{"id":78381,"date":"2020-04-19T07:42:02","date_gmt":"2020-04-19T05:42:02","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/obnovlenie-dns-servera-bind-9-11-18-9-16-2-i-9-17-1"},"modified":"2020-04-19T07:42:02","modified_gmt":"2020-04-19T05:42:02","slug":"obnovlenie-dns-servera-bind-9-11-18-9-16-2-i-9-17-1","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/obnovlenie-dns-servera-bind-9-11-18-9-16-2-i-9-17-1","title":{"rendered":"Mise \u00e0 jour du serveur DNS BIND 9.11.18, 9.16.2 et 9.17.1","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Publi\u00e9<\/a><\/noindex> Mises \u00e0 jour correctives des versions stables du serveur DNS BIND 9.11.18 et 9.16.2, ainsi que de la version exp\u00e9rimentale en d\u00e9veloppement 9.17.1. Les nouvelles versions a \u00e9t\u00e9 corrig\u00e9e<\/a><\/noindex> Probl\u00e8me de s\u00e9curit\u00e9 li\u00e9 \u00e0 l'inefficacit\u00e9 de la protection contre les attaques \u00abDNS rebinding<\/a><\/noindex>\u00bb lors du fonctionnement en mode de redirection de requ\u00eates sur le serveur DNS (section \u00ab forwarders \u00bb dans les param\u00e8tres). De plus, des efforts ont \u00e9t\u00e9 r\u00e9alis\u00e9s pour r\u00e9duire la taille de la statistique des signatures num\u00e9riques stock\u00e9es en m\u00e9moire pour DNSSEC \u2014 le nombre de cl\u00e9s suivies a \u00e9t\u00e9 r\u00e9duit \u00e0 4 par zone, ce qui est suffisant dans 99 % des cas.<\/p>\n

La technique \u00ab DNS rebinding \u00bb permet, lors de l'ouverture par un utilisateur d'une certaine page dans le navigateur, d'\u00e9tablir une connexion WebSocket avec un service r\u00e9seau dans le r\u00e9seau interne, inaccessible par un acc\u00e8s direct via Internet. Pour contourner la protection mise en place par les navigateurs contre les demandes hors du domaine actuel (cross-origin), un changement de nom d'h\u00f4te dans le DNS est utilis\u00e9. Le serveur DNS de l'attaquant est configur\u00e9 pour renvoyer alternativement deux adresses IP : la premi\u00e8re requ\u00eate renvoie l'adresse IP r\u00e9elle du serveur avec la page, et les requ\u00eates suivantes renvoient l'adresse interne du dispositif (par exemple, 192.168.10.1).<\/p>\n

Le temps de vie (TTL) pour la premi\u00e8re r\u00e9ponse est d\u00e9fini \u00e0 la valeur minimale, donc lorsque la page est ouverte, le navigateur d\u00e9termine l'adresse IP r\u00e9elle du serveur de l'attaquant et charge le contenu de la page. Un code JavaScript est lanc\u00e9 sur la page, qui attend l'expiration du TTL et envoie une deuxi\u00e8me demande, qui d\u00e9termine maintenant l'h\u00f4te comme 192.168.10.1. Cela permet d'acc\u00e9der au service \u00e0 l'int\u00e9rieur du r\u00e9seau local depuis JavaScript, contournant la restriction cross-origin. Protection<\/a><\/noindex> contre de telles attaques dans BIND repose sur le blocage du retour par des serveurs externes des adresses IP du r\u00e9seau interne actuel ou des alias CNAME pour des domaines locaux via les param\u00e8tres deny-answer-addresses et deny-answer-aliases.<\/p>\n

<\/a><\/noindex><\/p>\n

Source : opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u044b\u0445 \u0432\u0435\u0442\u043e\u043a DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 BIND 9.11.18 \u0438 9.16.2, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043d\u0430\u0445\u043e\u0434\u044f\u0449\u0435\u0439\u0441\u044f \u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 9.17.1. \u0412 \u043d\u043e\u0432\u044b\u0445 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043d\u0435\u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c\u044e \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u0430\u0442\u0430\u043a «DNS rebinding» \u043f\u0440\u0438 \u0440\u0430\u0431\u043e\u0442\u0435 \u0432 \u0440\u0435\u0436\u0438\u043c\u0435 \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u0437\u0430\u043f\u0440\u043e\u0441\u044b DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 (\u0431\u043b\u043e\u043a «forwarders» \u0432 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430\u0445). \u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0430 \u0440\u0430\u0431\u043e\u0442\u0430 \u043f\u043e \u0441\u043e\u043a\u0440\u0430\u0449\u0435\u043d\u0438\u044e \u0440\u0430\u0437\u043c\u0435\u0440\u0430 \u0445\u0440\u0430\u043d\u044f\u0449\u0435\u0439\u0441\u044f \u0432 \u043f\u0430\u043c\u044f\u0442\u0438 \u0441\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0438 \u0446\u0438\u0444\u0440\u043e\u0432\u044b\u0445 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-78381","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Mise \u00e0 jour du serveur DNS BIND 9.11.18, 9.16.2 et 9.17.1 | ProHoster","description":"Des mises \u00e0 jour correctives pour les versions stables du serveur DNS BIND 9.11.18 et 9.16.2 ont \u00e9t\u00e9 publi\u00e9es.","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/obnovlenie-dns-servera-bind-9-11-18-9-16-2-i-9-17-1","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 BIND 9.11.18, 9.16.2 \u0438 9.17.1 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u044b\u0445 \u0432\u0435\u0442\u043e\u043a DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 BIND 9.11.18 \u0438 9.16.2, \u0430.","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/obnovlenie-dns-servera-bind-9-11-18-9-16-2-i-9-17-1","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-04-19T05:42:02+00:00","article:modified_time":"2020-04-19T05:42:02+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"78381","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 16:59:34","updated":"2022-10-05 22:31:18","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/78381","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=78381"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/78381\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=78381"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=78381"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=78381"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}