genereerimise kaudu suurt koormust ja \u00fcletada p\u00e4ringute intensiivsuse piirm\u00e4\u00e4ra) ning rakendada liiklusv\u00f5imendi DDoS-r\u00fcnnakute jaoks. <\/p>\n

Esitatavatest protokollidest, mille rakendused on haavatavad, mainitakse DNS-i, NTP-d, TFTP-d, Echo (RFC862), Chargen (RFC864) ja QOTD (RFC865). Haavatavuse olemasolu (CVE-2024-2169) on kinnitatud mitme ettev\u00f5tte toodetes, sealhulgas Cisco, Microsoft, Broadcom, Brother, Honeywell (CVE-2024-1309) ja MikroTik. Kaitsmeedetena haavatavuste blokeerimiseks soovitatakse lubada tulem\u00fc\u00fcris petmiseluku (uRPF), piirata juurdep\u00e4\u00e4su liigsetele UDP-teenustele ja seadistada liikluspiiranguid (rate-limit ja QoS). <\/p>\n

Haavat tulenevad UDP protokolli kaitsetuse t\u00f5ttu aadresside valeandmise vastu \u2014 kui vahepealsed ruuterid ei kaitse valeandmise eest, saab r\u00fcndaja UDP-paketti panna suvalise serveri IP-aadressi ja saata selle paketi teisele serverile, mis saadab vastuse antud valeaadressile. R\u00fcnnaku meetod seisneb olukorra loomises, kus pakettide vahetamine serverite vahel, mis kasutavad haavatavaid protokolle, satub l\u00f5putusse ts\u00fcklisse. N\u00e4iteks v\u00f5ib sihtserver vastata saabunud paketile vea koodiga, ja server, mille aadressi r\u00fcndaja kasutas, saadab samuti vastuse, mis viib omakorda vale vastuse saamiseni. Nii serverid<\/a> algab l\u00f5putu 'ping-pong' m\u00e4ng pakettidega.

\"R\u00fcnnak<\/center> <\/p>\n

M\u00e4rkimisv\u00e4\u00e4rne on, et selline r\u00fcnnakumeetod ei ole uus ja serveris<\/a> NTP-\u0441\u00f5ltuvuse s\u00f5nninguga seotud r\u00fcnnak on k\u00f5rvaldatud juba 2009. aastal (CVE-2009-3563) versioonides 4.2.4p8 ja 4.2.5. R\u00fcnnak seisnes NTP-paketi saatmises valeaadressilt koos seadmisega lipuga MODE_PRIVATE, mille t\u00f6\u00f6tlemisel tagastas sihtserver vastuse, et privaatre\u017eiimi ei saa kasutada, j\u00e4tkates vastuses lippu MODE_PRIVATE. Vastavalt ei suutnud ka teine server seda lippu t\u00f6\u00f6delda ja saatis oma vastuse, mis viis kahe NTP-serveri vahetusse pakettide ringlusse. DNS-protokolli osas on teave sellise r\u00fcnnaku v\u00f5imalikkuse kohta avaldatud juba 1996. aastal. <\/p>\n

Globaalne IP-aadresside skaneerimine on n\u00e4idanud, et praegu on v\u00f5rgu kaudu v\u00e4hemalt 23 000 haavatavat TFTP-serverit, 63 000 DNS-serverit, 89 000 NTP-serverit, 56 000 Echo\/RFC862 teenust, 22 000 Chargen\/RFC864 teenust ja 21 000 QOTD\/RFC865 teenust. Eeldatakse, et NTP-serverite puhul on probleemi p\u00f5hjuseks k\u00f5rgete vanade versioonide ntpd kasutamine, mis on v\u00e4lja antud enne 2010. aastat. Echo, Chargen ja QOTD teenused on algselt haavatavad oma arhitektuuri t\u00f5ttu. TFTP ja DNS-serverite olukord n\u00f5uab sekkumist nende administraatorite poolt. Serverid atftpd ja tftpd ei ole probleemi haavatavad, kuna need kasutavad vastuse saatmisel juhuslikku algset v\u00f5rguporti. Haavatavatest DNS-serveritest mainitakse dproxy-nexgeni. Microsofti toodetes ilmneb probleem WDS (Windows Deployment Services), samas kui Cisco toodetes esinev probleem puudutab 2800 ja 2970 seeria ruutereid.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043e\u0440\u0434\u0438\u043d\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0439 \u0446\u0435\u043d\u0442\u0440 CERT (\u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0430 \u0440\u0435\u0430\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430 \u0447\u0440\u0435\u0437\u0432\u044b\u0447\u0430\u0439\u043d\u044b\u0435 \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u0438), \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0435 \u043e \u0441\u0435\u0440\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u044b\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u043e\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0442\u0440\u0430\u043d\u0441\u043f\u043e\u0440\u0442\u0430 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b UDP. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0433\u0443\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043e\u0442\u043a\u0430\u0437\u0430 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438 \u0438\u0437-\u0437\u0430 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0437\u0430\u0446\u0438\u043a\u043b\u0438\u0432\u0430\u043d\u0438\u044f \u043e\u0431\u043c\u0435\u043d\u0430 \u043f\u0430\u043a\u0435\u0442\u0430\u043c\u0438 \u043c\u0435\u0436\u0434\u0443 \u0434\u0432\u0443\u043c\u044f \u0445\u043e\u0441\u0442\u0430\u043c\u0438. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u043c\u043e\u0433\u0443\u0442 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0439 \u043f\u0440\u043e\u043f\u0443\u0441\u043a\u043d\u043e\u0439 \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0441\u0435\u0442\u0438, \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":114453,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-114452","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47UDP-p\u00f5histe protokollide r\u00fcnnak, mis p\u00f5hjustab pakettide ringlusse | ProHoster","description":"CERT (arvutite h\u00e4daolukorra reageerimise grupp) on avaldanud hoiatuse erinevate rakendusprotokollide rakenduste seeria haavatavuste osas, mis kasutavad transportimiseks.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/ataka-na-nekotorye-protokoly-na-osnove-udp-privodyashhaya-k-zacziklivaniyu-obmena-paketami","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 \u043d\u0430 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u044b \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 UDP, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0437\u0430\u0446\u0438\u043a\u043b\u0438\u0432\u0430\u043d\u0438\u044e \u043e\u0431\u043c\u0435\u043d\u0430 \u043f\u0430\u043a\u0435\u0442\u0430\u043c\u0438 | ProHoster","og:description":"\u041a\u043e\u043e\u0440\u0434\u0438\u043d\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0439 \u0446\u0435\u043d\u0442\u0440 CERT (\u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0430 \u0440\u0435\u0430\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430 \u0447\u0440\u0435\u0437\u0432\u044b\u0447\u0430\u0439\u043d\u044b\u0435 \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u0438), \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0435 \u043e \u0441\u0435\u0440\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u044b\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u043e\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0442\u0440\u0430\u043d\u0441\u043f\u043e\u0440\u0442\u0430.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/ataka-na-nekotorye-protokoly-na-osnove-udp-privodyashhaya-k-zacziklivaniyu-obmena-paketami","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-03-20T10:25:49+00:00","article:modified_time":"2024-03-20T10:25:49+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"114452","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-09 16:53:32","updated":"2026-02-09 21:37:58","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/114452","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=114452"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/114452\/revisions"}],"predecessor-version":[{"id":159859,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/114452\/revisions\/159859"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/114453"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=114452"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=114452"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=114452"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}