{"id":94510,"date":"2020-09-18T01:41:56","date_gmt":"2020-09-17T23:41:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/realizacziya-kontrollera-domena-v-samba-okazalas-podverzhena-uyazvimosti-zerologin"},"modified":"2020-09-18T01:41:56","modified_gmt":"2020-09-17T23:41:56","slug":"realizacziya-kontrollera-domena-v-samba-okazalas-podverzhena-uyazvimosti-zerologin","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/realizacziya-kontrollera-domena-v-samba-okazalas-podverzhena-uyazvimosti-zerologin","title":{"rendered":"La mise en \u0153uvre du contr\u00f4leur de domaine dans Samba s'est av\u00e9r\u00e9e vuln\u00e9rable \u00e0 l'exploitation ZeroLogin","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Les d\u00e9veloppeurs du projet Samba ont averti<\/a><\/noindex> les utilisateurs que r\u00e9cemment une vuln\u00e9rabilit\u00e9<\/a><\/noindex> a \u00e9t\u00e9 d\u00e9couverte dans Windows, vuln\u00e9rabilit\u00e9 ZeroLogin (CVE-2020-1472<\/a><\/noindex>) se manifeste<\/a><\/noindex> et dans la mise en \u0153uvre du contr\u00f4leur de domaine bas\u00e9 sur Samba. La vuln\u00e9rabilit\u00e9 est caus\u00e9e<\/a><\/noindex> par des lacunes dans le protocole MS-NRPC et l'algorithme de cryptage AES-CFB8, et lorsqu'elle est exploit\u00e9e avec succ\u00e8s, elle permet \u00e0 un attaquant d'obtenir l'acc\u00e8s administrateur dans le contr\u00f4leur de domaine.<\/p>\n

La vuln\u00e9rabilit\u00e9 r\u00e9side dans le fait que le protocole MS-NRPC (Netlogon Remote Protocol) permet, lors des \u00e9changes de donn\u00e9es d'authentification, de revenir \u00e0 l'utilisation d'une connexion RPC non chiffr\u00e9e. Apr\u00e8s cela, un attaquant peut exploiter une faille dans l'algorithme AES-CFB8 pour falsifier (spoofing) une connexion r\u00e9ussie. En moyenne, il faut environ 256 tentatives de spoofing pour obtenir des droits d'administrateur. Il n'est pas n\u00e9cessaire d'avoir un compte actif sur le contr\u00f4leur de domaine pour r\u00e9aliser une attaque ; des tentatives de spoofing peuvent \u00eatre effectu\u00e9es en utilisant un mot de passe incorrect. La demande d'authentification via NTLM sera redirig\u00e9e vers le contr\u00f4leur de domaine, qui renverra un refus d'acc\u00e8s, mais l'attaquant peut falsifier cette r\u00e9ponse, et le syst\u00e8me cibl\u00e9 consid\u00e9rera que la connexion a r\u00e9ussi.<\/p>\n

Dans Samba, la vuln\u00e9rabilit\u00e9 se manifeste uniquement sur les syst\u00e8mes qui n'utilisent pas le param\u00e8tre \u00ab server schannel = yes \u00bb, qui est d\u00e9fini par d\u00e9faut depuis Samba 4.8. En particulier, les syst\u00e8mes avec les param\u00e8tres \u00ab server schannel = no \u00bb et \u00ab server schannel = auto \u00bb peuvent \u00eatre compromis, permettant \u00e0 Samba d'exploiter les m\u00eames failles dans l'algorithme AES-CFB8 que sous Windows. <\/p>\n

Lors de l'utilisation d'un prototype d'exploit de r\u00e9f\u00e9rence pr\u00e9par\u00e9 pour Windows dans Samba, seule l'appel ServerAuthenticate3 est d\u00e9clench\u00e9, tandis que l'op\u00e9ration ServerPasswordSet2 \u00e9choue (l'exploit n\u00e9cessite une adaptation pour Samba). Aucune information n'est disponible sur le fonctionnement d'alternatives aux exploits (<\/a><\/noindex>). Les tentatives d'attaque sur les syst\u00e8mes peuvent \u00eatre suivies en analysant la pr\u00e9sence d'entr\u00e9es mentionnant ServerAuthenticate3 et ServerPasswordSet dans les journaux d'audit de Samba.1<\/a><\/noindex>, 2<\/a><\/noindex>, 3<\/a><\/noindex>, 4<\/a><\/noindex>Pour le PinePhone, un ensemble universel a \u00e9t\u00e9 pr\u00e9par\u00e9 avec 13 distributions<\/p>\n

<\/a><\/noindex><\/p>\n

Source : opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Samba \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u0447\u0442\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u0430\u044f \u0432 Windows \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c ZeroLogin (CVE-2020-1472) \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0438 \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u0430 \u043d\u0430 \u0431\u0430\u0437\u0435 Samba. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043d\u0435\u0434\u043e\u0440\u0430\u0431\u043e\u0442\u043a\u0430\u043c\u0438 \u0432 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0435 MS-NRPC \u0438 \u043a\u0440\u0438\u043f\u0442\u043e\u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c\u0435 AES-CFB8, \u0438 \u043f\u0440\u0438 \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0432 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0435 \u0434\u043e\u043c\u0435\u043d\u0430. \u0421\u0443\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b MS-NRPC (Netlogon Remote Protocol) \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u0440\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-94510","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"Les d\u00e9veloppeurs du projet Samba ont averti les utilisateurs que r\u00e9cemment","description":"\ud83e\udd47La mise en \u0153uvre du contr\u00f4leur de domaine dans Samba s'est av\u00e9r\u00e9e vuln\u00e9rable \u00e0 l'exploitation ZeroLogin | ProHoster","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/realizacziya-kontrollera-domena-v-samba-okazalas-podverzhena-uyazvimosti-zerologin","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u0430 \u0432 Samba \u043e\u043a\u0430\u0437\u0430\u043b\u0430\u0441\u044c \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 ZeroLogin | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Samba \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u0447\u0442\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/realizacziya-kontrollera-domena-v-samba-okazalas-podverzhena-uyazvimosti-zerologin","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-09-17T23:41:56+00:00","article:modified_time":"2020-09-17T23:41:56+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"94510","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 11:25:23","updated":"2022-09-29 04:02:07","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/94510","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=94510"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/94510\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=94510"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=94510"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=94510"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}