11 Raunuka Masu Amfani Daga Nesa A Cikin TCP/IP Tarin VxWorks

Masu binciken tsaro daga Armis fallasa bayani game da 11 vulnerabilities (PDF) a cikin TCP/IP Ana amfani da tarin IPnet a cikin tsarin aiki na VxWorks. Ana sanya wa matsalolin suna "URGENT/11." Ana iya amfani da raunin da ke tattare da shi daga nesa ta hanyar aika fakitin hanyar sadarwa na musamman. Ga wasu matsaloli, yana yiwuwa a kai hari ta hanyar firewalls da NAT (misali, idan mahari yana sarrafa sabar DNS da na'urar da ke cikin hanyar sadarwa ta ciki ke shiga).

Matsaloli shida na iya haifar da kisa lambar mai hari lokacin aiki ba daidai ba saitin IP ko zaɓuɓɓukan TCP a cikin fakiti, da kuma lokacin tantance fakitin DHCP. Matsaloli biyar ba su da haɗari kuma suna iya haifar da zubar da bayanai ko harin DoS. An daidaita bayyana rashin lafiyar tare da kogin Wind, kuma sabon sakin VxWorks 7 SR0620, wanda aka saki a makon da ya gabata, ya riga ya magance matsalolin.

Tun da kowane lahani yana rinjayar wani ɓangare na daban-daban na tarin hanyar sadarwar, batutuwan na iya zama takamaiman-saki, amma an bayyana cewa kowane nau'in VxWorks tun daga 6.5 yana da aƙalla raunin aiwatar da lambar nesa ɗaya. A wannan yanayin, ga kowane bambance-bambancen na VxWorks ya zama dole don ƙirƙirar amfani daban. A cewar Armis, matsalar ta shafi na’urori kusan miliyan 200, da suka hada da na’urorin masana’antu da na likitanci, da na’urori masu amfani da wayar salula, da wayoyin VOIP, da na’urorin kashe wuta, da na’urorin buga takardu da na’urorin Intanet daban-daban.

Kamfanin Wind River tunanicewa wannan adadi ya wuce kima kuma matsalar tana shafar ƙananan ƙananan na'urori marasa mahimmanci, wanda, a matsayin mai mulkin, yana iyakance ga hanyar sadarwa na ciki. Tarin hanyar sadarwar IPnet yana samuwa ne kawai a cikin zaɓin bugu na VxWorks, gami da sakewa waɗanda ba a tallafawa (kafin 6.5). Na'urorin da suka dogara da dandamali na VxWorks 653 da VxWorks Cert Edition da ake amfani da su a wurare masu mahimmanci (mutumin masana'antu, na'urorin lantarki da na jirgin sama) ba sa fuskantar matsala.

Wakilan Armis sun yi imanin cewa saboda wahalar sabunta na'urori masu rauni, yana yiwuwa tsutsotsi za su bayyana waɗanda ke cutar da cibiyoyin sadarwa na cikin gida kuma suna kai hari ga shahararrun nau'ikan na'urori masu rauni gaba ɗaya. Misali, wasu na'urori, kamar kayan aikin likitanci da masana'antu, suna buƙatar sake tabbatarwa da gwaji mai yawa lokacin sabunta firmware ɗin su, yana mai da wahala sabunta firmware ɗin su.

Wind River tafiyacewa a irin waɗannan lokuta, ana iya rage haɗarin yin sulhu ta hanyar ba da damar ginannun abubuwan tsaro kamar tari maras iya aiwatarwa, kariyar tari mai ambaliya, ƙuntatawa na tsarin kira, da keɓewar tsari. Hakanan za'a iya ba da kariya ta ƙara sa hannu na toshe hari akan bangon wuta da tsarin rigakafin kutse, da kuma iyakance hanyar sadarwar hanyar sadarwa zuwa na'urar kawai zuwa kewayen tsaro na ciki.

source: budenet.ru