{"id":100059,"date":"2021-04-29T10:22:42","date_gmt":"2021-04-29T08:22:42","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/obnovlenie-dns-servera-bind-c-ustraneniem-uyazvimosti-dopuskayushhej-udalyonnoe-vypolnenie-koda"},"modified":"2021-04-29T10:22:42","modified_gmt":"2021-04-29T08:22:42","slug":"obnovlenie-dns-servera-bind-c-ustraneniem-uyazvimosti-dopuskayushhej-udalyonnoe-vypolnenie-koda","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/obnovlenie-dns-servera-bind-c-ustraneniem-uyazvimosti-dopuskayushhej-udalyonnoe-vypolnenie-koda","title":{"rendered":"Actualizare a serverului DNS BIND cu remedierea unei vulnerabilit\u0103\u021bi care permite execu\u021bia de cod de la distan\u021b\u0103","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Au fost publicate actualiz\u0103ri corective pentru versiunile stabile ale serverului DNS BIND 9.11.31 \u0219i 9.16.15, precum \u0219i pentru ramura experimental\u0103 aflat\u0103 \u00een dezvoltare 9.17.12. \u00cen noile eliber\u0103ri au fost remediate trei vulnerabilit\u0103\u021bi, dintre care una (CVE-2021-25216) duce la o dep\u0103\u0219ire a buffer-ului. Pe sistemele pe 32 de bi\u021bi, vulnerabilitatea poate fi exploatat\u0103 pentru executarea de cod de la distan\u021b\u0103 de c\u0103tre un atacator prin trimiterea unei cereri GSS-TSIG preg\u0103tite special. Pe sistemele pe 64 de bi\u021bi, problema se limiteaz\u0103 la blocarea procesului named.      <\/p>\n<p>Problema apare doar c\u00e2nd este activat mecanismul GSS-TSIG, activat prin set\u0103rile tkey-gssapi-keytab \u0219i tkey-gssapi-credential. GSS-TSIG este dezactivat \u00een configura\u021bia implicit\u0103 \u0219i este de obicei utilizat \u00een medii mixte, unde BIND este combinat cu controlere de domeniu Active Directory sau \u00een integrarea cu Samba.       <\/p>\n<p>Vulnerabilitatea este cauzat\u0103 de o eroare \u00een implementarea mecanismului SPNEGO (Simple and Protected GSSAPI Negotiation Mechanism), utilizat \u00een GSSAPI pentru negocierea protocoalelor utilizate de client \u0219i <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/ro\/server\/dts-prohoster\/\"   title=\"serverul\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"3007\">serverul<\/a> metode de protec\u021bie. GSSAPI este folosit ca protocol de nivel \u00eenalt pentru schimbul securizat de chei prin intermediul extensiei GSS-TSIG, utilizat\u0103 \u00een procesul de autentificare a actualiz\u0103rilor dinamice ale zonelor DNS.         <\/p>\n<p>Deoarece vulnerabilit\u0103\u021bile critice \u00een implementarea \u00eencorporat\u0103 a SPNEGO au fost descoperite \u0219i \u00een trecut, implementarea acestui protocol a fost eliminat\u0103 din baza de cod BIND 9. Pentru utilizatorii care au nevoie de suport pentru SPNEGO, se recomand\u0103 utilizarea unei implement\u0103ri externe, furnizat\u0103 de biblioteca de sistem GSSAPI (disponibil\u0103 \u00een MIT Kerberos \u0219i Heimdal Kerberos).     <\/p>\n<p>Utilizatorii versiunilor mai vechi de BIND pot, ca o solu\u021bie temporar\u0103 pentru a evita problema, s\u0103 dezactiveze GSS-TSIG \u00een set\u0103ri (parametrii tkey-gssapi-keytab \u0219i tkey-gssapi-credential) sau s\u0103 recompilateze BIND f\u0103r\u0103 suport pentru mecanismul SPNEGO (op\u021biunea &#171;&#8212;disable-isc-spnego&#187; \u00een scriptul &#171;configure&#187;). Po\u021bi urm\u0103ri apari\u021bia actualiz\u0103rilor \u00een distribu\u021bii pe paginile: Debian, SUSE, Ubuntu, Fedora, Arch Linux, FreeBSD, NetBSD. Pachetele RHEL \u0219i ALT Linux sunt compilate f\u0103r\u0103 suport \u00eencorporat pentru SPNEGO.              <\/p>\n<p>\u00cen plus, actualiz\u0103rile in discu\u021bie pentru BIND au rezolvat \u00eenc\u0103 dou\u0103 vulnerabilit\u0103\u021bi:  <\/p>\n<ul>\n<li class=\"l\"> CVE-2021-25215 &#8212; pr\u0103bu\u0219irea procesului named \u00een timpul proces\u0103rii \u00eenregistr\u0103rilor DNAME (redirec\u021bionarea proces\u0103rii unei p\u0103r\u021bi a subdomeniilor), ceea ce duce la ad\u0103ugarea de duplicate \u00een sec\u021biunea ANSWER. Exploatarea vulnerabilit\u0103\u021bii pe serverele DNS autoritate necesit\u0103 modific\u0103ri \u00een zonele DNS procesate, iar pentru cele recursive <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/ro\/server\/\"   title=\"servere\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"1576\">servere<\/a> \u00eenregistrarea problematic\u0103 poate fi ob\u021binut\u0103 dup\u0103 contactarea unui server autoritativ.\n<li class=\"l\"> CVE-2021-25214 &#8212; pr\u0103bu\u0219irea procesului named \u00een timpul proces\u0103rii unei cereri de intrare IXFR (folosit\u0103 pentru transmiterea incremental\u0103 a modific\u0103rilor \u00eentre serverele DNS). Problema afecteaz\u0103 doar sistemele care au permis transmiterea zonelor DNS de pe serverul atacator (de obicei, transmiterea zonelor este utilizat\u0103 pentru sincronizarea serverelor master \u0219i slave \u0219i este permis\u0103 selectiv doar pentru serverele de \u00eencredere). Ca o solu\u021bie temporar\u0103 de protec\u021bie, se poate dezactiva suportul pentru IXFR prin setarea &#171;request-ixfr no;&#187;.    <\/ul>\n<p>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=55042\">opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u044b\u0445 \u0432\u0435\u0442\u043e\u043a DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 BIND 9.11.31 \u0438 9.16.15, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043d\u0430\u0445\u043e\u0434\u044f\u0449\u0435\u0439\u0441\u044f \u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 9.17.12. \u0412 \u043d\u043e\u0432\u044b\u0445 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0442\u0440\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043e\u0434\u043d\u0430 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 (CVE-2021-25216) \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u0431\u0443\u0444\u0435\u0440\u0430. \u041d\u0430 32-\u0440\u0430\u0437\u0440\u044f\u0434\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0437\u0430\u043f\u0440\u043e\u0441\u0430 GSS-TSIG. \u041d\u0430 64-\u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043a\u0440\u0430\u0445\u043e\u043c [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-100059","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u044b\u0445 \u0432\u0435\u0442\u043e\u043a DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 BIND 9.11.31 \u0438 9.16.15, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043d\u0430\u0445\u043e\u0434\u044f\u0449\u0435\u0439\u0441\u044f \u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 9.17.12.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/news\/obnovlenie-dns-servera-bind-c-ustraneniem-uyazvimosti-dopuskayushhej-udalyonnoe-vypolnenie-koda\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 BIND c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0435\u0439 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u044b\u0445 \u0432\u0435\u0442\u043e\u043a DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 BIND 9.11.31 \u0438 9.16.15, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043d\u0430\u0445\u043e\u0434\u044f\u0449\u0435\u0439\u0441\u044f \u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 9.17.12.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/news\/obnovlenie-dns-servera-bind-c-ustraneniem-uyazvimosti-dopuskayushhej-udalyonnoe-vypolnenie-koda\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2021-04-29T08:22:42+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2021-04-29T08:22:42+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Actualizare a serverului DNS BIND cu corectarea unei vulnerabilit\u0103\u021bi care permite execu\u021bia de cod de la distan\u021b\u0103 | ProHoster","description":"Au fost publicate actualiz\u0103ri corective pentru ramurile stabile ale serverului DNS BIND 9.11.31 \u0219i 9.16.15, precum \u0219i pentru ramura experimental\u0103 aflat\u0103 \u00een dezvoltare 9.17.12.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/obnovlenie-dns-servera-bind-c-ustraneniem-uyazvimosti-dopuskayushhej-udalyonnoe-vypolnenie-koda","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 BIND c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0435\u0439 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u044b\u0445 \u0432\u0435\u0442\u043e\u043a DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 BIND 9.11.31 \u0438 9.16.15, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043d\u0430\u0445\u043e\u0434\u044f\u0449\u0435\u0439\u0441\u044f \u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 9.17.12.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/obnovlenie-dns-servera-bind-c-ustraneniem-uyazvimosti-dopuskayushhej-udalyonnoe-vypolnenie-koda","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-04-29T08:22:42+00:00","article:modified_time":"2021-04-29T08:22:42+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"100059","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-04-29 08:30:36","updated":"2026-02-09 21:46:37","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/100059","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=100059"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/100059\/revisions"}],"predecessor-version":[{"id":160288,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/100059\/revisions\/160288"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=100059"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=100059"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=100059"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}