{"id":98911,"date":"2021-01-21T14:42:14","date_gmt":"2021-01-21T12:42:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/dnspooq-sem-novyh-uyazvimostej-v-dnsmasq"},"modified":"2021-01-21T14:42:14","modified_gmt":"2021-01-21T12:42:14","slug":"dnspooq-sem-novyh-uyazvimostej-v-dnsmasq","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/dnspooq-sem-novyh-uyazvimostej-v-dnsmasq","title":{"rendered":"DNSpooq - seitse uut haavatavust dnsmasq'is","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

JSOF uurimisgrupi spetsialistid teatasid seitsmest uuest haavatavusest DNS\/DHCP serveris dnsmasq. Server dnsmasq on v\u00e4ga populaarne ja seda kasutatakse vaikimisi paljudes Linuxi distributsioonides ning ka Cisco, Ubiquiti ja muudes v\u00f5rguseadmetes. Dnspooq haavatavused h\u00f5lmavad DNS-i vahem\u00e4lu r\u00fcndamist ja ka kaugt\u00e4ide t\u00e4itmist. Haavatavused on parandatud dnsmasq 2.83 versioonis.<\/p>\n

2008. aastal avastas tuntud turvauuringute spetsialist Dan Kaminsky ja paljastas Interneti DNSi mehhanismi aluseks oleva p\u00f5hi puuduse. Kaminsky t\u00f5estas, et r\u00fcndajad saavad aadresse petta of domains<\/a> ja varastama tietoja. T\u00e4m\u00e4n j\u00e4lkeen se tuli tunnetuksi nimell\u00e4 «Kaminskin hy\u00f6kk\u00e4ys».<\/p>\n

DNS on olnud aastak\u00fcmneid ebaturvaline protokoll, kuigi arvatakse, et see tagab teatud taseme terviklikkust. Just seet\u00f5ttu toetuvad sellele endiselt nii palju. Samuti on v\u00e4lja t\u00f6\u00f6tatud meetmed DNS-protokolli turvalisuse parandamiseks. Nende meetmete hulka kuuluvad HTTPS, HSTS, DNSSEC ja muud algatused. Sellegipoolest on isegi k\u00f5igi nende mehhanismide juures DNS-i pealtkuulamine riskantne r\u00fcnnak 2021. aastal. Suur osa internetist toetub DNS-ile endiselt sama palju kui 2008. aastal ja on sarnaste r\u00fcnnakute suhtes haavatav.<\/p>\n

DNSpooq vahepealsed haavatavused:
\nCVE-2020-25686, CVE-2020-25684, CVE-2020-25685. Need haavatavused on sarnased SAD DNS r\u00fcnnakutega, millest on hiljuti teatanud California \u00dclikooli ja Tsinghua \u00dclikooli teadlased. SAD DNS ja DNSpooq haavatavused v\u00f5ivad samuti \u00fchineda, et r\u00fcnnakuid veelgi h\u00f5lbustada. Kaudselt m\u00f5juva r\u00fcnnaku kohta on samuti teatatud \u00fclikoolide \u00fchiste j\u00f5upingutustega (Poison Over Troubled Forwarders jt).
\nHaavatavustest t\u00f6\u00f6tab, v\u00e4hendades entropiat. N\u00f5rkade hash'ide kasutamine DNS-p\u00e4ringute identifitseerimiseks ja vastuste vale vastavus v\u00f5ivad entropiat oluliselt v\u00e4hendada, muutes vajalikuks vaid ~19 bitti \u00e4ra arvata, mis v\u00f5imaldab vahem\u00e4lu m\u00fcrgitamist. Viis, kuidas dnsmasq t\u00f6\u00f6tleb CNAME-kirjeid, v\u00f5imaldab CNAME-kirjeid valetada ja t\u00f5husalt m\u00fcrgitada kuni 9 DNS-kirjet korraga.<\/p>\n

Puhvri \u00fclevoolu haavatavused: CVE-2020-25687, CVE-2020-25683, CVE-2020-25682, CVE-2020-25681. K\u00f5ik neli esitatud haavatavust esinevad DNSSEC-i rakendava koodi korral ning avalduvad ainult DNSSEC-i kontrollimise s\u00e4tete aktiveerimisel.<\/p>\n

Allikas: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0421\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u0438\u0437 JSOF research labs \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0438 \u043e \u0441\u0435\u043c\u0438 \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 DNS\/DHCP \u0441\u0435\u0440\u0432\u0435\u0440\u0435 dnsmasq. \u0421\u0435\u0440\u0432\u0435\u0440 dnsmasq \u0432\u0435\u0441\u044c\u043c\u0430 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u0435\u043d \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0432\u043e \u043c\u043d\u043e\u0433\u0438\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 linux, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0432 \u0441\u0435\u0442\u0435\u0432\u043e\u043c \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u0438 Cisco, Ubiquiti \u0438 \u043f\u0440\u043e\u0447\u0438\u0445. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 Dnspooq \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0442 \u0432 \u0441\u0435\u0431\u044f \u043e\u0442\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 DNS-\u043a\u044d\u0448\u0430, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u044b \u0432 dnsmasq 2.83. \u0412 2008 \u0433\u043e\u0434\u0443 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-98911","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47DNSpooq \u2014 seitse uut haavatavust dnsmasq-s | ProHoster","description":"JSOF uurimislabori spetsialistid teatasid seitsmest uuest haavatavusest DNS\/DHCP serveris dnsmasq. Server dnsmasq on v\u00e4ga populaarne ning seda kasutatakse vaikimisi paljudes Linuxi jaotustes, samuti Cisco, Ubiquiti ja muude v\u00f5rguseadmete puhul. Dnspooq haavatavused h\u00f5lmavad DNS-vahem\u00e4lu m\u00fcrgitamist ja kaugekoodide t\u00e4itmist. Haavatavused on parandatud dnsmasq versioonis 2.83. Aastal 2008.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/dnspooq-sem-novyh-uyazvimostej-v-dnsmasq","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47DNSpooq \u2014 \u0441\u0435\u043c\u044c \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 dnsmasq | ProHoster","og:description":"\u0421\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u0438\u0437 JSOF research labs \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0438 \u043e \u0441\u0435\u043c\u0438 \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 DNS\/DHCP \u0441\u0435\u0440\u0432\u0435\u0440\u0435 dnsmasq. \u0421\u0435\u0440\u0432\u0435\u0440 dnsmasq \u0432\u0435\u0441\u044c\u043c\u0430 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u0435\u043d \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0432\u043e \u043c\u043d\u043e\u0433\u0438\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 linux, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0432 \u0441\u0435\u0442\u0435\u0432\u043e\u043c \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u0438 Cisco, Ubiquiti \u0438 \u043f\u0440\u043e\u0447\u0438\u0445. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 Dnspooq \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0442 \u0432 \u0441\u0435\u0431\u044f \u043e\u0442\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 DNS-\u043a\u044d\u0448\u0430, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u044b \u0432 dnsmasq 2.83. \u0412 2008 \u0433\u043e\u0434\u0443","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/dnspooq-sem-novyh-uyazvimostej-v-dnsmasq","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-01-21T12:42:14+00:00","article:modified_time":"2021-01-21T12:42:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"98911","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 09:57:26","updated":"2026-02-11 11:12:04"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/98911","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=98911"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/98911\/revisions"}],"predecessor-version":[{"id":160551,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/98911\/revisions\/160551"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=98911"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=98911"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=98911"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}