Grupa istra\u017eiva\u010da s Kalifornijskog sveu\u010dili\u0161ta u Riversideu objavila je novu varijantu napada SAD DNS (CVE-2021-20322), koja radi unato\u010d za\u0161titi dodanoj pro\u0161le godine za blokiranje ranjivosti CVE-2020-25705. Nova metoda je u osnovi sli\u010dna ranijoj ranjivosti i razlikuje se samo kori\u0161tenjem druga\u010dijeg tipa ICMP paketa za provjeru aktivnih UDP portova. Predlo\u017eeni napad omogu\u0107ava umetanje la\u017enih podataka u DNS cache servera, \u0161to se mo\u017ee iskoristiti za zamjenu IP adrese proizvoljnom domenu u cacheu i preusmjeravanje zahtjeva na server napada\u010da. <\/p>\n
Predlo\u017eena metoda funkcioni\u0161e samo u mre\u017enom sloju Linuxa zbog vezanosti za specifi\u010dnosti rada mehanizma obrade ICMP paketa u Linuxu, koji je izvor curenja podataka, olak\u0161avaju\u0107i identifikaciju UDP port broja koji se koristi. serverom<\/a> za slanje vanjskog zahtjeva. Izmjene koje blokiraju curenje informacija usvojene su u jezgru Linuxa krajem kolovoza (ispravka je uklju\u010dena u jezgru 5.15 i rujanske nadogradnje LTS grana jezgra). Ispravka se svodi na prelazak na kori\u0161tenje algoritma za hashiranje SipHash umjesto Jenkins Hash u mre\u017enim cache-ima. Status otklanjanja ranjivosti u distribucijama mo\u017ee se procijeniti prema podacima na ovim stranicama: Debian, RHEL, Fedora, SUSE, Ubuntu. <\/p>\n Prema podacima istra\u017eiva\u010da koji su identificirali problem, ranjivosti je podlo\u017eno oko 38% otvorenih resolvera dostupnih na mre\u017ei, uklju\u010duju\u0107i popularne DNS usluge poput OpenDNS i Quad9 (9.9.9.9). \u0160to se ti\u010de serverskog softvera, napad se mo\u017ee izvesti kori\u0161tenjem paketa kao \u0161to su BIND, Unbound i dnsmasq na Linux serverima. Na DNS serverima koji su podi\u017eu s Windows i BSD sustava, problem se ne manifestira. Za uspje\u0161no provo\u0111enje napada potrebno je koristiti IP spoofing, tj. potrebno je da pru\u017eatelj napada\u010da ne blokira pakete s la\u017enom izvorom IP adresom. <\/p>\n Podsje\u0107amo da SAD DNS napad omogu\u0107ava zaobila\u017eenje za\u0161tite dodane na DNS servere kako bi se blokirala klasi\u010dna metoda trovanja DNS predmemorije, koju je 2008. godine predlo\u017eio Dan Kaminsky. Kaminski metoda manipuli\u0161e neznatnom veli\u010dinom polja sa identifikacionim brojem DNS upita, koji iznosi samo 16 bita. Za odabir ispravnog identifikatora DNS transakcije potrebnog za spoofing imena hosta, dovoljno je poslati otprilike 7000 upita i simulirati oko 140 tisu\u0107a la\u017enih odgovora. Napad se svodi na slanje velikog broja paketa s la\u017enom povezano\u0161\u0107u na IP i s razli\u010ditim identifikatorima DNS transakcije na DNS resolver. Kako bi se sprije\u010dilo ke\u0161iranje prvog odgovora, u svakom la\u017enom odgovoru navodi se malo izmijenjeno ime domene (1.example.com, 2.example.com, 3.example.com itd.). <\/p>\n Za za\u0161titu od ove vrste napada proizvo\u0111a\u010di DNS servera implementirali su slu\u010dajnu raspodjelu brojeva izvornih mre\u017enih portova s kojih se \u0161alju upiti za rje\u0161avanje, \u0161to je nadoknadilo nedovoljno veliku veli\u010dinu identifikatora. Nakon implementacije za\u0161tite, uz odabir 16-bitnog identifikatora, postalo je neophodno odabrati i jedan od 64 tisu\u0107e portova za slanje la\u017enog odgovora, \u0161to je pove\u0107alo broj opcija za odabir na 2^32. <\/p>\n SAD DNS metoda omogu\u0107ava drasti\u010dno pojednostavljenje odre\u0111ivanja broja mre\u017enog porta i svodi napad na klasi\u010dnu Kaminjskog metodu. Napada\u010d mo\u017ee identificirati zahtjeve za neiskori\u0161tenim i aktivnim UDP-portovima koriste\u0107i curenje informacija o aktivnosti mre\u017enih portova tijekom obrade ICMP paketa. Ova metoda omogu\u0107ava smanjenje broja mogu\u0107nosti pretra\u017eivanja za 4 reda veli\u010dine \u2014 2^16+2^16 umjesto 2^32 (131_072 umjesto 4_294_967_296). Curenje informacija koje omogu\u0107uju brzo odre\u0111ivanje aktivnih UDP-portova uzrokovano je nedostacima u kodu obrade ICMP paketa sa zahtjevima za fragmentaciju (ICMP Fragmentation Needed flag) ili preusmjeravanje (ICMP Redirect flag). Slanje takvih paketa mijenja stanje predmemorije u mre\u017enom sloju, \u0161to omogu\u0107uje na temelju reakcije servera utvr\u0111ivanje koji je od UDP-portova aktivan, a koji nije. <\/p>\n Napadni scenarij: Kada DNS-rezolver poku\u0161ava odrediti domensko ime, \u0161alje UDP-upit na poslu\u017eiteljski DNS-poslu\u017eitelj. U trenutku kada rezolver \u010deka odgovor, napada\u010d mo\u017ee brzo odrediti broj izvorne priklju\u010dne to\u010dke koja je kori\u0161tena za slanje upita i poslati la\u017eni odgovor na taj broj, predstavljaju\u0107i se kao poslu\u017eiteljski DNS-poslu\u017eitelj koriste\u0107i spoofing. IP adrese<\/a>DNS-rezolver \u0107e staviti u cache podatke proslije\u0111ene u la\u017enom odgovoru i neko \u0107e vrijeme na sve druge DNS-upite za domensko ime vra\u0107ati podmetnuti IP-adresu napada\u010da. \u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u041a\u0430\u043b\u0438\u0444\u043e\u0440\u043d\u0438\u0439\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0432 \u0420\u0438\u0432\u0435\u0440\u0441\u0430\u0439\u0434\u0435 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u043d\u043e\u0432\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0430\u0442\u0430\u043a\u0438 SAD DNS (CVE-2021-20322), \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0439 \u043d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0437\u0430\u0449\u0438\u0442\u0443, \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u043d\u0443\u044e \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u0433\u043e\u0434\u0443 \u0434\u043b\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2020-25705. \u041d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0432 \u0446\u0435\u043b\u043e\u043c \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u0435\u043d \u043f\u0440\u043e\u0448\u043b\u043e\u0433\u043e\u0434\u043d\u0435\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438 \u043e\u0442\u043b\u0438\u0447\u0430\u0435\u0442\u0441\u044f \u043b\u0438\u0448\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0434\u0440\u0443\u0433\u043e\u0433\u043e \u0442\u0438\u043f\u0430 ICMP-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0445 UDP-\u043f\u043e\u0440\u0442\u043e\u0432. \u041f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u043d\u0430\u044f \u0430\u0442\u0430\u043a\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0442\u044c \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u0444\u0438\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u043a\u044d\u0448 DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u0430, \u0447\u0442\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102308","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Nova varijanta napada SAD DNS za davanje la\u017enih podataka u DNS cache | ProHoster","description":"Grupa istra\u017eiva\u010da sa Sveu\u010dili\u0161ta Kalifornija u Riversideu objavila je novu varijantu napada SAD DNS (CVE-2021-20322) koja funkcionira unato\u010d za\u0161titi dodanoj pro\u0161le godine radi blokiranja ranjivosti.","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/news\/novyj-variant-ataki-sad-dns-dlya-podstanovki-fiktivnyh-dannyh-v-kesh-dns","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041d\u043e\u0432\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0430\u0442\u0430\u043a\u0438 SAD DNS \u0434\u043b\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0444\u0438\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u043a\u044d\u0448 DNS | ProHoster","og:description":"\u0413\u0440\u0443\u043f\u043f\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u041a\u0430\u043b\u0438\u0444\u043e\u0440\u043d\u0438\u0439\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0432 \u0420\u0438\u0432\u0435\u0440\u0441\u0430\u0439\u0434\u0435 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u043d\u043e\u0432\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u0430\u0442\u0430\u043a\u0438 SAD DNS (CVE-2021-20322), \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0439 \u043d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0437\u0430\u0449\u0438\u0442\u0443, \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u043d\u0443\u044e \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u0433\u043e\u0434\u0443 \u0434\u043b\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438.","og:url":"https:\/\/prohoster.info\/hr\/blog\/news\/novyj-variant-ataki-sad-dns-dlya-podstanovki-fiktivnyh-dannyh-v-kesh-dns","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-11-17T19:36:54+00:00","article:modified_time":"2021-11-17T19:36:54+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102308","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-11-17 19:38:17","updated":"2026-02-09 21:46:42","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/102308","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=102308"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/102308\/revisions"}],"predecessor-version":[{"id":160307,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/102308\/revisions\/160307"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=102308"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=102308"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=102308"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Izvor: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"