{"id":94510,"date":"2020-09-18T01:41:56","date_gmt":"2020-09-17T23:41:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/realizacziya-kontrollera-domena-v-samba-okazalas-podverzhena-uyazvimosti-zerologin"},"modified":"2020-09-18T01:41:56","modified_gmt":"2020-09-17T23:41:56","slug":"realizacziya-kontrollera-domena-v-samba-okazalas-podverzhena-uyazvimosti-zerologin","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/realizacziya-kontrollera-domena-v-samba-okazalas-podverzhena-uyazvimosti-zerologin","title":{"rendered":"A domain controller implementation in Samba has been found to be vulnerable to the ZeroLogin exploit","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

The developers of the Samba project warned<\/a><\/noindex> users that recently identified<\/a><\/noindex> in Windows the ZeroLogin vulnerability (CVE-2020-1472<\/a><\/noindex>) manifests<\/a><\/noindex> and in the domain controller implementation based on Samba. The vulnerability is caused by<\/a><\/noindex> shortcomings in the MS-NRPC protocol and the AES-CFB8 cryptographic algorithm, and upon successful exploitation allows an attacker to gain administrator access to the domain controller.<\/p>\n

A sebezhet\u0151s\u00e9g l\u00e9nyege, hogy az MS-NRPC (Netlogon Remote Protocol) protokoll lehet\u0151v\u00e9 teszi, hogy a hiteles\u00edt\u00e9si adatok cser\u00e9jekor visszal\u00e9pj\u00fcnk a titkos\u00edtatlan RPC-kapcsolatok haszn\u00e1lat\u00e1ra. Ezt k\u00f6vet\u0151en a t\u00e1mad\u00f3 kihaszn\u00e1lhatja az AES-CFB8 algoritmus hib\u00e1j\u00e1t a sikeres rendszerbejelentkez\u00e9s hamis\u00edt\u00e1s\u00e1ra. Az adminisztr\u00e1tori jogosults\u00e1gokkal val\u00f3 bel\u00e9p\u00e9shez \u00e1tlagosan k\u00f6r\u00fclbel\u00fcl 256 hamis\u00edt\u00e1st kell v\u00e9grehajtani. A t\u00e1mad\u00e1shoz nem sz\u00fcks\u00e9ges m\u0171k\u00f6d\u0151 felhaszn\u00e1l\u00f3i fi\u00f3k a domain vez\u00e9rl\u0151\u00f6n; a hamis\u00edt\u00e1si k\u00eds\u00e9rleteket hib\u00e1s jelsz\u00f3val is v\u00e9grehajthatj\u00e1k. Az NTLM-en kereszt\u00fcli hiteles\u00edt\u00e9si k\u00e9r\u00e9s \u00e1tir\u00e1ny\u00edt\u00e1sra ker\u00fcl a domain vez\u00e9rl\u0151re, amely megtagadja a hozz\u00e1f\u00e9r\u00e9st, de a t\u00e1mad\u00f3 m\u00f3dos\u00edthatja ezt a v\u00e1laszt, \u00e9s a c\u00e9lzott rendszer sikeres bejelentkez\u00e9sk\u00e9nt \u00e9rtelmezi azt.<\/p>\n

A Samb\u00e1ban a sebezhet\u0151s\u00e9g csak azokban a rendszerekben jelentkezik, amelyek nem haszn\u00e1lj\u00e1k a \"server schannel = yes\" be\u00e1ll\u00edt\u00e1st, amely a Samba 4.8-t\u00f3l kezdve alap\u00e9rtelmezett. K\u00fcl\u00f6n\u00f6sen a \"server schannel = no\" \u00e9s \"server schannel = auto\" be\u00e1ll\u00edt\u00e1sokkal rendelkez\u0151 rendszerek lehetnek vesz\u00e9lyeztetve, amelyek lehet\u0151v\u00e9 teszik a Samba sz\u00e1m\u00e1ra, hogy ugyanazokat a hib\u00e1kat a AES-CFB8 algoritmusban haszn\u00e1lja, mint a Windows. <\/p>\n

When using a reference exploit prototype prepared for Windows in Samba, only the ServerAuthenticate3 call is triggered, and the ServerPasswordSet2 operation fails (the exploit requires adaptation for Samba). There are no reports on the functionality of alternative exploits (<\/a><\/noindex>). Attempts to trace attacks on systems can be made by analyzing the records mentioning ServerAuthenticate3 and ServerPasswordSet in Samba audit logs.1<\/a><\/noindex>, 2<\/a><\/noindex>, 3<\/a><\/noindex>, 4<\/a><\/noindex>VxLAN factory. Part 3<\/p>\n

<\/a><\/noindex><\/p>\n

Forr\u00e1s: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Samba \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u0447\u0442\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u0430\u044f \u0432 Windows \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c ZeroLogin (CVE-2020-1472) \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0438 \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u0430 \u043d\u0430 \u0431\u0430\u0437\u0435 Samba. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043d\u0435\u0434\u043e\u0440\u0430\u0431\u043e\u0442\u043a\u0430\u043c\u0438 \u0432 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0435 MS-NRPC \u0438 \u043a\u0440\u0438\u043f\u0442\u043e\u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c\u0435 AES-CFB8, \u0438 \u043f\u0440\u0438 \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0432 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0435 \u0434\u043e\u043c\u0435\u043d\u0430. \u0421\u0443\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b MS-NRPC (Netlogon Remote Protocol) \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u0440\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-94510","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"A domain controller implementation in Samba has been found to be vulnerable to the ZeroLogin exploit | ProHoster","description":"\ud83e\udd47A domain controller implementation in Samba has been found to be vulnerable to the ZeroLogin exploit | ProHoster","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/news\/realizacziya-kontrollera-domena-v-samba-okazalas-podverzhena-uyazvimosti-zerologin","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u0430 \u0432 Samba \u043e\u043a\u0430\u0437\u0430\u043b\u0430\u0441\u044c \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 ZeroLogin | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Samba \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u0447\u0442\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e","og:url":"https:\/\/prohoster.info\/hu\/blog\/news\/realizacziya-kontrollera-domena-v-samba-okazalas-podverzhena-uyazvimosti-zerologin","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-09-17T23:41:56+00:00","article:modified_time":"2020-09-17T23:41:56+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"94510","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 11:25:23","updated":"2022-09-29 04:02:07","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/94510","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=94510"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/94510\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=94510"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=94510"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=94510"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}