{"id":74131,"date":"2020-03-14T14:42:14","date_gmt":"2020-03-14T11:42:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/obnovite-routeros-na-vashem-mikrotik"},"modified":"2020-03-14T14:42:14","modified_gmt":"2020-03-14T11:42:14","slug":"obnovite-routeros-na-vashem-mikrotik","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/obnovite-routeros-na-vashem-mikrotik","title":{"rendered":"Uuendage RouterOS oma MikroTik-is","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Uuendage
\n10. m\u00e4rtsil hakkas Mail.ru tugiteenistus saama kaebusi, et kasutajad ei p\u00e4\u00e4se Mail.ru IMAP\/SMTP serveritesse oma e-posti programmide kaudu. Samal ajal ei l\u00e4binud osa \u00fchendustest, samas kui teised n\u00e4itasid sertifikaadi viga. Viga tekkis seet\u00f5ttu, et \"server\" v\u00e4ljastas isesertifitseeritud TLS-sertifikaadi.
\n<\/a><\/noindex>\u00a0
\n\"Uuendage
\nKaks p\u00e4eva hiljem sai rohkem kui 10 kaebust erinevatelt kasutajatelt erinevatest v\u00f5rkudest ja erinevatelt seadmetelt, mis v\u00e4listas \u00fche teenusepakkuja v\u00f5rguprobleemide t\u00f5en\u00e4osuse. Probleemi p\u00f5hjalikum anal\u00fc\u00fcs n\u00e4itas, et imap.mail.ru (nagu ka teiste e-posti serverite ja teenuste) server on DNS tasandil asendatud. Edasistes uuringutes, kus meie kasutajad aktiivselt aitasid, avastasime, et probleem seisneb vale salvestuses nende ruuteri vahemikus, mis on samal ajal kohaliku DNS-resolverina, ja millest paljudes (aga mitte k\u00f5igis) juhtudel on MikroTiki seade, mis on v\u00e4ga populaarne v\u00e4ikestes ettev\u00f5tetes ja v\u00e4ikestes Interneti-teenusepakkujates.<\/p>\n

Mis on probleem<\/h2>\n

\n2019. aasta septembris avastasid teadlased avastasime <\/a><\/noindex>mitmeid haavatavusi MikroTik RouterOS-is (CVE-2019-3976, CVE-2019-3977, CVE-2019-3978, CVE-2019-3979), mis v\u00f5imaldasid DNS cache poisoning r\u00fcnnakut, st DNS-kirjete asendamist ruuteri DNS-vahemikus, ja CVE-2019-3978 v\u00f5imaldab r\u00fcndajal mitte oodata, kuni keegi sisemistest v\u00f5rgust p\u00f6\u00f6rdub selle DNS-serveri poole, et m\u00fcrgitada resolveri vahemikku, vaid algatada sellise p\u00e4ringu ise porti 8291 (UDP ja TCP) kaudu. MikroTik parandas haavatavuse versioonides RouterOS 6.45.7 (stabiilne) ja 6.44.6 (pikaajaline) 28. oktoobril 2019, kuid vastavalt uuringutele <\/a><\/noindex>enamik kasutajatest ei ole praeguseks uuendusi paigaldanud.<\/p>\n

On ilmne, et hetkel seda probleemi kasutatakse aktiivselt \"reaalses elus\".<\/p>\n

Miks see on ohtlik<\/h2>\n

\nR\u00fcndaja v\u00f5ib asendada DNS-kirje mistahes hostile, mille poole p\u00f6\u00f6rdub kasutaja sisemises v\u00f5rgus, nii et ta p\u00fc\u00fcab selle poole liiklust. Kui tundlik teave edastatakse kr\u00fcptimata (n\u00e4iteks http:\/\/ ilma TLS-ita) v\u00f5i kasutaja n\u00f5ustub vale sertifikaadi vastuv\u00f5tmisega, v\u00f5ib r\u00fcndaja saada k\u00f5ik andmed, mis saadetakse \u00fchenduse kaudu, n\u00e4iteks kasutajanime v\u00f5i parooli. Kahjuks n\u00e4itab praktika, et kui kasutajal on v\u00f5imalus vale sertifikaadiga n\u00f5ustuda, siis ta seda ka teeb.<\/p>\n

Miks just SMTP ja IMAP serverid ning mis p\u00e4\u00e4stis kasutajad<\/h2>\n

\nMiks r\u00fcndajad \u00fcritasid just SMTP\/IMAP liiklust e-posti rakendustes t\u00f6\u00f6delda, mitte sihtida veebiliiklust, kuigi suurem osa kasutajatest p\u00e4\u00e4seb e-kirjadele juurde brauseri kaudu HTTPS-i abil?<\/p>\n

Kaupade ja teenuste tarnijad, mis kasutavad SMTP ja IMAP\/POP3, ei kaitse alati kasutajat vigade eest, lubades tal saata oma sisselogimisandmed ebaturvalise v\u00f5i kompromiteeritud \u00fchenduse kaudu, hoolimata standardist RFC 8314<\/a><\/noindex>, mis v\u00f5eti vastu juba 2018. aastal (ja realiseeriti Mail.ru-s palju varem), peaks need kasutajad kaitsma mis tahes kaitsmata \u00fchenduse kaudu paroolide r\u00f6\u00f6vimise eest. Lisaks sellele kasutatakse e-posti klientides praegu v\u00e4ga harva protokolli OAuth (seda toetavad Mail.ru e-posti serverid), ja ilma selleta edastatakse sisselogimisandmed igas seansis.<\/p>\n

Sirvijad v\u00f5ivad olla veidi paremini kaitstud Man-in-the-Middle r\u00fcnnakute eest. K\u00f5ikidel olulistel domeenidel, sealhulgas mail.ru, on lisaks HTTPS-ile rakendatud HSTS (HTTP range transport security) poliitika. Kui HSTS on sisse l\u00fclitatud, ei luba kaasaegne sirvija kasutajal lihtsalt vastu v\u00f5tta vale sertifikaati, isegi kui kasutaja seda soovib. HSTS-i k\u00f5rval on kasutajaid kaitsnud ka see, et alates 2017. aastast keelavad Mail.ru SMTP, IMAP ja POP3 serverid parooli edastamise ebaturvalise \u00fchenduse kaudu; k\u00f5ik meie kasutajad kasutasid TLS-i SMTP, POP3 ja IMAP-iga juurde p\u00e4\u00e4semiseks, seet\u00f5ttu saab sisselogimisandmed r\u00f6\u00f6vida ainult siis, kui kasutaja n\u00f5ustub vale sertifikaadi aktsepteerimisega.<\/p>\n

Mobiilikasutajatele soovitame alati kasutada Mail.ru rakendusi, et p\u00e4\u00e4seda e-kirjale juurde, kuna nende kaudu on e-kirjade haldamine turvalisem kui sirvijates v\u00f5i sisseehitatud SMTP\/IMAP klientides.<\/p>\n

Mida on vaja teha<\/h2>\n

\nMikroTik RouterOS-i tarkvara tuleb uuendada turvalisse versiooni. Kui mingil p\u00f5hjusel ei ole see v\u00f5imalik, tuleb filtreerida liiklus sadamal 8291 (tcp ja udp), see muudab probleemi haldamise keerulisemaks, kuigi see ei likvideeri v\u00f5imalust passiivseks s\u00fcstimiseks DNS-i vahem\u00e4lu. Internetiteenuse pakkujatel on soovitatav seda sadamat oma v\u00f5rgus filtreerida, et kaitsta \u00e4rikasutajaid.\u00a0<\/p>\n

Kasutajad, kes on aktsepteerinud vale sertifikaati, peaksid koheselt vahetama oma e-posti ja teiste teenuste parooli, mille puhul see sertifikaat kasutusele v\u00f5eti. Me omalt poolt teavitame neid kasutajaid, kes p\u00e4\u00e4sevad e-kirjadele juurde haavatavates seadmetes.<\/p>\n

P.S. On veel seotud haavatavus, mis on toodud postituses. LukaSafonov<\/a><\/noindex> \"RouterOSi backport-haavatus seab ohvriks sadu tuhandeid seadmeid<\/a><\/noindex>".
\n
Allikas: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412\u0435\u0447\u0435\u0440\u043e\u043c 10 \u043c\u0430\u0440\u0442\u0430 \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 Mail.ru \u043d\u0430\u0447\u0430\u043b\u0430 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u0436\u0430\u043b\u043e\u0431\u044b \u043e\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043d\u0430 \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a IMAP\/SMTP \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c Mail.ru \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0447\u0430\u0441\u0442\u044c \u043a\u043e\u043d\u043d\u0435\u043a\u0442\u043e\u0432 \u043d\u0435 \u043f\u0440\u043e\u0445\u043e\u0434\u0438\u043b\u0430, \u0430 \u0447\u0430\u0441\u0442\u044c \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u044e\u0442 \u043e\u0448\u0438\u0431\u043a\u0443 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430. \u041e\u0448\u0438\u0431\u043a\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u0442\u0435\u043c, \u0447\u0442\u043e \u00ab\u0441\u0435\u0440\u0432\u0435\u0440\u00bb \u043e\u0442\u0434\u0430\u0435\u0442 \u0441\u0430\u043c\u043e\u043f\u043e\u0434\u043f\u0438\u0441\u0430\u043d\u044b\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 TLS. \u00a0 \u0417\u0430 \u0434\u0432\u0430 \u0434\u043d\u044f \u043f\u0440\u0438\u0448\u043b\u043e \u0431\u043e\u043b\u0435\u0435 10 \u0436\u0430\u043b\u043e\u0431 \u043e\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0441\u0430\u043c\u044b\u0445 \u0440\u0430\u0437\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":74132,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-74131","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Uuendage RouterOS oma MikroTikil | ProHoster","description":"10. m\u00e4rtsi \u00f5htul alustas Mail.ru tugiteenus.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/obnovite-routeros-na-vashem-mikrotik","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0431\u043d\u043e\u0432\u0438\u0442\u0435 RouterOS \u043d\u0430 \u0432\u0430\u0448\u0435\u043c MikroTik | ProHoster","og:description":"\u0412\u0435\u0447\u0435\u0440\u043e\u043c 10 \u043c\u0430\u0440\u0442\u0430 \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 Mail.ru \u043d\u0430\u0447\u0430\u043b\u0430.","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/obnovite-routeros-na-vashem-mikrotik","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-14T11:42:14+00:00","article:modified_time":"2020-03-14T11:42:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"74131","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:20:27","updated":"2022-09-30 20:30:09","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/74131","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=74131"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/74131\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/74132"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=74131"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=74131"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=74131"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}