{"id":94510,"date":"2020-09-18T01:41:56","date_gmt":"2020-09-17T23:41:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/realizacziya-kontrollera-domena-v-samba-okazalas-podverzhena-uyazvimosti-zerologin"},"modified":"2020-09-18T01:41:56","modified_gmt":"2020-09-17T23:41:56","slug":"realizacziya-kontrollera-domena-v-samba-okazalas-podverzhena-uyazvimosti-zerologin","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/news\/realizacziya-kontrollera-domena-v-samba-okazalas-podverzhena-uyazvimosti-zerologin","title":{"rendered":"A implementa\u00e7\u00e3o do controlador de dom\u00ednio no Samba foi vulner\u00e1vel \u00e0 falha ZeroLogin","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Desenvolvedores do projeto Samba avisaram<\/a><\/noindex> usu\u00e1rios, que recentemente detectada<\/a><\/noindex> na vulnerabilidade ZeroLogin no Windows (CVE-2020-1472<\/a><\/noindex>) se manifesta<\/a><\/noindex> ) e na implementa\u00e7\u00e3o do controlador de dom\u00ednio baseado no Samba. A vulnerabilidade \u00e9 causado<\/a><\/noindex> decorre de falhas no protocolo MS-NRPC e no algoritmo de criptografia AES-CFB8, e, quando explorada com sucesso, permite que um invasor obtenha acesso de administrador no controlador de dom\u00ednio.<\/p>\n

A vulnerabilidade reside no fato de que o protocolo MS-NRPC (Netlogon Remote Protocol) permite que, ao trocar dados de autentica\u00e7\u00e3o, se retorne ao uso de uma conex\u00e3o RPC sem criptografia. Ap\u00f3s isso, um invasor pode explorar uma brecha no algoritmo AES-CFB8 para falsificar um login bem-sucedido. Em m\u00e9dia, s\u00e3o necess\u00e1rias cerca de 256 tentativas de falsifica\u00e7\u00e3o para obter acesso como administrador. Para realizar o ataque, n\u00e3o \u00e9 necess\u00e1rio ter uma conta de trabalho no controlador de dom\u00ednio \u2014 as tentativas de falsifica\u00e7\u00e3o podem ser feitas utilizando uma senha incorreta. A solicita\u00e7\u00e3o de autentica\u00e7\u00e3o via NTLM ser\u00e1 redirecionada para o controlador de dom\u00ednio, que retornar\u00e1 uma recusa de acesso, mas o invasor pode alterar essa resposta, e o sistema atacado considerar\u00e1 o login bem-sucedido.<\/p>\n

No Samba, a vulnerabilidade se manifesta apenas em sistemas que n\u00e3o utilizam a configura\u00e7\u00e3o 'server schannel = yes', que, a partir do Samba 4.8, \u00e9 definida como padr\u00e3o. Em particular, sistemas com as configura\u00e7\u00f5es 'server schannel = no' e 'server schannel = auto' podem estar comprometidos, permitindo que o Samba use as mesmas falhas no algoritmo AES-CFB8 que existem no Windows. <\/p>\n

Ao usar um prot\u00f3tipo de exploit preparado para o Windows , no Samba apenas a chamada ServerAuthenticate3 \u00e9 acionada, e a opera\u00e7\u00e3o ServerPasswordSet2 falha (o exploit requer adapta\u00e7\u00e3o para o Samba). N\u00e3o h\u00e1 informa\u00e7\u00f5es sobre a efic\u00e1cia de exploits alternativos (<\/a><\/noindex>). As tentativas de ataque aos sistemas podem ser rastreadas atrav\u00e9s da an\u00e1lise da presen\u00e7a de registros mencionando ServerAuthenticate3 e ServerPasswordSet nos logs de auditoria do Samba.1<\/a><\/noindex>, 2<\/a><\/noindex>, 3<\/a><\/noindex>, 4<\/a><\/noindex>Os desenvolvedores do projeto Samba alertaram os usu\u00e1rios que recentemente<\/p>\n

<\/a><\/noindex><\/p>\n

Fonte: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Samba \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u0447\u0442\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u0430\u044f \u0432 Windows \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c ZeroLogin (CVE-2020-1472) \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0438 \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u0430 \u043d\u0430 \u0431\u0430\u0437\u0435 Samba. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043d\u0435\u0434\u043e\u0440\u0430\u0431\u043e\u0442\u043a\u0430\u043c\u0438 \u0432 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0435 MS-NRPC \u0438 \u043a\u0440\u0438\u043f\u0442\u043e\u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c\u0435 AES-CFB8, \u0438 \u043f\u0440\u0438 \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0432 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0435 \u0434\u043e\u043c\u0435\u043d\u0430. \u0421\u0443\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b MS-NRPC (Netlogon Remote Protocol) \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u0440\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-94510","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47A implementa\u00e7\u00e3o do controlador de dom\u00ednio no Samba foi vulner\u00e1vel \u00e0 falha ZeroLogin | ProHoster","description":"\ud83e\udd47A implementa\u00e7\u00e3o do controlador de dom\u00ednio no Samba revelou estar vulner\u00e1vel \u00e0 vulnerabilidade ZeroLogin | ProHoster","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/realizacziya-kontrollera-domena-v-samba-okazalas-podverzhena-uyazvimosti-zerologin","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430 \u0434\u043e\u043c\u0435\u043d\u0430 \u0432 Samba \u043e\u043a\u0430\u0437\u0430\u043b\u0430\u0441\u044c \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 ZeroLogin | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Samba \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u0447\u0442\u043e \u043d\u0435\u0434\u0430\u0432\u043d\u043e","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/realizacziya-kontrollera-domena-v-samba-okazalas-podverzhena-uyazvimosti-zerologin","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-09-17T23:41:56+00:00","article:modified_time":"2020-09-17T23:41:56+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"94510","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 11:25:23","updated":"2022-09-29 04:02:07","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/94510","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=94510"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/94510\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=94510"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=94510"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=94510"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}