{"id":113594,"date":"2024-02-14T22:02:42","date_gmt":"2024-02-14T20:02:42","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-keytrap-i-nsec3-zatragivayushhie-bolshinstvo-realizaczij-dnssec"},"modified":"2024-02-14T22:02:42","modified_gmt":"2024-02-14T20:02:42","slug":"uyazvimosti-keytrap-i-nsec3-zatragivayushhie-bolshinstvo-realizaczij-dnssec","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimosti-keytrap-i-nsec3-zatragivayushhie-bolshinstvo-realizaczij-dnssec","title":{"rendered":"Podatno\u015bci KeyTrap i NSEC3, kt\u00f3re dotycz\u0105 wi\u0119kszo\u015bci implementacji DNSSEC","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>W r\u00f3\u017cnych implementacjach protoko\u0142u DNSSEC zidentyfikowano dwie luki, kt\u00f3re dotycz\u0105 resolver\u00f3w DNS BIND, PowerDNS, dnsmasq, Knot Resolver i Unbound. Luki te pozwalaj\u0105 na osi\u0105gni\u0119cie odmowy \u015bwiadczenia us\u0142ug przez resolvery DNS, kt\u00f3re wykonuj\u0105 walidacj\u0119 przy u\u017cyciu DNSSEC, z powodu wzrostu obci\u0105\u017cenia CPU, kt\u00f3re uniemo\u017cliwia przetwarzanie innych zapyta\u0144. Aby przeprowadzi\u0107 atak, wystarczy wys\u0142a\u0107 do resolvera DNS u\u017cywaj\u0105cego DNSSEC zapytanie, kt\u00f3re prowadzi do odwo\u0142ania si\u0119 do specjalnie skonfigurowanej strefy DNS na serwerze atakuj\u0105cego.      <\/p>\n<p>Zidentyfikowane problemy:  <\/p>\n<ul>\n<li class=\"l\"> CVE-2023-50387 (kodowe imi\u0119 KeyTrap) \u2014 odwo\u0142anie do specjalnie skonfigurowanych stref DNS prowadzi do odmowy us\u0142ugi z powodu znacznego obci\u0105\u017cenia CPU i d\u0142ugotrwa\u0142ego wykonywania weryfikacji DNSSEC. Aby przeprowadzi\u0107 atak, nale\u017cy umie\u015bci\u0107 na kontrolowanym przez napastnika serwerze DNS stref\u0119 domeny z z\u0142o\u015bliwymi ustawieniami oraz wymusi\u0107 odwo\u0142anie do tej strefy przez rekurencyjny serwer DNS, kt\u00f3rego odmowy us\u0142ugi dokonuje napastnik.\n<p>Z\u0142o\u015bliwe ustawienia sprowadzaj\u0105 si\u0119 do u\u017cycia dla strefy kombinacji konfliktuj\u0105cych kluczy, rekord\u00f3w RRSET i certyfikat\u00f3w cyfrowych. Pr\u00f3ba weryfikacji z u\u017cyciem tych kluczy prowadzi do wykonywania d\u0142ugotrwa\u0142ych operacji wymagaj\u0105cych du\u017cych zasob\u00f3w, kt\u00f3re mog\u0105 ca\u0142kowicie obci\u0105\u017cy\u0107 CPU i zablokowa\u0107 przetwarzanie innych zapyta\u0144 (na przyk\u0142ad twierdzi si\u0119, \u017ce podczas ataku na BIND uda\u0142o si\u0119 zatrzyma\u0107 przetwarzanie innych zapyta\u0144 na 16 godzin).      <\/p>\n<li class=\"l\"> CVE-2023-50868 (kodowe imi\u0119 NSEC3) \u2014 odmowa us\u0142ugi z powodu przeprowadzania znacznych oblicze\u0144 podczas obliczania haszy w rekordach NSEC3 (Next Secure v3) podczas przetwarzania specjalnie skonfigurowanych odpowiedzi DNSSEC. Metoda ataku przypomina pierwsz\u0105 podatno\u015b\u0107, z t\u0105 r\u00f3\u017cnic\u0105, \u017ce na serwerze DNS napastnika tworzony jest specjalnie skonfigurowany zestaw rekord\u00f3w NSEC3 RRSET.      <\/ul>\n<p>Zauwa\u017cono, \u017ce pojawienie si\u0119 wy\u017cej wymienionych luk jest spowodowane zdefiniowaniem w specyfikacji DNSSEC mo\u017cliwo\u015bci wysy\u0142ania przez serwer DNS wszystkich dost\u0119pnych kluczy kryptograficznych, podczas gdy resolvery powinny przetwarza\u0107 dowolnie otrzymane klucze, dop\u00f3ki weryfikacja nie zako\u0144czy si\u0119 pomy\u015blnie lub wszystkie otrzymane klucze nie zostan\u0105 zweryfikowane.    <\/p>\n<p>Aby zablokowa\u0107 luki w resolverach, ograniczono maksymaln\u0105 liczb\u0119 kluczy DNSSEC u\u017cywanych w procesie budowania \u0142a\u0144cucha zaufania oraz maksymaln\u0105 liczb\u0119 oblicze\u0144 skr\u00f3t\u00f3w dla NSEC3, a tak\u017ce ograniczono ponowne pr\u00f3by weryfikacji dla ka\u017cdego RRSET (kombinacje kluczy i podpis\u00f3w) i ka\u017cdej odpowiedzi. <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/pl\/server\/dts-los-angeles\/\"   title=\"serwery\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"3614\">serwery<\/a>.     <\/p>\n<p>Luki zosta\u0142y usuni\u0119te w aktualizacjach Unbound (1.19.1), PowerDNS Recursor (4.8.6, 4.9.3, 5.0.2), Knot Resolver (5.7.1), dnsmasq (2.90) i BIND (9.16.48, 9.18.24 i 9.19.21). Status usuni\u0119cia luk w dystrybucjach mo\u017cna oceni\u0107 na stronach: Debian, Ubuntu, SUSE, RHEL, Fedora, Arch Linux, Gentoo, Slackware, NetBSD, FreeBSD.            <\/p>\n<p>W wersjach serwera DNS BIND 9.16.48, 9.18.24 i 9.19.21 dodatkowo usuni\u0119to kilka luk:  <\/p>\n<ul>\n<li class=\"l\"> CVE-2023-4408 \u2014 przetwarzanie du\u017cych komunikat\u00f3w DNS mo\u017ce prowadzi\u0107 do znacznego obci\u0105\u017cenia CPU.\n<li class=\"l\"> CVE-2023-5517 \u2014 zapytanie specjalnie skonfigurowanej strefy odwrotnej mo\u017ce prowadzi\u0107 do awaryjnego zako\u0144czenia z powodu uruchomienia weryfikacji assert. Problem wyst\u0119puje tylko w konfiguracjach z w\u0142\u0105czonym ustawieniem \u201enxdomain-redirect\u201d.\n<li class=\"l\"> CVE-2023-5679 \u2014 rekurencyjne ustalanie hosta mo\u017ce prowadzi\u0107 do awaryjnego zako\u0144czenia z powodu uruchomienia weryfikacji assert w systemach z w\u0142\u0105czon\u0105 obs\u0142ug\u0105 DNS64 i \u201eserve-stale\u201d (ustawienia stale-cache-enable i stale-answer-enable).\n<li class=\"l\"> CVE-2023-6516 \u2014 specjalnie skonfigurowane rekurencyjne zapytania mog\u0105 prowadzi\u0107 do wyczerpania dost\u0119pnej pami\u0119ci procesu.    <\/ul>\n<p>\u0179r\u00f3d\u0142o: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=60599\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 DNSSEC \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0435 DNS-\u0440\u0435\u0437\u043e\u043b\u0432\u0435\u0440\u044b BIND, PowerDNS, dnsmasq, Knot Resolver \u0438 Unbound. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043e\u0442\u043a\u0430\u0437\u0430 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438 DNS-\u0440\u0435\u0437\u043e\u043b\u0432\u0435\u0440\u043e\u0432, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u044e\u0449\u0438\u0445 \u0432\u0430\u043b\u0438\u0434\u0430\u0446\u0438\u044e \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 DNSSEC, \u0438\u0437-\u0437\u0430 \u0432\u043e\u0437\u043d\u0438\u043a\u043d\u043e\u0432\u0435\u043d\u0438\u044f \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043d\u0430 CPU, \u043c\u0435\u0448\u0430\u044e\u0449\u0435\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0434\u0440\u0443\u0433\u0438\u0445 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432. \u0414\u043b\u044f \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u043d\u0430 DNS-\u0440\u0435\u0437\u043e\u043b\u0432\u0435\u0440, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0439 DNSSEC, \u0437\u0430\u043f\u0440\u043e\u0441, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0438\u0439 \u043a \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044e \u043a \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0439 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-113594","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 DNSSEC \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0435 DNS-\u0440\u0435\u0437\u043e\u043b\u0432\u0435\u0440\u044b BIND, PowerDNS, dnsmasq, Knot Resolver \u0438 Unbound.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimosti-keytrap-i-nsec3-zatragivayushhie-bolshinstvo-realizaczij-dnssec\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"pl_PL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 KeyTrap \u0438 NSEC3, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0435 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0439 DNSSEC | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 DNSSEC \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0435 DNS-\u0440\u0435\u0437\u043e\u043b\u0432\u0435\u0440\u044b BIND, PowerDNS, dnsmasq, Knot Resolver \u0438 Unbound.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimosti-keytrap-i-nsec3-zatragivayushhie-bolshinstvo-realizaczij-dnssec\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2024-02-14T20:02:42+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2024-02-14T20:02:42+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Luki KeyTrap i NSEC3, dotycz\u0105ce wi\u0119kszo\u015bci implementacji DNSSEC | ProHoster","description":"W r\u00f3\u017cnych implementacjach protoko\u0142u DNSSEC wykryto dwie luki, kt\u00f3re dotycz\u0105 resolver\u00f3w DNS BIND, PowerDNS, dnsmasq, Knot Resolver i Unbound.","canonical_url":"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimosti-keytrap-i-nsec3-zatragivayushhie-bolshinstvo-realizaczij-dnssec","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pl_PL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 KeyTrap \u0438 NSEC3, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0435 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0439 DNSSEC | ProHoster","og:description":"\u0412 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 DNSSEC \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0435 DNS-\u0440\u0435\u0437\u043e\u043b\u0432\u0435\u0440\u044b BIND, PowerDNS, dnsmasq, Knot Resolver \u0438 Unbound.","og:url":"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimosti-keytrap-i-nsec3-zatragivayushhie-bolshinstvo-realizaczij-dnssec","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-02-14T20:02:42+00:00","article:modified_time":"2024-02-14T20:02:42+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"113594","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-22 15:29:23","updated":"2026-02-22 15:29:23","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/113594","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/comments?post=113594"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/113594\/revisions"}],"predecessor-version":[{"id":162142,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/113594\/revisions\/162142"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media?parent=113594"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/categories?post=113594"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/tags?post=113594"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}