{"id":103950,"date":"2022-05-04T15:37:02","date_gmt":"2022-05-04T13:37:03","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-uclibc-i-uclibc-ng-pozvolyayushhaya-podmenit-dannye-v-keshe-dns"},"modified":"2022-05-04T15:37:02","modified_gmt":"2022-05-04T13:37:03","slug":"uyazvimost-v-uclibc-i-uclibc-ng-pozvolyayushhaya-podmenit-dannye-v-keshe-dns","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/news\/uyazvimost-v-uclibc-i-uclibc-ng-pozvolyayushhaya-podmenit-dannye-v-keshe-dns","title":{"rendered":"Vulnerabilit\u00e0 in uClibc e uClibc-ng che consente di modificare i dati nella cache DNS.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Nelle librerie standard C uClibc e uClibc-ng, utilizzate in molti dispositivi embedded e portatili, \u00e8 stata rilevata una vulnerabilit\u00e0 (CVE non assegnato) che consente di inserire dati falsi nella cache DNS, che possono essere utilizzati per sostituire l'indirizzo IP di un dominio a piacere e reindirizzare le richieste al dominio su un server di un attaccante.     <\/p>\n<p>Il problema riguarda vari firmware Linux per router, punti di accesso e dispositivi IoT, cos\u00ec come distribuzioni Linux per sistemi embedded come OpenWRT e Embedded Gentoo. Si osserva che la vulnerabilit\u00e0 si manifesta in dispositivi di molti produttori (ad esempio, uClibc \u00e8 usato nei firmware di Linksys, Netgear e Axis), ma poich\u00e9 uClibc e uClibc-ng non hanno ancora corretto la vulnerabilit\u00e0, i dettagli specifici riguardanti i dispositivi e i produttori nei cui prodotti \u00e8 presente il problema non sono attualmente divulgati.    <\/p>\n<p>La vulnerabilit\u00e0 \u00e8 causata dall'uso di identificatori di transazione prevedibili nel codice per l'invio di richieste DNS. L'identificativo della richiesta DNS veniva scelto semplicemente incrementando un contatore senza applicare ulteriore randomizzazione ai numeri di porta, il che consentiva l'avvelenamento della cache DNS tramite l'invio preventivo di pacchetti UDP con risposte false (la risposta viene accettata se arriva prima della risposta reale e include un ID corretto). <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/it\/server\/dts-los-angeles\/\"   title=\"server\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"3809\">server<\/a> A differenza del metodo di Kaminsky proposto nel 2008, l'identificatore di transazione non deve nemmeno essere indovinato, poich\u00e9 \u00e8 inizialmente prevedibile (inizialmente \u00e8 impostato su 1, che viene incrementato con ogni richiesta, e non scelto casualmente).     <center><img decoding=\"async\" alt=\"Vulnerabilit\u00e0 in uClibc e uClibc-ng che consente di modificare i dati nella cache DNS.\" src=\"\/wp-content\/uploads\/2022\/05\/29cd1ae29db2776f3121eda961bd8c4d.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/center>    <\/p>\n<p>Nella specifica per proteggere contro la previsione degli identificatori, si raccomanda di applicare ulteriormente una distribuzione casuale dei numeri di porta di rete di origine da cui vengono inviati i pacchetti DNS, il che compensa la dimensione insufficiente dell'identificatore. Quando viene attivata la randomizzazione delle porte per la composizione di una risposta falsa, \u00e8 necessario indovinare, oltre all'identificatore di 16 bit, anche il numero della porta di rete. In uClibc e uClibc-ng, tale randomizzazione non era esplicitamente integrata (alla chiamata bind non veniva specificata una porta UDP di origine casuale) e il suo utilizzo dipendeva dalle impostazioni del sistema operativo.     <\/p>\n<p>Disattivando la randomizzazione del flusso, l'identificazione dell'identificatore di richiesta incrementale \u00e8 considerata un compito banale. Ma anche in caso di randomizzazione, un attaccante deve solo indovinare la porta di rete da un intervallo di 32768\u201360999, per il quale pu\u00f2 utilizzare l'invio massiccio simultaneo di risposte fittizie su diverse porte di rete.    <center><img decoding=\"async\" alt=\"Vulnerabilit\u00e0 in uClibc e uClibc-ng che consente di modificare i dati nella cache DNS.\" src=\"\/wp-content\/uploads\/2022\/05\/ba16f63c3eab657ee687a893744ae972.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/center>      <\/p>\n<p>Il problema \u00e8 stato confermato in tutte le versioni attuali di uClibc e uClibc-ng, comprese le versioni pi\u00f9 recenti di uClibc 0.9.33.2 e uClibc-ng 1.0.40. A settembre 2021, le informazioni sulla vulnerabilit\u00e0 sono state inviate a CERT\/CC per coordinare la preparazione delle patch. A gennaio 2022, i dettagli sul problema sono stati comunicati a oltre 200 produttori che collaborano con CERT\/CC. A marzo, \u00e8 stato tentato di contattare separatamente il progetto uClibc-ng, ma hanno risposto di non essere in grado di risolvere autonomamente la vulnerabilit\u00e0 e hanno raccomandato di divulgare pubblicamente le informazioni sul problema, sperando di ricevere assistenza dalla comunit\u00e0 per sviluppare una patch. Tra i produttori, NETGEAR ha annunciato il rilascio di un aggiornamento per risolvere la vulnerabilit\u00e0.<br \/>\n<br \/>Fonte: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=57131\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0445 \u0421\u0438-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 uClibc \u0438 uClibc-ng, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0445 \u0432\u043e \u043c\u043d\u043e\u0433\u0438\u0445 \u0432\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0438 \u043f\u043e\u0440\u0442\u0430\u0442\u0438\u0432\u043d\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE \u043d\u0435 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0444\u0438\u043a\u0442\u0438\u0432\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u0432 \u043a\u044d\u0448 DNS, \u0447\u0442\u043e \u043c\u043e\u0436\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u043f\u043e\u0434\u043c\u0435\u043d\u044b \u0432 \u043a\u044d\u0448\u0435 IP-\u0430\u0434\u0440\u0435\u0441\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u043c\u0435\u043d\u0430 \u0438 \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u0439 \u043a \u0434\u043e\u043c\u0435\u043d\u0443 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 Linux-\u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0438 \u0434\u043b\u044f \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u043e\u0432, \u0442\u043e\u0447\u0435\u043a \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0430-\u0432\u0435\u0449\u0435\u0439, \u0430 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":103951,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-103950","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0445 \u0421\u0438-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 uClibc \u0438 uClibc-ng, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0445 \u0432\u043e \u043c\u043d\u043e\u0433\u0438\u0445 \u0432\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0438 \u043f\u043e\u0440\u0442\u0430\u0442\u0438\u0432\u043d\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE \u043d\u0435 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0444\u0438\u043a\u0442\u0438\u0432\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u0432 \u043a\u044d\u0448 DNS, \u0447\u0442\u043e \u043c\u043e\u0436\u043d\u043e.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/it\/blog\/news\/uyazvimost-v-uclibc-i-uclibc-ng-pozvolyayushhaya-podmenit-dannye-v-keshe-dns\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"it_IT\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 uClibc \u0438 uClibc-ng, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u0434\u043c\u0435\u043d\u0438\u0442\u044c \u0434\u0430\u043d\u043d\u044b\u0435 \u0432 \u043a\u044d\u0448\u0435 DNS | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0445 \u0421\u0438-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 uClibc \u0438 uClibc-ng, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0445 \u0432\u043e \u043c\u043d\u043e\u0433\u0438\u0445 \u0432\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0438 \u043f\u043e\u0440\u0442\u0430\u0442\u0438\u0432\u043d\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE \u043d\u0435 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0444\u0438\u043a\u0442\u0438\u0432\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u0432 \u043a\u044d\u0448 DNS, \u0447\u0442\u043e \u043c\u043e\u0436\u043d\u043e.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/it\/blog\/news\/uyazvimost-v-uclibc-i-uclibc-ng-pozvolyayushhaya-podmenit-dannye-v-keshe-dns\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2022-05-04T13:37:03+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2022-05-04T13:37:03+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilit\u00e0 in uClibc e uClibc-ng che consente di alterare i dati nella cache DNS | ProHoster","description":"Nelle librerie standard C uClibc e uClibc-ng, utilizzate in molti dispositivi embedded e portatili, \u00e8 stata identificata una vulnerabilit\u00e0 (CVE non assegnato) che consente di inserire dati fasulli nella cache DNS, il che \u00e8 possibile.","canonical_url":"https:\/\/prohoster.info\/it\/blog\/news\/uyazvimost-v-uclibc-i-uclibc-ng-pozvolyayushhaya-podmenit-dannye-v-keshe-dns","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 uClibc \u0438 uClibc-ng, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u0434\u043c\u0435\u043d\u0438\u0442\u044c \u0434\u0430\u043d\u043d\u044b\u0435 \u0432 \u043a\u044d\u0448\u0435 DNS | ProHoster","og:description":"\u0412 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0445 \u0421\u0438-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 uClibc \u0438 uClibc-ng, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0445 \u0432\u043e \u043c\u043d\u043e\u0433\u0438\u0445 \u0432\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0438 \u043f\u043e\u0440\u0442\u0430\u0442\u0438\u0432\u043d\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE \u043d\u0435 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0444\u0438\u043a\u0442\u0438\u0432\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u0432 \u043a\u044d\u0448 DNS, \u0447\u0442\u043e \u043c\u043e\u0436\u043d\u043e.","og:url":"https:\/\/prohoster.info\/it\/blog\/news\/uyazvimost-v-uclibc-i-uclibc-ng-pozvolyayushhaya-podmenit-dannye-v-keshe-dns","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-05-04T13:37:03+00:00","article:modified_time":"2022-05-04T13:37:03+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"103950","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-22 16:01:28","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-05-04 13:37:57","updated":"2026-02-22 16:01:28","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/103950","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=103950"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/103950\/revisions"}],"predecessor-version":[{"id":162337,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/103950\/revisions\/162337"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media\/103951"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=103950"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=103950"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=103950"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}