{"id":104866,"date":"2022-08-17T09:36:49","date_gmt":"2022-08-17T07:36:49","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-ustrojstvah-na-baze-soc-realtek-pozvolyayushhaya-vypolnit-kod-cherez-otpravku-udp-paketa"},"modified":"2022-08-17T09:36:49","modified_gmt":"2022-08-17T07:36:49","slug":"uyazvimost-v-ustrojstvah-na-baze-soc-realtek-pozvolyayushhaya-vypolnit-kod-cherez-otpravku-udp-paketa","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/news\/uyazvimost-v-ustrojstvah-na-baze-soc-realtek-pozvolyayushhaya-vypolnit-kod-cherez-otpravku-udp-paketa","title":{"rendered":"Ranljivost u ure\u0111ajima na bazi SoC Realtek koja omogu\u0107ava izvr\u0161avanje koda slanjem UDP paketa.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Istra\u017eiva\u010di iz kompanije Faraday Security predstavili su na konferenciji DEFCON detalje iskori\u0161\u0107avanja kriti\u010dne ranjivosti (CVE-2022-27255) u SDK-u za \u010dipove Realtek RTL819x, koja omogu\u0107ava izvr\u0161avanje vlastitog koda na ure\u0111aju slanjem posebno formatiranog UDP paketa. Ova ranjivost je zna\u010dajna jer omogu\u0107ava napad na ure\u0111aje u kojima je isklju\u010den pristup web su\u010delju za vanjske mre\u017ee \u2014 za napad je dovoljno poslati jedan UDP paket.    <\/p>\n<p>Ranjivost se odnosi na ure\u0111aje koji koriste ranjive verzije SDK-a Realtek, uklju\u010duju\u0107i eCos RSDK 1.5.7p1 i MSDK 4.9.4p1. A\u017euriranja eCos SDK-a koja otklanjaju ranjivost objavila je kompanija Realtek 25. o\u017eujka. Trenutno nije jasno koji su to\u010dno ure\u0111aji pogo\u0111eni problemom \u2014 SoC Realtek RTL819x koristi se u mre\u017enim usmjeriva\u010dima, pristupnim to\u010dkama, poja\u010diva\u010dima Wi-Fi, IP kamerama, ure\u0111ajima interneta stvari i drugim mre\u017enim ure\u0111ajima vi\u0161e od 60 proizvo\u0111a\u010da, uklju\u010duju\u0107i Asus, A-Link, Beeline, Belkin, Buffalo, D-Link, Edison, Huawei, LG, Logitec, MT-Link, Netgear, Smartlink, UPVEL, ZTE i Zyxel.     <\/p>\n<p>U javnosti su ve\u0107 objavljeni primjeri eksploita za dobivanje udaljenog pristupa ure\u0111aju i izvr\u0161avanje vlastitih naredbi na primjeru napada na usmjeriva\u010d Nexxt Nebula 300 Plus. Dodatno su objavljeni alati za analizu firmwara na prisutnost ranjivosti.     <\/p>\n<p>Uzimaju\u0107i u obzir probleme s pripremom i isporukom, kao i a\u017euriranja firmwara na ve\u0107 objavljenim ure\u0111ajima, o\u010dekuje se da \u0107e se uskoro pojaviti automatizirani napadi i crvi koji napadaju ranjive mre\u017ene ure\u0111aje. Nakon uspje\u0161nog napada, pogo\u0111eni ure\u0111aji mogu se koristiti zlonamjernim korisnicima, na primjer, za formiranje botneta, uvo\u0111enje backdoor-a za ostavljanje rupa u unutarnjoj mre\u017ei poduze\u0107a, presretanje tranzitnog prometa ili njegovo preusmjeravanje na vanjski host.    <\/p>\n<p>Ranjivost je uzrokovana prelivanjem baferom u modulu \u201eSIP ALG\u201c (SIP Application Layer Gateway), koji se koristi za organizaciju propu\u0161tanja SIP paketa iza prevodnika adresa. Problem je nastao zbog izostanka provjere stvarne veli\u010dine primljenih podataka, \u0161to dovodi do prepisivanja podru\u010dja memorije izvan fiksnog bafera prilikom pozivanja funkcije strcpy tijekom obrade SIP paketa. Napad se mo\u017ee izvr\u0161iti slanjem UDP paketa s neispravnim vrijednostima polja u SDP dijelu podataka ili SIP protokolskom zaglavlju. Za iskori\u0161\u0107avanje je dovoljno poslati jedan paket na proizvoljni UDP port WAN su\u010delja.      <center>  <video controls=\"\" style=\"width: 700px; height: 400px; max-width:100%\"><source src=\"https:\/\/github.com\/infobyte\/cve-2022-27255\/raw\/main\/DEFCON\/poc.mp4\" type=\"video\/mp4\"><\/video>  <\/center>    <\/p>\n<p>Kao zaobilazno rje\u0161enje za za\u0161titu preporu\u010duje se blokiranje na vatrozidu ili u sustavu za prevenciju mre\u017enih upada UDP paketa s SIP porukom \u201eINVITE\u201c, linijom \u201em=audio\u201c i veli\u010dinom ve\u0107om od 128 bajta. Primjer pravila za otkrivanje poku\u0161aja iskori\u0161tavanja u IDS-u Snort 3: alert udp any any -&gt; any any (sid:1000000; \t msg:\u201eIskori\u0161tavanje SIP prometa u Realtek eCOS SDK-u CVE-2022-27255\u201c;; \t content: \u201einvite\u201c; depth: 6; nocase; \t content: \u201em=audio\u201c; \t isdataat: 128,relative; \t content:!\u201e|0d|\u201c; within: 128;)<br \/>\n<br \/>Izvor: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=57645\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Faraday Security \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0438 \u043d\u0430 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 DEFCON \u0434\u0435\u0442\u0430\u043b\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2022-27255) \u0432 SDK \u0434\u043b\u044f \u0447\u0438\u043f\u043e\u0432 Realtek RTL819x, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0441\u0432\u043e\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e UDP-\u043f\u0430\u043a\u0435\u0442\u0430. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u0430 \u0442\u0435\u043c, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u0442\u044c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043e\u0442\u043a\u043b\u044e\u0447\u0451\u043d \u0434\u043e\u0441\u0442\u0443\u043f \u0432 web-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 \u0434\u043b\u044f \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0441\u0435\u0442\u0435\u0439 &#8212; \u0434\u043b\u044f \u0430\u0442\u0430\u043a\u0438 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043f\u0440\u043e\u0441\u0442\u043e \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u043e\u0434\u0438\u043d UDP-\u043f\u0430\u043a\u0435\u0442. [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-104866","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Faraday Security \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0438 \u043d\u0430 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 DEFCON \u0434\u0435\u0442\u0430\u043b\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2022-27255) \u0432 SDK \u0434\u043b\u044f \u0447\u0438\u043f\u043e\u0432 Realtek RTL819x, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0441\u0432\u043e\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/hr\/blog\/news\/uyazvimost-v-ustrojstvah-na-baze-soc-realtek-pozvolyayushhaya-vypolnit-kod-cherez-otpravku-udp-paketa\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"hr_HR\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 \u043d\u0430 \u0431\u0430\u0437\u0435 SoC Realtek, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 UDP-\u043f\u0430\u043a\u0435\u0442\u0430 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Faraday Security \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0438 \u043d\u0430 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 DEFCON \u0434\u0435\u0442\u0430\u043b\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2022-27255) \u0432 SDK \u0434\u043b\u044f \u0447\u0438\u043f\u043e\u0432 Realtek RTL819x, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0441\u0432\u043e\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/hr\/blog\/news\/uyazvimost-v-ustrojstvah-na-baze-soc-realtek-pozvolyayushhaya-vypolnit-kod-cherez-otpravku-udp-paketa\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2022-08-17T07:36:49+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2022-08-17T07:36:49+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ranljivost v napravah, ki temeljijo na SoC Realtek, ki omogo\u010da izvajanje kode prek po\u0161iljanja UDP paketa | ProHoster","description":"Raziskovalci podjetja Faraday Security so na konferenci DEFCON predstavili podrobnosti o izkori\u0161\u010danju kriti\u010dne ranljivosti (CVE-2022-27255) v SDK-ju za \u010dipe Realtek RTL819x, ki omogo\u010da izvajanje lastne kode na napravah.","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/news\/uyazvimost-v-ustrojstvah-na-baze-soc-realtek-pozvolyayushhaya-vypolnit-kod-cherez-otpravku-udp-paketa","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 \u043d\u0430 \u0431\u0430\u0437\u0435 SoC Realtek, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 UDP-\u043f\u0430\u043a\u0435\u0442\u0430 | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Faraday Security \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0438 \u043d\u0430 \u043a\u043e\u043d\u0444\u0435\u0440\u0435\u043d\u0446\u0438\u0438 DEFCON \u0434\u0435\u0442\u0430\u043b\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2022-27255) \u0432 SDK \u0434\u043b\u044f \u0447\u0438\u043f\u043e\u0432 Realtek RTL819x, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0441\u0432\u043e\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435.","og:url":"https:\/\/prohoster.info\/hr\/blog\/news\/uyazvimost-v-ustrojstvah-na-baze-soc-realtek-pozvolyayushhaya-vypolnit-kod-cherez-otpravku-udp-paketa","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-08-17T07:36:49+00:00","article:modified_time":"2022-08-17T07:36:49+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"104866","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-08-17 07:37:54","updated":"2022-09-28 09:36:11","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/104866","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=104866"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/104866\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=104866"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=104866"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=104866"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}