{"id":104866,"date":"2022-08-17T09:36:49","date_gmt":"2022-08-17T07:36:49","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-ustrojstvah-na-baze-soc-realtek-pozvolyayushhaya-vypolnit-kod-cherez-otpravku-udp-paketa"},"modified":"2022-08-17T09:36:49","modified_gmt":"2022-08-17T07:36:49","slug":"uyazvimost-v-ustrojstvah-na-baze-soc-realtek-pozvolyayushhaya-vypolnit-kod-cherez-otpravku-udp-paketa","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/uyazvimost-v-ustrojstvah-na-baze-soc-realtek-pozvolyayushhaya-vypolnit-kod-cherez-otpravku-udp-paketa","title":{"rendered":"Vuln\u00e9rabilit\u00e9 dans les appareils bas\u00e9s sur SoC Realtek, permettant l'ex\u00e9cution de code via l'envoi d'un paquet UDP.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Des chercheurs de Faraday Security ont pr\u00e9sent\u00e9 lors de la conf\u00e9rence DEFCON les d\u00e9tails d'une exploitation d'une vuln\u00e9rabilit\u00e9 critique (CVE-2022-27255) dans le SDK des puces Realtek RTL819x, permettant d'ex\u00e9cuter du code sur un appareil via l'envoi d'un paquet UDP sp\u00e9cialement con\u00e7u. La vuln\u00e9rabilit\u00e9 est remarquable car elle permet d'attaquer des appareils o\u00f9 l'acc\u00e8s au web-interface pour les r\u00e9seaux externes est d\u00e9sactiv\u00e9 : il suffit d'envoyer un seul paquet UDP.    <\/p>\n<p>La vuln\u00e9rabilit\u00e9 concerne les appareils utilisant des versions vuln\u00e9rables du SDK Realtek, y compris eCos RSDK 1.5.7p1 et MSDK 4.9.4p1. Des mises \u00e0 jour du SDK eCos corrigeant la vuln\u00e9rabilit\u00e9 ont \u00e9t\u00e9 publi\u00e9es par Realtek le 25 mars. Il n'est pas encore clair quels appareils sont affect\u00e9s : le SoC Realtek RTL819x est utilis\u00e9 dans des routeurs, points d'acc\u00e8s, amplificateurs Wi-Fi, cam\u00e9ras IP, appareils IoT et autres \u00e9quipements r\u00e9seaux de plus de 60 fabricants, y compris Asus, A-Link, Beeline, Belkin, Buffalo, D-Link, Edison, Huawei, LG, Logitec, MT-Link, Netgear, Smartlink, UPVEL, ZTE et Zyxel.     <\/p>\n<p>Des exemples d'exploits pour obtenir un acc\u00e8s \u00e0 distance \u00e0 l'appareil et ex\u00e9cuter ses propres commandes, bas\u00e9s sur une attaque contre le routeur Nexxt Nebula 300 Plus, ont d\u00e9j\u00e0 \u00e9t\u00e9 publi\u00e9s en acc\u00e8s libre. Des utilitaires pour analyser les firmwares \u00e0 la recherche de vuln\u00e9rabilit\u00e9s ont \u00e9galement \u00e9t\u00e9 publi\u00e9s.     <\/p>\n<p>\u00c9tant donn\u00e9 les probl\u00e8mes de pr\u00e9paration et de livraison ainsi que les mises \u00e0 jour des firmwares pour les dispositifs d\u00e9j\u00e0 sortis, on s'attend \u00e0 voir d'ici peu des attaques automatis\u00e9es et des vers infectant des appareils r\u00e9seau vuln\u00e9rables. Apr\u00e8s une attaque r\u00e9ussie, les appareils compromis pourraient \u00eatre utilis\u00e9s par des attaquants, par exemple pour former des botnets, implanter des portes d\u00e9rob\u00e9es permettant de laisser une faille dans le r\u00e9seau interne de l'entreprise, intercepter le trafic en transit ou le rediriger vers un h\u00f4te externe.    <\/p>\n<p>La vuln\u00e9rabilit\u00e9 est caus\u00e9e par un d\u00e9bordement de tampon dans le module \u00ab SIP ALG \u00bb (SIP Application Layer Gateway), utilis\u00e9 pour la gestion des paquets SIP \u00e0 travers un traducteur d'adresses. Le probl\u00e8me survient en raison de l'absence de v\u00e9rification de la taille r\u00e9elle des donn\u00e9es re\u00e7ues, ce qui entra\u00eene l'\u00e9criture dans la m\u00e9moire au-del\u00e0 du tampon fixe lors de l'appel de la fonction strcpy pendant le traitement des paquets SIP. L'attaque peut \u00eatre r\u00e9alis\u00e9e en envoyant un paquet UDP avec des valeurs incorrectes dans les champs de donn\u00e9es SDP ou dans l'en-t\u00eate du protocole SIP. Pour l'exploitation, il suffit d'envoyer un seul paquet \u00e0 un port UDP arbitraire de l'interface WAN.      <center>  <video controls=\"\" style=\"width: 700px; height: 400px; max-width:100%\"><source src=\"https:\/\/github.com\/infobyte\/cve-2022-27255\/raw\/main\/DEFCON\/poc.mp4\" type=\"video\/mp4\"><\/video>  <\/center>    <\/p>\n<p>Pour contourner la protection, il est recommand\u00e9 de bloquer au niveau du pare-feu ou du syst\u00e8me de pr\u00e9vention des intrusions les paquets UDP contenant le message SIP \u00ab INVITE \u00bb, la ligne \u00ab m=audio \u00bb et d'une taille sup\u00e9rieure \u00e0 128 octets. Exemple de r\u00e8gle pour d\u00e9tecter des tentatives d'exploitation dans l'IDS Snort 3 : alert udp any any -&gt; any any (sid:1000000; msg:\u00ab Exploitation du trafic SIP du SDK Realtek eCOS CVE-2022-27255 \u00bb; content: \u00ab invite \u00bb; depth: 6; nocase; content: \u00ab m=audio \u00bb; isdataat: 128,relative; content:!\u00ab |0d| \u00bb; within: 128;)<br \/>\n<br \/>Source : <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=57645\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Faraday Security \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0438 \u043d\u0430 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 DEFCON \u0434\u0435\u0442\u0430\u043b\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2022-27255) \u0432 SDK \u0434\u043b\u044f \u0447\u0438\u043f\u043e\u0432 Realtek RTL819x, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0441\u0432\u043e\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e UDP-\u043f\u0430\u043a\u0435\u0442\u0430. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u0430 \u0442\u0435\u043c, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u0442\u044c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043e\u0442\u043a\u043b\u044e\u0447\u0451\u043d \u0434\u043e\u0441\u0442\u0443\u043f \u0432 web-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 \u0434\u043b\u044f \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0441\u0435\u0442\u0435\u0439 &#8212; \u0434\u043b\u044f \u0430\u0442\u0430\u043a\u0438 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043f\u0440\u043e\u0441\u0442\u043e \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u043e\u0434\u0438\u043d UDP-\u043f\u0430\u043a\u0435\u0442. [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-104866","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Faraday Security \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0438 \u043d\u0430 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 DEFCON \u0434\u0435\u0442\u0430\u043b\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2022-27255) \u0432 SDK \u0434\u043b\u044f \u0447\u0438\u043f\u043e\u0432 Realtek RTL819x, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0441\u0432\u043e\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/fr\/blog\/news\/uyazvimost-v-ustrojstvah-na-baze-soc-realtek-pozvolyayushhaya-vypolnit-kod-cherez-otpravku-udp-paketa\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"fr_FR\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 \u043d\u0430 \u0431\u0430\u0437\u0435 SoC Realtek, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 UDP-\u043f\u0430\u043a\u0435\u0442\u0430 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Faraday Security \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0438 \u043d\u0430 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 DEFCON \u0434\u0435\u0442\u0430\u043b\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2022-27255) \u0432 SDK \u0434\u043b\u044f \u0447\u0438\u043f\u043e\u0432 Realtek RTL819x, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0441\u0432\u043e\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/fr\/blog\/news\/uyazvimost-v-ustrojstvah-na-baze-soc-realtek-pozvolyayushhaya-vypolnit-kod-cherez-otpravku-udp-paketa\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2022-08-17T07:36:49+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2022-08-17T07:36:49+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vuln\u00e9rabilit\u00e9 dans les appareils bas\u00e9s sur SoC Realtek, permettant d'ex\u00e9cuter du code via l'envoi d'un paquet UDP | ProHoster","description":"Des chercheurs de l'entreprise Faraday Security ont pr\u00e9sent\u00e9 lors de la conf\u00e9rence DEFCON les d\u00e9tails de l'exploitation d'une vuln\u00e9rabilit\u00e9 critique (CVE-2022-27255) dans le SDK pour les puces Realtek RTL819x, permettant d'ex\u00e9cuter leur code sur l'appareil.","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/uyazvimost-v-ustrojstvah-na-baze-soc-realtek-pozvolyayushhaya-vypolnit-kod-cherez-otpravku-udp-paketa","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 \u043d\u0430 \u0431\u0430\u0437\u0435 SoC Realtek, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 UDP-\u043f\u0430\u043a\u0435\u0442\u0430 | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Faraday Security \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0438 \u043d\u0430 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 DEFCON \u0434\u0435\u0442\u0430\u043b\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2022-27255) \u0432 SDK \u0434\u043b\u044f \u0447\u0438\u043f\u043e\u0432 Realtek RTL819x, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0441\u0432\u043e\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435.","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/uyazvimost-v-ustrojstvah-na-baze-soc-realtek-pozvolyayushhaya-vypolnit-kod-cherez-otpravku-udp-paketa","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-08-17T07:36:49+00:00","article:modified_time":"2022-08-17T07:36:49+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"104866","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-08-17 07:37:54","updated":"2022-09-28 09:36:11","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/104866","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=104866"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/104866\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=104866"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=104866"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=104866"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}