{"id":98911,"date":"2021-01-21T14:42:14","date_gmt":"2021-01-21T12:42:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/dnspooq-sem-novyh-uyazvimostej-v-dnsmasq"},"modified":"2021-01-21T14:42:14","modified_gmt":"2021-01-21T12:42:14","slug":"dnspooq-sem-novyh-uyazvimostej-v-dnsmasq","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/dnspooq-sem-novyh-uyazvimostej-v-dnsmasq","title":{"rendered":"DNSpooq \u2013 seitse uut haavatavust dnsmasq-s.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

JSOF teadusuuringute laborid teatasid seitsmest uuest haavatavusest DNS\/DHCP serveris dnsmasq. Server dnsmasq on v\u00e4ga populaarne ja seda kasutatakse vaikimisi paljudes Linuxi distributsioonides, samuti v\u00f5rguvarustuses, nagu Cisco, Ubiquiti ja teised. Haavatavused Dnspooq h\u00f5lmavad DNS-i vahem\u00e4lu saastamist ning kaugkoodi t\u00e4itmist. Haavatavused on parandatud dnsmasq 2.83-s.<\/p>\n

2008. aastal avastas tuntud turva-uuringute ekspert Dan Kaminsky fundamentaalse puuduse DNS-i mehhanismis internetis. Kaminsky t\u00f5estas, et kurjategijad saavad adresse muuta domeenide<\/a> \u0438 \u043a\u0440\u0430\u0441\u0442\u044c \u0434\u0430\u043d\u043d\u044b\u0435. \u0421 \u0442\u0435\u0445 \u043f\u043e\u0440 \u044d\u0442\u043e \u0441\u0442\u0430\u043b\u043e \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e \u043a\u0430\u043a «\u0410\u0442\u0430\u043a\u0430 \u041a\u0430\u043c\u0438\u043d\u0441\u043a\u043e\u0433\u043e».<\/p>\n

DNS on juba aastak\u00fcmneid peetud ebaturvaliseks protokolliks, kuigi eeldatakse, et see tagab teatava taseme terviklikkuse. Just sellep\u00e4rast toetutakse sellele endiselt v\u00e4ga tugevalt. Samal ajal on v\u00e4lja t\u00f6\u00f6tatud mehhanismid DNS-i p\u00f5h protokolli turvalisuse suurendamiseks. Nende mehhanismide hulka kuuluvad HTTPS, HSTS, DNSSEC ja muud algatused. Siiski on isegi k\u00f5igi nende mehhanismide olemasolul DNS-i vahelej\u00e4tmine endiselt ohtlik r\u00fcnnak 2021. aastal. Suur osa internetist toetub DNS-ile sama palju nagu 2008. aastal ning on sama t\u00fc\u00fcpi r\u00fcnnakutele alti.<\/p>\n

DNSpooq vahem\u00e4lu saastamise haavatavused:
\nCVE-2020-25686, CVE-2020-25684, CVE-2020-25685. Need haavatavused on sarnased hiljuti Californias asuvate \u00fclikoolide ja Tsinghua \u00fclikooli teadlaste teatatud SAD DNS r\u00fcnnakutega. SAD DNS ja DNSpooq haavatavusi saab samuti \u00fchendada, et suurendada r\u00fcnnakute t\u00f5husust. \u00dchiste j\u00f5upingutustega \u00fclikoolide poolt on teatatud ka teistest r\u00fcnnakutest, millel on ebaselged tagaj\u00e4rjed (Poison Over Troubled Forwarders jne).
\nHaavatavused toimivad entropia v\u00e4hendamise kaudu. N\u00f5rga r\u00e4si kasutamine DNS-i p\u00e4ringute tuvastamiseks ja vastuste eb t\u00e4pne vastavus v\u00f5imaldab oluliselt v\u00e4hendada entropiat ning tuleb \u00e4ra arvata vaid ~19 bitti, mis teeb vahem\u00e4lu saastamise v\u00f5imaliku. See, kuidas dnsmasq k\u00e4sitleb CNAME-kandeid, v\u00f5imaldab CNAME-kantide ahelate vale kuvamise, saastades t\u00f5husalt kuni 9 DNS-i kande korraga.<\/p>\n

Puhveri \u00fclevoolu haavatavused: CVE-2020-25687, CVE-2020-25683, CVE-2020-25682, CVE-2020-25681. K\u00f5ik neli m\u00e4rgistatud haavatavust on olemas DNSSEC-i rakenduskoodis ja ilmnevad ainult DNSSEC-i kontrollimise seadistamisel.<\/p>\n

Allikas: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0421\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u0438\u0437 JSOF research labs \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0438 \u043e \u0441\u0435\u043c\u0438 \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 DNS\/DHCP \u0441\u0435\u0440\u0432\u0435\u0440\u0435 dnsmasq. \u0421\u0435\u0440\u0432\u0435\u0440 dnsmasq \u0432\u0435\u0441\u044c\u043c\u0430 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u0435\u043d \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0432\u043e \u043c\u043d\u043e\u0433\u0438\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 linux, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0432 \u0441\u0435\u0442\u0435\u0432\u043e\u043c \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u0438 Cisco, Ubiquiti \u0438 \u043f\u0440\u043e\u0447\u0438\u0445. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 Dnspooq \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0442 \u0432 \u0441\u0435\u0431\u044f \u043e\u0442\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 DNS-\u043a\u044d\u0448\u0430, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u044b \u0432 dnsmasq 2.83. \u0412 2008 \u0433\u043e\u0434\u0443 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-98911","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47DNSpooq \u2014 seitse uut haavatavust dnsmasq'is | ProHoster","description":"JSOF uurimislaborite spetsialistid teatasid seitsmest uuest haavatavusest DNS\/DHCP serveris dnsmasq.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/dnspooq-sem-novyh-uyazvimostej-v-dnsmasq","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47DNSpooq \u2014 \u0441\u0435\u043c\u044c \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 dnsmasq | ProHoster","og:description":"\u0421\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u0438\u0437 JSOF research labs \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0438 \u043e \u0441\u0435\u043c\u0438 \u043d\u043e\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0432 DNS\/DHCP \u0441\u0435\u0440\u0432\u0435\u0440\u0435 dnsmasq.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/dnspooq-sem-novyh-uyazvimostej-v-dnsmasq","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-01-21T12:42:14+00:00","article:modified_time":"2021-01-21T12:42:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"98911","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 09:57:26","updated":"2026-02-11 11:12:04","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/98911","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=98911"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/98911\/revisions"}],"predecessor-version":[{"id":160551,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/98911\/revisions\/160551"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=98911"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=98911"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=98911"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}