{"id":113594,"date":"2024-02-14T22:02:42","date_gmt":"2024-02-14T20:02:42","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-keytrap-i-nsec3-zatragivayushhie-bolshinstvo-realizaczij-dnssec"},"modified":"2024-02-14T22:02:42","modified_gmt":"2024-02-14T20:02:42","slug":"uyazvimosti-keytrap-i-nsec3-zatragivayushhie-bolshinstvo-realizaczij-dnssec","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/news\/uyazvimosti-keytrap-i-nsec3-zatragivayushhie-bolshinstvo-realizaczij-dnssec","title":{"rendered":"Sigurnosne ranjivosti KeyTrap i NSEC3 koje utje\u010du na ve\u0107inu implementacija DNSSEC-a","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>U razli\u010ditim implementacijama protokola DNSSEC otkrivene su dvije ranjivosti koje uti\u010du na DNS rezolvere BIND, PowerDNS, dnsmasq, Knot Resolver i Unbound. Ranjivosti omogu\u0107uju izazivanje odbijanja usluge DNS rezolverima koji vr\u0161e validaciju uz pomo\u0107 DNSSEC-a, zbog pojave visokog optere\u0107enja CPU-a \u0161to ometa obradu drugih zahtjeva. Za izvr\u0161enje napada dovoljno je poslati na DNS rezolver koji koristi DNSSEC zahtjev koji dovodi do pristupa specijalno oblikovanoj DNS zoni na serveru napada\u010da.      <\/p>\n<p>Otkrivene pote\u0161ko\u0107e:  <\/p>\n<ul>\n<li class=\"l\"> CVE-2023-50387 (kodno ime KeyTrap) \u2014 prilikom pristupa specijalno oblikovanim DNS zonama dolazi do odbacivanja usluge zbog stvaranja zna\u010dajnog optere\u0107enja na CPU i dugotrajnog izvr\u0161enja DNSSEC provere. Za izvo\u0111enje napada potrebno je postaviti domen s malicioznim pode\u0161avanjima na DNS serveru pod kontrolom napada\u010da, kao i ostvariti pristup toj zoni putem rekurzivnog DNS servera, \u010dije odbacivanje usluge napada\u010d poku\u0161ava izazvati.\n<p>Maliciozne postavke svode se na kori\u0161tenje kombinacije sukobljenih klju\u010deva, RRSET zapisa i digitalnih potpisa za zonu. Poku\u0161aj provjere uz kori\u0161tenje tih klju\u010deva dovodi do dugotrajnih operacija koje zahtijevaju puno resursa, zbog \u010dega CPU mo\u017ee biti potpuno optere\u0107en, ometaju\u0107i obradu drugih zahtjeva (na primjer, navodi se da je napadom na BIND obustavljena obrada drugih zahtjeva na 16 sati).      <\/p>\n<li class=\"l\"> CVE-2023-50868 (kodno ime NSEC3) \u2014 odbacivanje usluge usled izvr\u0161avanja zna\u010dajnih prora\u010duna prilikom izra\u010dunavanja he\u0161eva u NSEC3 zapisima (Next Secure v3) prilikom obrade specijalno oblikovanih DNSSEC odgovora. Metod napada podse\u0107a na prvu ranjivost, uz izuzetak da na zlo\u0107udnom DNS serveru se kreira specijalno oblikovan skup NSEC3 RRSET zapisa.      <\/ul>\n<p>Isti\u010de se da su pojavljivanje gore spomenutih ranjivosti uzrokovane definicijom u specifikaciji DNSSEC mogu\u0107nosti slanja svih dostupnih kriptografskih klju\u010deva od strane DNS servera, pri \u010demu rezolviri trebaju obraditi sve primljene klju\u010deve dok provjera ne zavr\u0161i uspje\u0161no ili dok svi primljeni klju\u010devi ne budu provjereni.    <\/p>\n<p>Kako bi se sprije\u010dile ranjivosti u resolverima, maksimalni broj DNSSEC klju\u010deva kori\u0161tenih u procesu gradnje lanca povjerenja te maksimalni broj izra\u010duna hash-a za NSEC3 su ograni\u010deni, kao i broj ponovnih poku\u0161aja provjere za svaki RRSET (kombinacije klju\u010deva i potpisa) i svaki odgovor. <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/hr\/server\/dts-los-angeles\/\"   title=\"poslu\u017eitelja\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"3614\">poslu\u017eitelja<\/a>.     <\/p>\n<p>Ranjivosti su ispravljene u a\u017euriranjima Unbound (1.19.1), PowerDNS Recursor (4.8.6, 4.9.3, 5.0.2), Knot Resolver (5.7.1), dnsmasq (2.90) i BIND (9.16.48, 9.18.24 i 9.19.21). Status ispravljenih ranjivosti u distribucijama mo\u017eete procijeniti na ovim stranicama: Debian, Ubuntu, SUSE, RHEL, Fedora, Arch Linux, Gentoo, Slackware, NetBSD, FreeBSD.            <\/p>\n<p>U verzijama DNS poslu\u017eitelja BIND 9.16.48, 9.18.24 i 9.19.21 dodatno su otkrivene jo\u0161 neke ranjivosti:  <\/p>\n<ul>\n<li class=\"l\"> CVE-2023-4408 \u2014 razmatranje velikih DNS poruka mo\u017ee dovesti do stvaranja visokog optere\u0107enja na CPU.\n<li class=\"l\"> CVE-2023-5517 \u2014 zahtev specijalno oblikovane povratne zone mo\u017ee dovesti do iznenadnog zavr\u0161etka zbog aktiviranja assert provere. Problem se javlja samo u konfiguracijama s uklju\u010denim pode\u0161avanjem \u201enxdomain-redirect\u201c.\n<li class=\"l\"> CVE-2023-5679 \u2014 rekurzivno odre\u0111ivanje hosta mo\u017ee dovesti do iznenadnog zavr\u0161etka zbog aktiviranja assert provere na sistemima s uklju\u010denom podr\u0161kom za DNS64 i \u201eserve-stale\u201c (pode\u0161avanja stale-cache-enable i stale-answer-enable).\n<li class=\"l\"> CVE-2023-6516 \u2014 specijalno oblikovani rekurzivni zahtevi mogu dovesti do iscrpljivanja dostupne memorije procesa.    <\/ul>\n<p>Izvor: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=60599\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 DNSSEC \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0435 DNS-\u0440\u0435\u0437\u043e\u043b\u0432\u0435\u0440\u044b BIND, PowerDNS, dnsmasq, Knot Resolver \u0438 Unbound. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043e\u0442\u043a\u0430\u0437\u0430 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438 DNS-\u0440\u0435\u0437\u043e\u043b\u0432\u0435\u0440\u043e\u0432, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u044e\u0449\u0438\u0445 \u0432\u0430\u043b\u0438\u0434\u0430\u0446\u0438\u044e \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 DNSSEC, \u0438\u0437-\u0437\u0430 \u0432\u043e\u0437\u043d\u0438\u043a\u043d\u043e\u0432\u0435\u043d\u0438\u044f \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043d\u0430 CPU, \u043c\u0435\u0448\u0430\u044e\u0449\u0435\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0434\u0440\u0443\u0433\u0438\u0445 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432. \u0414\u043b\u044f \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u043d\u0430 DNS-\u0440\u0435\u0437\u043e\u043b\u0432\u0435\u0440, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0439 DNSSEC, \u0437\u0430\u043f\u0440\u043e\u0441, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0438\u0439 \u043a \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044e \u043a \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0439 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-113594","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 DNSSEC \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0435 DNS-\u0440\u0435\u0437\u043e\u043b\u0432\u0435\u0440\u044b BIND, PowerDNS, dnsmasq, Knot Resolver \u0438 Unbound.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/hr\/blog\/news\/uyazvimosti-keytrap-i-nsec3-zatragivayushhie-bolshinstvo-realizaczij-dnssec\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"hr_HR\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 KeyTrap \u0438 NSEC3, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0435 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0439 DNSSEC | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 DNSSEC \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0435 DNS-\u0440\u0435\u0437\u043e\u043b\u0432\u0435\u0440\u044b BIND, PowerDNS, dnsmasq, Knot Resolver \u0438 Unbound.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/hr\/blog\/news\/uyazvimosti-keytrap-i-nsec3-zatragivayushhie-bolshinstvo-realizaczij-dnssec\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2024-02-14T20:02:42+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2024-02-14T20:02:42+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Ranjivosti KeyTrap i NSEC3 koje utje\u010du na ve\u0107inu implementacija DNSSEC | ProHoster","description":"U raznim implementacijama DNSSEC protokola otkrivene su dvije ranjivosti koje zahva\u0107aju DNS resolvere BIND, PowerDNS, dnsmasq, Knot Resolver i Unbound.","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/news\/uyazvimosti-keytrap-i-nsec3-zatragivayushhie-bolshinstvo-realizaczij-dnssec","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 KeyTrap \u0438 NSEC3, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0435 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0439 DNSSEC | ProHoster","og:description":"\u0412 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 DNSSEC \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0435 DNS-\u0440\u0435\u0437\u043e\u043b\u0432\u0435\u0440\u044b BIND, PowerDNS, dnsmasq, Knot Resolver \u0438 Unbound.","og:url":"https:\/\/prohoster.info\/hr\/blog\/news\/uyazvimosti-keytrap-i-nsec3-zatragivayushhie-bolshinstvo-realizaczij-dnssec","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-02-14T20:02:42+00:00","article:modified_time":"2024-02-14T20:02:42+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"113594","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-22 15:29:23","updated":"2026-02-22 15:29:23","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/113594","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=113594"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/113594\/revisions"}],"predecessor-version":[{"id":162142,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/113594\/revisions\/162142"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=113594"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=113594"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=113594"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}