{"id":74131,"date":"2020-03-14T14:42:14","date_gmt":"2020-03-14T11:42:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/obnovite-routeros-na-vashem-mikrotik"},"modified":"2020-03-14T14:42:14","modified_gmt":"2020-03-14T11:42:14","slug":"obnovite-routeros-na-vashem-mikrotik","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/obnovite-routeros-na-vashem-mikrotik","title":{"rendered":"Uuendage RouterOS oma MikroTik'is","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Uuendage
\n10. m\u00e4rtsil hakkas Mail.ru klienditeenindus saama kaebusi kasutajatelt, kes ei saanud Mail.ru IMAP\/SFTP serveritega oma e-posti programmide kaudu \u00fchendust. Osade \u00fchenduste puhul ei \u00f5nnestunud \u00fchenduda, samas kui teised andsid sertifikaadi vea. Viga tekkis seet\u00f5ttu, et \"server\" edastab isesignitud TLS-sertifikaadi.
\n<\/a><\/noindex>\u00a0
\n\"Uuendage
\nKaks p\u00e4eva jooksul tuli \u00fcle 10 kaebuse kasutajatelt erinevatelt v\u00f5rkudelt ja erinevatelt seadmetelt, mis j\u00e4ttis t\u00f5en\u00e4oliseks, et teema ei ole seotud \u00fchegi teenusepakkuja probleemiga. Probleemi t\u00e4iendav uurimine n\u00e4itas, et imap.mail.ru (ning ka teiste postiserverite ja teenuste) server oli DNS-i tasandil vale konfiguratsiooni t\u00f5ttu asendatud. Edasi, meie kasutajate aktiivse abi abil, leidsime, et p\u00f5hjuseks on vale salvestus nende ruuteri vahem\u00e4lus, mis on samas ka kohalik DNS resolvers, ning milleks paljudel (aga mitte k\u00f5igil) juhtudel osutus seade MikroTik, mis on v\u00e4ga populaarne v\u00e4ikestes ettev\u00f5tetes ja v\u00e4ikestes internetiteenuse pakkujates.<\/p>\n

Mis on probleem<\/h2>\n

\n2019. aasta septembris avastasid uurijad leidis <\/a><\/noindex>MikroTik RouterOS-is on mitu haavatavust (CVE-2019-3976, CVE-2019-3977, CVE-2019-3978, CVE-2019-3979), mis v\u00f5imaldasid DNS cache poisoning r\u00fcnnaku, st DNS-kirjete valeandmine ruuteri DNS-cache'is. Eriti CVE-2019-3978 annab r\u00fcndajale v\u00f5imaluse mitte oodata, kuni keegi sisemisest v\u00f5rgust saadab p\u00e4ringu oma DNS-serverile, et saastada resolvori cache, vaid algatada selline p\u00e4ring ise kaudu pordi 8291 (UDP ja TCP). MikroTik parandas haavatavuse RouterOS versioonides 6.45.7 (stable) ja 6.44.6 (long-term) 28. oktoobril 2019, kuid uuringute kohaselt suurem osa kasutajatest ei ole hetkel pat\u0161i installinud. <\/a><\/noindex>Ilmselgelt on see probleem praegu aktiivselt \u00e4ra kasutatud 'otse'.<\/p>\n

Mida see t\u00e4hendab<\/p>\n

Miks see on ohtlik<\/h2>\n

\nR\u00fcndaja v\u00f5ib muuta mis tahes hosti DNS-kirjet, kuhu sisev\u00f5rgu kasutaja p\u00f6\u00f6rdub, ja seel\u00e4bi suunata liiklust selle poole. Kui tundlikku teavet edastatakse kr\u00fcpteerimata (nt http:\/\/ ilma TLS-ita) v\u00f5i kui kasutaja n\u00f5ustub vale sertifikaadi aktsepteerimisega, v\u00f5ib r\u00fcndaja saada k\u00f5ik andmed, mis edastatakse \u00fchenduse kaudu, n\u00e4iteks sisselogimise v\u00f5i parooli. Kahjuks n\u00e4itab praktika, et kui kasutajal on v\u00f5imalus aktsepteerida vale sertifikaati, kasutab ta seda kindlasti.<\/p>\n

Miks just SMTP ja IMAP serverid ning mis p\u00e4\u00e4stis kasutajaid<\/h2>\n

\nMiks p\u00fc\u00fcdsid r\u00fcndajad tabada just SMTP\/IMAP-liiklust kirja\u00e4pidelt, mitte veebi liiklust, kuigi enamus kasutajatest p\u00e4\u00e4seb kirjadele ligi brauseris HTTPS kaudu?<\/p>\n

Kuid mitte k\u00f5ik SMTP ja IMAP\/POP3 toimivad postiprogrammid ei kaitse kasutajat vea eest, lubades tal saata sisselogimist ja parooli l\u00e4bi ebaturvalise v\u00f5i kompromiteeritud \u00fchenduse, ehkki standardi kohaselt RFC 8314<\/a><\/noindex>, mis 2018. aastal vastu v\u00f5etud (ja Mail.ru-s palju varem rakendatud), peaksid need kaitsma kasutajat parooli \u00e4rakasutamise eest igasuguste kaitsmata \u00fchenduste kaudu. Samuti, kuna postikliendid harva kasutavad OAuth protokolli (mida Mail.ru postiserverid toetavad), edastatakse sisselogimise ja parooli iga sessiooni jooksul.<\/p>\n

Brauserid v\u00f5ivad olla veidi paremini kaitstud Man-in-the-Middle r\u00fcnnakute eest. K\u00f5ikidel t\u00e4htsatel mail.ru domeenidel on HTTPS-i k\u00f5rval rakendatud HSTS poliitika (HTTP range transport security). Kui HSTS on aktiveeritud, ei luba moodne brauser kasutajal lihtsalt aktsepteerida vale sertifikaati, isegi kui kasutaja seda soovib. Peale HSTS on kasutajaid p\u00e4\u00e4stnud seegi, et alates 2017. aastast keelavad Mail.ru SMTP, IMAP ja POP3 serverid parooli edastamise kaitsmata \u00fchenduse kaudu; k\u00f5ik meie kasutajad on kasutanud TLS-i SMTP, POP3 ja IMAP kaudu liga, seega on sisselogimise ja parooli pealtkuulamine v\u00f5imalik ainult siis, kui kasutaja ise n\u00f5ustub v\u00f5ltsitud sertifikaadi aktsepteerimisega.<\/p>\n

Mobiilkasutajatele soovitame alati kasutada Mail.ru rakendusi meiliga liitumiseks, kuna nende kaudu on e-posti kasutamine turvalisem kui brauserites v\u00f5i sisseehitatud SMTP\/IMAP klientides.<\/p>\n

Mida on vaja teha<\/h2>\n

\nTuleb uuendada MikroTik RouterOS-i tarkvara turvalisse versiooni. Kui mingil p\u00f5hjusel pole see v\u00f5imalik, tuleb filtreerida liiklust pordi 8291 (tcp ja udp) j\u00e4rgi; see raskendab probleemi kaasnevat kasutamist, kuigi ei k\u00f5rvalda passiivse sissetungimise v\u00f5imalust DNS-i vahem\u00e4llu. Interneti-teenuse pakkujatel on soovitatav selle pordi filtreerimine oma v\u00f5rkudes, et kaitsta ettev\u00f5tte kasutajaid.\u00a0<\/p>\n

K\u00f5ik kasutajad, kes aktsepteerisid vale sertifikaati, peavad viivitamatult muutma oma e-posti ja teiste teenuste salas\u00f5nu, mille jaoks see sertifikaat aktsepteeriti. Me omalt poolt teavitame kasutajaid, kes siseneb e-posti kaudu haavatavate seadmete kaudu.<\/p>\n

P.S. On veel sellega seotud haavatavust, mis on kirjeldatud postituses LukaSafonov<\/a><\/noindex> "Backporti haavatavus RouterOS seab ohtu sadu tuhandeid seadmeid<\/a><\/noindex>\".
\n
Allikas: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412\u0435\u0447\u0435\u0440\u043e\u043c 10 \u043c\u0430\u0440\u0442\u0430 \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 Mail.ru \u043d\u0430\u0447\u0430\u043b\u0430 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u0436\u0430\u043b\u043e\u0431\u044b \u043e\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043d\u0430 \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a IMAP\/SMTP \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c Mail.ru \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0447\u0430\u0441\u0442\u044c \u043a\u043e\u043d\u043d\u0435\u043a\u0442\u043e\u0432 \u043d\u0435 \u043f\u0440\u043e\u0445\u043e\u0434\u0438\u043b\u0430, \u0430 \u0447\u0430\u0441\u0442\u044c \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u044e\u0442 \u043e\u0448\u0438\u0431\u043a\u0443 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430. \u041e\u0448\u0438\u0431\u043a\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u0442\u0435\u043c, \u0447\u0442\u043e \u00ab\u0441\u0435\u0440\u0432\u0435\u0440\u00bb \u043e\u0442\u0434\u0430\u0435\u0442 \u0441\u0430\u043c\u043e\u043f\u043e\u0434\u043f\u0438\u0441\u0430\u043d\u044b\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 TLS. \u00a0 \u0417\u0430 \u0434\u0432\u0430 \u0434\u043d\u044f \u043f\u0440\u0438\u0448\u043b\u043e \u0431\u043e\u043b\u0435\u0435 10 \u0436\u0430\u043b\u043e\u0431 \u043e\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0441\u0430\u043c\u044b\u0445 \u0440\u0430\u0437\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":74132,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-74131","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Uuendage RouterOS oma MikroTikil | ProHoster","description":"10. m\u00e4rtsil said Mail.ru klienditoe teenused kaebusi kasutajatelt, kes ei saanud \u00fchendust luua Mail.ru IMAP\/SMTP serveritega oma e-posti programmide kaudu. Samuti ilmnes, et osa \u00fchendustest ei toimi, samas kui osa n\u00e4itas sertifikaadi viga. Viga on p\u00f5hjustatud sellest, et \"server\" annab v\u00e4lja iseallkirjastatud TLS-sertifikaadi. Kahe p\u00e4eva jooksul saadi \u00fcle 10 kaebuse kasutajatelt v\u00e4ga erinevates v\u00f5rkudes.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/obnovite-routeros-na-vashem-mikrotik","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0431\u043d\u043e\u0432\u0438\u0442\u0435 RouterOS \u043d\u0430 \u0432\u0430\u0448\u0435\u043c MikroTik | ProHoster","og:description":"\u0412\u0435\u0447\u0435\u0440\u043e\u043c 10 \u043c\u0430\u0440\u0442\u0430 \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 Mail.ru \u043d\u0430\u0447\u0430\u043b\u0430 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u0436\u0430\u043b\u043e\u0431\u044b \u043e\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043d\u0430 \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a IMAP\/SMTP \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c Mail.ru \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0447\u0430\u0441\u0442\u044c \u043a\u043e\u043d\u043d\u0435\u043a\u0442\u043e\u0432 \u043d\u0435 \u043f\u0440\u043e\u0445\u043e\u0434\u0438\u043b\u0430, \u0430 \u0447\u0430\u0441\u0442\u044c \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u044e\u0442 \u043e\u0448\u0438\u0431\u043a\u0443 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430. \u041e\u0448\u0438\u0431\u043a\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u0442\u0435\u043c, \u0447\u0442\u043e \u00ab\u0441\u0435\u0440\u0432\u0435\u0440\u00bb \u043e\u0442\u0434\u0430\u0435\u0442 \u0441\u0430\u043c\u043e\u043f\u043e\u0434\u043f\u0438\u0441\u0430\u043d\u044b\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 TLS. \u0417\u0430 \u0434\u0432\u0430 \u0434\u043d\u044f \u043f\u0440\u0438\u0448\u043b\u043e \u0431\u043e\u043b\u0435\u0435 10 \u0436\u0430\u043b\u043e\u0431 \u043e\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0441\u0430\u043c\u044b\u0445 \u0440\u0430\u0437\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0439","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/obnovite-routeros-na-vashem-mikrotik","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-14T11:42:14+00:00","article:modified_time":"2020-03-14T11:42:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"74131","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:20:27","updated":"2022-09-30 20:30:09"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/74131","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=74131"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/74131\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/74132"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=74131"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=74131"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=74131"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}