{"id":73151,"date":"2020-03-07T14:42:03","date_gmt":"2020-03-07T11:42:03","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-pppd-i-lwip-pozvolyayushhaya-udalyonno-vypolnit-kod-s-pravami-root"},"modified":"2020-03-07T14:42:03","modified_gmt":"2020-03-07T11:42:03","slug":"uyazvimost-v-pppd-i-lwip-pozvolyayushhaya-udalyonno-vypolnit-kod-s-pravami-root","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/news\/uyazvimost-v-pppd-i-lwip-pozvolyayushhaya-udalyonno-vypolnit-kod-s-pravami-root","title":{"rendered":"Vulnerabilit\u00e0 in pppd e lwIP che consente l'esecuzione remota di codice con privilegi di root","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Nel pacchetto pppd identificata<\/a><\/noindex> vulnerabilit\u00e0<\/a><\/noindex> (CVE-2020-8597<\/a><\/noindex>), che consente di eseguire il proprio codice tramite l'invio di richieste di autenticazione opportunamente formattate ai sistemi che utilizzano il protocollo PPP (Point-to-Point Protocol) o PPPoE (PPP over Ethernet). Questi protocolli sono solitamente utilizzati dai provider per organizzare le connessioni tramite Ethernet o DSL e sono utilizzati anche in alcune VPN (ad esempio, pptpd e openfortivpn<\/a><\/noindex>). Per verificare la vulnerabilit\u00e0 dei propri sistemi a questo problema \u00e8 preparato<\/a><\/noindex> prototipo di exploit.<\/p>\n

La vulnerabilit\u00e0 \u00e8 causata da un buffer overflow nell'implementazione del protocollo di autenticazione EAP (Extensible Authentication Protocol). L'attacco pu\u00f2 essere effettuato prima dell'autenticazione mediante l'invio di un pacchetto di tipo EAPT_MD5CHAP, contenente un nome host molto lungo che non rientra nel buffer dedicato. A causa di un errore nella verifica della dimensione del campo rhostname, l'attaccante pu\u00f2 sovrascrivere i dati al di fuori del buffer nello stack e ottenere l'esecuzione remota del proprio codice con privilegi di root. La vulnerabilit\u00e0 si manifesta sia sul lato server che sul lato client, quindi pu\u00f2 essere attaccato non solo il server, ma anche il client che cerca di connettersi a un server controllato dall'attaccante (ad esempio, l'attaccante pu\u00f2 prima compromettere il server tramite la vulnerabilit\u00e0 e poi iniziare a colpire i clienti che si connettono).<\/p>\n

Il problema riguarda le versioni pppd<\/a><\/noindex> dalla 2.4.2 alla 2.4.8 inclusa ed \u00e8 stato risolto nella forma patch<\/a><\/noindex>. La vulnerabilit\u00e0 \u00e8 stata confermata anche in i processori AMD, per i quali non si manifesta il vettore di attacco principale. I metodi di mitigazione gi\u00e0 implementati contro le vulnerabilit\u00e0 Spectre e Meltdown non proteggono dall'attacco SWAPGS utilizzando processori Intel, ma sono gi\u00e0 state proposte delle patch per Linux, ChromeOS, Android e Windows.<\/a><\/noindex> stack lwIP<\/a><\/noindex>, ma nella configurazione predefinita di lwIP il supporto EAP non \u00e8 abilitato.<\/p>\n

Lo stato della correzione del problema nelle distribuzioni pu\u00f2 essere visualizzato su queste pagine: Debian<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, RHEL<\/a><\/noindex>, Fedora<\/a><\/noindex>, SUSE<\/a><\/noindex>, OpenWRT<\/a><\/noindex>, Arch<\/a><\/noindex>, NetBSD<\/a><\/noindex>. In RHEL, OpenWRT e SUSE, il pacchetto pppd \u00e8 compilato con la protezione \"Stack Smashing Protection\" (modalit\u00e0 \"-fstack-protector\" in gcc), che limita l'utilizzo delle vulnerabilit\u00e0 derivanti da crash. Oltre alle distribuzioni, la vulnerabilit\u00e0 \u00e8 stata confermata anche in alcuni prodotti. Cisco<\/a><\/noindex> (CallManager), TP-LINK<\/a><\/noindex> e Synology (DiskStation Manager, VisualStation VS960HD e Router Manager), che utilizzano codice pppd o lwIP.<\/p>\n

<\/a><\/noindex><\/p>\n

Fonte: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043f\u0430\u043a\u0435\u0442\u0435 pppd \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-8597), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0441\u0432\u043e\u0439 \u043a\u043e\u0434 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u043d\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u043a \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u043c \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b PPP (Point-to-Point Protocol) \u0438\u043b\u0438 PPPoE (PPP over Ethernet). \u0414\u0430\u043d\u043d\u044b\u0435 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u044b \u043e\u0431\u044b\u0447\u043d\u043e \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u044e\u0442\u0441\u044f \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u0430\u043c\u0438 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0447\u0435\u0440\u0435\u0437 Ethernet \u0438\u043b\u0438 DSL, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0432 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 VPN (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, pptpd \u0438 openfortivpn). \u0414\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u043d\u043e\u0441\u0442\u0438 \u0441\u0432\u043e\u0438\u0445 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-73151","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Vulnerabilit\u00e0 in pppd e lwIP, che consentono l'esecuzione remota di codice con privilegi di root | ProHoster","description":"\u00c8 stata identificata una vulnerabilit\u00e0 nel pacchetto pppd.","canonical_url":"https:\/\/prohoster.info\/it\/blog\/news\/uyazvimost-v-pppd-i-lwip-pozvolyayushhaya-udalyonno-vypolnit-kod-s-pravami-root","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 pppd \u0438 lwIP, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root | ProHoster","og:description":"\u0412 \u043f\u0430\u043a\u0435\u0442\u0435 pppd \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c.","og:url":"https:\/\/prohoster.info\/it\/blog\/news\/uyazvimost-v-pppd-i-lwip-pozvolyayushhaya-udalyonno-vypolnit-kod-s-pravami-root","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-07T11:42:03+00:00","article:modified_time":"2020-03-07T11:42:03+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"73151","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:38:40","updated":"2022-09-28 04:48:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/73151","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=73151"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/73151\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=73151"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=73151"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=73151"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}