{"id":73151,"date":"2020-03-07T14:42:03","date_gmt":"2020-03-07T11:42:03","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-pppd-i-lwip-pozvolyayushhaya-udalyonno-vypolnit-kod-s-pravami-root"},"modified":"2020-03-07T14:42:03","modified_gmt":"2020-03-07T11:42:03","slug":"uyazvimost-v-pppd-i-lwip-pozvolyayushhaya-udalyonno-vypolnit-kod-s-pravami-root","status":"publish","type":"post","link":"https:\/\/prohoster.info\/nl\/blog\/news\/uyazvimost-v-pppd-i-lwip-pozvolyayushhaya-udalyonno-vypolnit-kod-s-pravami-root","title":{"rendered":"Kwetsbaarheid in pppd en lwIP, waardoor code op afstand met rootrechten kan worden uitgevoerd","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>In het pppd-pakket <noindex><a rel=\"nofollow\" href=\"https:\/\/seclists.org\/fulldisclosure\/2020\/Mar\/6\">gedetecteerd<\/a><\/noindex> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.kb.cert.org\/vuls\/id\/782301\/\">kwetsbaarheid<\/a><\/noindex> (<noindex><a rel=\"nofollow\" href=\"https:\/\/security-tracker.debian.org\/tracker\/CVE-2020-8597\">CVE-2020-8597<\/a><\/noindex>), waardoor het mogelijk is om eigen code uit te voeren door speciaal opgestelde authenticatieverzoeken naar systemen te sturen die het PPP-protocol (Point-to-Point Protocol) of PPPoE (PPP over Ethernet) gebruiken. Deze protocollen worden doorgaans door providers gebruikt voor aansluiting via Ethernet of DSL, en worden ook gebruikt in sommige VPN's (bijvoorbeeld pptpd en <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/adrienverge\/openfortivpn\">openfortivpn<\/a><\/noindex>). Voor het controleren van de kwetsbaarheid van uw systemen voor dit probleem <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/marcinguy\/CVE-2020-8597\">voorbereid<\/a><\/noindex>  prototype van de exploit.<\/p>\n<p>De kwetsbaarheid wordt veroorzaakt door een buffer-overloop in de implementatie van het EAP (Extensible Authentication Protocol) authenticatieprotocol. De aanval kan plaatsvinden v\u00f3\u00f3r de authenticatiefase door een pakket met het type EAPT_MD5CHAP te verzenden dat een zeer lange hostnaam bevat, die niet in de toegewezen buffer past. Door een fout in de controlecode van het veld rhostname kan de aanvaller gegevens buiten de buffer op de stack overschrijven en op afstand zijn eigen code met root-rechten uitvoeren. De kwetsbaarheid manifesteert zich aan zowel de server- als de klantzijde, dat wil zeggen, niet alleen de server kan worden aangevallen, maar ook de klant die probeert verbinding te maken met een door de aanvaller gecontroleerde server (bijvoorbeeld kan de aanvaller eerst een server via een kwetsbaarheid hacken en vervolgens de verbinding makende klanten aanvallen).<\/p>\n<p>Het probleem raakt versies <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/paulusmack\/ppp\/\">pppd<\/a><\/noindex> van 2.4.2 tot 2.4.8 inclusief en is verholpen in de vorm van <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/paulusmack\/ppp\/commit\/8d7970b8f3db727fe798b65f3377fe6787575426\">patch<\/a><\/noindex>. De kwetsbaarheid is ook <noindex><a rel=\"nofollow\" href=\"http:\/\/git.savannah.nongnu.org\/cgit\/lwip.git\/commit\/?id=2ee3cbe69c6d2805e64e7cac2a1c1706e49ffd86\">aan<\/a><\/noindex> stack <noindex><a rel=\"nofollow\" href=\"http:\/\/git.savannah.nongnu.org\/cgit\/lwip.git\/tree\/\">lwIP<\/a><\/noindex>, maar in de standaardconfiguratie in lwIP is de ondersteuning voor EAP niet ingeschakeld.<\/p>\n<p> De status van het oplossen van het probleem in de distributies kan op de volgende pagina's worden bekeken: <noindex><a rel=\"nofollow\" href=\"https:\/\/security-tracker.debian.org\/tracker\/CVE-2020-8597\">Debian<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/people.canonical.com\/~ubuntu-security\/cve\/2020\/CVE-2020-8597.html\">Ubuntu<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/bugzilla.redhat.com\/show_bug.cgi?id=CVE-2020-8597\">RHEL<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/bugzilla.redhat.com\/show_bug.cgi?id=1800734\">Fedora<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/bugzilla.suse.com\/show_bug.cgi?id=CVE-2020-8597\">SUSE<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/openwrt.org\/advisory\/2020-02-21-1\">OpenWRT<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/security.archlinux.org\/CVE-2020-8597\">Arch<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"http:\/\/ftp.netbsd.org\/pub\/NetBSD\/packages\/vulns\/pkg-vulnerabilities\">NetBSD<\/a><\/noindex>. In RHEL, OpenWRT en SUSE is het pppd-pakket gecompileerd met ingeschakelde bescherming 'Stack Smashing Protection' ( de '-fstack-protector' modus in gcc), wat het misbruik van storingen beperkt. Naast de distributies is de kwetsbaarheid ook bevestigd in enkele producten. <noindex><a rel=\"nofollow\" href=\"https:\/\/quickview.cloudapps.cisco.com\/quickview\/bug\/CSCvs95534\/\">Cisco<\/a><\/noindex> (CallManager), <noindex><a rel=\"nofollow\" href=\"https:\/\/www.tp-link.com\/en\/support\/faq\/2803\/\">TP-LINK<\/a><\/noindex>  en Synology (DiskStation Manager, VisualStation VS960HD en Router Manager), die gebruik maken van pppd- of lwIP-code.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Bron: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=52498\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u043f\u0430\u043a\u0435\u0442\u0435 pppd \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-8597), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0441\u0432\u043e\u0439 \u043a\u043e\u0434 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u043d\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u043a \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u043c \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b PPP (Point-to-Point Protocol) \u0438\u043b\u0438 PPPoE (PPP over Ethernet). \u0414\u0430\u043d\u043d\u044b\u0435 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u044b \u043e\u0431\u044b\u0447\u043d\u043e \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u044e\u0442\u0441\u044f \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u0430\u043c\u0438 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0447\u0435\u0440\u0435\u0437 Ethernet \u0438\u043b\u0438 DSL, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0432 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 VPN (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, pptpd \u0438 openfortivpn). \u0414\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u043d\u043e\u0441\u0442\u0438 \u0441\u0432\u043e\u0438\u0445 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-73151","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u043f\u0430\u043a\u0435\u0442\u0435 pppd \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/nl\/blog\/news\/uyazvimost-v-pppd-i-lwip-pozvolyayushhaya-udalyonno-vypolnit-kod-s-pravami-root\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"nl_NL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 pppd \u0438 lwIP, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u043f\u0430\u043a\u0435\u0442\u0435 pppd \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/nl\/blog\/news\/uyazvimost-v-pppd-i-lwip-pozvolyayushhaya-udalyonno-vypolnit-kod-s-pravami-root\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-03-07T11:42:03+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-03-07T11:42:03+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kwetsbaarheid in pppd en lwIP, waardoor op afstand code met root-rechten kan worden uitgevoerd | ProHoster","description":"In het pppd-pakket is een kwetsbaarheid ontdekt.","canonical_url":"https:\/\/prohoster.info\/nl\/blog\/news\/uyazvimost-v-pppd-i-lwip-pozvolyayushhaya-udalyonno-vypolnit-kod-s-pravami-root","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"nl_NL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 pppd \u0438 lwIP, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root | ProHoster","og:description":"\u0412 \u043f\u0430\u043a\u0435\u0442\u0435 pppd \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c.","og:url":"https:\/\/prohoster.info\/nl\/blog\/news\/uyazvimost-v-pppd-i-lwip-pozvolyayushhaya-udalyonno-vypolnit-kod-s-pravami-root","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-07T11:42:03+00:00","article:modified_time":"2020-03-07T11:42:03+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"73151","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:38:40","updated":"2022-09-28 04:48:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts\/73151","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/comments?post=73151"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts\/73151\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/media?parent=73151"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/categories?post=73151"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/tags?post=73151"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}