{"id":36640,"date":"2019-10-31T22:12:50","date_gmt":"2019-10-31T19:12:50","guid":{"rendered":"https:\/\/prohoster.info\/blog\/11-udalyonno-ekspluatiruemyh-uyazvimostej-v-tcp-ip-steke-vxworks\/"},"modified":"2019-10-31T22:12:50","modified_gmt":"2019-10-31T19:12:50","slug":"11-udalyonno-ekspluatiruemyh-uyazvimostej-v-tcp-ip-steke-vxworks","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/11-udalyonno-ekspluatiruemyh-uyazvimostej-v-tcp-ip-steke-vxworks","title":{"rendered":"11 t\u00e1volr\u00f3l kihaszn\u00e1lhat\u00f3 s\u00e9r\u00fcl\u00e9kenys\u00e9g a VxWorks TCP\/IP verem\u00e9ben","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

A biztons\u00e1gi kutat\u00f3k az Armis c\u00e9gt\u0151l felfedt\u00e9k<\/a><\/noindex> inform\u00e1ci\u00f3t ad 11 sebezhet\u0151s\u00e9gr\u0151l<\/a><\/noindex> (PDF<\/a><\/noindex>) az IPnet TCP\/IP verem\u00e9ben, amelyet a VxWorks oper\u00e1ci\u00f3s rendszer haszn\u00e1l. A probl\u00e9m\u00e1kat \u201eURGENT\/11\u201d k\u00f3dn\u00e9ven azonos\u00edtott\u00e1k. A sebezhet\u0151s\u00e9gek t\u00e1voli kihaszn\u00e1l\u00e1sra ker\u00fclhetnek, k\u00fcl\u00f6n\u00f6sen akkor, ha speci\u00e1lisan kialak\u00edtott h\u00e1l\u00f3zati csomagokat k\u00fcldenek, bele\u00e9rtve azokat az eseteket, amikor bizonyos probl\u00e9m\u00e1k eset\u00e9n t\u00e1mad\u00e1s val\u00f3s\u00edthat\u00f3 meg a t\u0171zfalak \u00e9s NAT (p\u00e9ld\u00e1ul, ha a t\u00e1mad\u00f3 ellen\u0151rzi azt a DNS szervert, amelyhez a bels\u0151 h\u00e1l\u00f3zaton l\u00e9v\u0151 sebezhet\u0151 eszk\u00f6z kapcsol\u00f3dik).<\/p>\n

\"11<\/a><\/noindex><\/center><\/p>\n

Hat probl\u00e9ma vezethet a t\u00e1mad\u00f3 k\u00f3dj\u00e1nak v\u00e9grehajt\u00e1s\u00e1hoz a hib\u00e1san be\u00e1ll\u00edtott IP vagy TCP opci\u00f3k csomagban val\u00f3 feldolgoz\u00e1sa, valamint a DHCP csomagok elemz\u00e9se sor\u00e1n. \u00d6t probl\u00e9ma kev\u00e9sb\u00e9 vesz\u00e9lyes, \u00e9s inform\u00e1ci\u00f3sziv\u00e1rg\u00e1st vagy DoS-t\u00e1mad\u00e1sokat okozhat. Az inform\u00e1ci\u00f3k nyilv\u00e1noss\u00e1gra hozatala a Wind River c\u00e9ggel koordin\u00e1lva t\u00f6rt\u00e9nt; a VxWorks 7 SR0620 legut\u00f3bbi kiad\u00e1s\u00e1ban, amelyet a m\u00falt h\u00e9ten tettek k\u00f6zz\u00e9, a probl\u00e9m\u00e1k m\u00e1r megold\u00f3dtak.<\/p>\n

Mivel minden sebezhet\u0151s\u00e9g k\u00fcl\u00f6nb\u00f6z\u0151 r\u00e9szeit \u00e9rinti a h\u00e1l\u00f3zati veremnek, a probl\u00e9m\u00e1k specifikusak lehetnek bizonyos kiad\u00e1sokra, de \u00e1ll\u00edtj\u00e1k, hogy a VxWorks 6.5-\u00f6s verzi\u00f3j\u00e1t\u00f3l kezd\u0151d\u0151en minden verzi\u00f3ban megjelenik legal\u00e1bb egy sebezhet\u0151s\u00e9g, amely t\u00e1voli k\u00f3dv\u00e9grehajt\u00e1st tesz lehet\u0151v\u00e9. Minden VxWorks vari\u00e1nshoz k\u00fcl\u00f6n exploit l\u00e9trehoz\u00e1s\u00e1ra van sz\u00fcks\u00e9g. Az Armis c\u00e9g becsl\u00e9se szerint a probl\u00e9ma k\u00f6r\u00fclbel\u00fcl 200 milli\u00f3 eszk\u00f6zt \u00e9rint, bele\u00e9rtve ipari \u00e9s orvosi berendez\u00e9seket, routereket, VOIP telefonokat, t\u0171zfalakat, nyomtat\u00f3kat \u00e9s k\u00fcl\u00f6nf\u00e9le IoT eszk\u00f6z\u00f6ket. <\/p>\n

A Wind River c\u00e9g \u00fagy v\u00e9li<\/a><\/noindex>, hogy ez a sz\u00e1m t\u00falzott, \u00e9s a probl\u00e9ma csak viszonylag kis sz\u00e1m\u00fa nem kritikus eszk\u00f6zt \u00e9rint, amelyek \u00e1ltal\u00e1ban egy bels\u0151 v\u00e1llalati h\u00e1l\u00f3zatra korl\u00e1toz\u00f3dnak. Az IPnet h\u00e1l\u00f3zati verem csak n\u00e9h\u00e1ny VxWorks kiad\u00e1sban volt el\u00e9rhet\u0151, bele\u00e9rtve azokat, amelyek t\u00e1mogat\u00e1sa m\u00e1r megsz\u0171nt (6.5 el\u0151tt). A VxWorks 653 \u00e9s a VxWorks Cert Edition alap\u00fa platformokra \u00e9p\u00fclt eszk\u00f6z\u00f6k, amelyeket kritikus ter\u00fcleteken (ipari robotok, aut\u00f3ipari \u00e9s rep\u00fcl\u00e9stechnikai elektronika) haszn\u00e1lnak, nem mutatnak probl\u00e9m\u00e1kat.<\/p>\n

Az Armis k\u00e9pvisel\u0151i \u00fagy v\u00e9lik, hogy a sebezhet\u0151 eszk\u00f6z\u00f6k friss\u00edt\u00e9s\u00e9nek bonyolults\u00e1ga miatt nem z\u00e1rhat\u00f3 ki a f\u00e9rgek megjelen\u00e9se, amelyek helyi h\u00e1l\u00f3zatokat t\u00e1madhatnak, t\u00f6megesen c\u00e9lozva meg a legn\u00e9pszer\u0171bb sebezhet\u0151 eszk\u00f6z\u00f6k kateg\u00f3ri\u00e1it. P\u00e9ld\u00e1ul bizonyos eszk\u00f6z\u00f6k, mint az orvosi \u00e9s ipari berendez\u00e9sek, a firmware friss\u00edt\u00e9sekor \u00fajra tan\u00fas\u00edt\u00e1st \u00e9s hossz\u00fa t\u00e1v\u00fa tesztel\u00e9st ig\u00e9nyelnek, ami megnehez\u00edti a firmware friss\u00edt\u00e9st.<\/p>\n

Wind River \u00fagy v\u00e9lik<\/a><\/noindex>, hogy ilyen esetekben a kompromitt\u00e1l\u00e1s kock\u00e1zat\u00e1t cs\u00f6kkenthetj\u00fck a m\u00e1r megl\u00e9v\u0151 be\u00e9p\u00edtett biztons\u00e1gi eszk\u00f6z\u00f6k aktiv\u00e1l\u00e1s\u00e1val, mint p\u00e9ld\u00e1ul a nem futtathat\u00f3 verem, verem t\u00falcsordul\u00e1s elleni v\u00e9delem, a rendszerh\u00edv\u00e1sok korl\u00e1toz\u00e1sa \u00e9s a folyamatok izol\u00e1ci\u00f3ja. A v\u00e9delem biztos\u00edthat\u00f3 a t\u00e1mad\u00e1sblokkol\u00f3 al\u00e1\u00edr\u00e1sok hozz\u00e1ad\u00e1s\u00e1val a t\u0171zfalakra \u00e9s behatol\u00e1smegel\u0151z\u0151 rendszerekre, valamint a h\u00e1l\u00f3zati hozz\u00e1f\u00e9r\u00e9s korl\u00e1toz\u00e1s\u00e1val az eszk\u00f6zh\u00f6z kiz\u00e1r\u00f3lag a bels\u0151 biztons\u00e1gi peremen kereszt\u00fcl.<\/p>\n

<\/a><\/noindex><\/p>\n

Forr\u00e1s: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Armis \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\u0431 11 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 (PDF) \u0432 TCP\/IP \u0441\u0442\u0435\u043a\u0435 IPnet, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u043c \u0432 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 VxWorks. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430\u043c \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u043e \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f «URGENT\/11». \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u0434\u043b\u044f \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u0435 \u0430\u0442\u0430\u043a\u0438 \u043f\u0440\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0435 \u0447\u0435\u0440\u0435\u0437 \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u044b\u0435 \u044d\u043a\u0440\u0430\u043d\u044b \u0438 NAT (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0435\u0441\u043b\u0438 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":27438,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-36640","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd4711 t\u00e1volr\u00f3l kihaszn\u00e1lhat\u00f3 sebezhet\u0151s\u00e9get a VxWorks TCP\/IP verem\u00e9ben | ProHoster","description":"Az Armis biztons\u00e1gi kutat\u00f3i nyilv\u00e1noss\u00e1gra hozt\u00e1k az","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/news\/11-udalyonno-ekspluatiruemyh-uyazvimostej-v-tcp-ip-steke-vxworks","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd4711 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 TCP\/IP \u0441\u0442\u0435\u043a\u0435 VxWorks | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Armis \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\u0431","og:url":"https:\/\/prohoster.info\/hu\/blog\/news\/11-udalyonno-ekspluatiruemyh-uyazvimostej-v-tcp-ip-steke-vxworks","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:12:50+00:00","article:modified_time":"2019-10-31T19:12:50+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"36640","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 04:15:12","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 23:17:29","updated":"2026-01-22 04:15:12","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/36640","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=36640"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/36640\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media\/27438"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=36640"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=36640"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=36640"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}