{"id":113594,"date":"2024-02-14T22:02:42","date_gmt":"2024-02-14T20:02:42","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-keytrap-i-nsec3-zatragivayushhie-bolshinstvo-realizaczij-dnssec"},"modified":"2024-02-14T22:02:42","modified_gmt":"2024-02-14T20:02:42","slug":"uyazvimosti-keytrap-i-nsec3-zatragivayushhie-bolshinstvo-realizaczij-dnssec","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-keytrap-i-nsec3-zatragivayushhie-bolshinstvo-realizaczij-dnssec","title":{"rendered":"Vulnerabilit\u0103\u021bile KeyTrap \u0219i NSEC3, care afecteaz\u0103 majoritatea implement\u0103rilor DNSSEC","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>\u00cen diferitele implement\u0103ri ale protocolului DNSSEC au fost identificate dou\u0103 vulnerabilit\u0103\u021bi care afecteaz\u0103 rezolverele DNS BIND, PowerDNS, dnsmasq, Knot Resolver \u0219i Unbound. Vulnerabilit\u0103\u021bile permit provocarea unui atac de tip denial of service asupra rezolverelor DNS care efectueaz\u0103 validarea utiliz\u00e2nd DNSSEC, din cauza gener\u0103rii unei sarcini mari pe CPU, care \u00eempiedic\u0103 procesarea altor cereri. Pentru a efectua un atac, este suficient s\u0103 se trimit\u0103 c\u0103tre un rezolver DNS care folose\u0219te DNSSEC o cerere care duce la interogarea unei zone DNS special concepute pe serverul atacatorului.      <\/p>\n<p>Problemele identificate:  <\/p>\n<ul>\n<li class=\"l\"> CVE-2023-50387 (nume de cod KeyTrap) \u2014 accesarea zonelor DNS special concepute duce la o \u00eentrerupere a serviciului din cauza gener\u0103rii unei \u00eenc\u0103rc\u0103ri semnificative pe CPU \u0219i a unei perioade lungi de verificare DNSSEC. Pentru a efectua un atac, este necesar s\u0103 se g\u0103zduiasc\u0103 pe un server DNS controlat de atacator o zon\u0103 de domeniu cu set\u0103ri mali\u021bioase \u0219i s\u0103 se ob\u021bin\u0103 accesul la aceast\u0103 zon\u0103 de c\u0103tre un server DNS recursiv, a c\u0103rui disponibilitate este compromis\u0103 de atacator.\n<p>Configur\u0103rile d\u0103un\u0103toare constau \u00een utilizarea pentru zon\u0103 a unei combina\u021bii de chei conflictuale \u00eentre ele, \u00eenregistr\u0103ri RRSET \u0219i semn\u0103turi digitale. \u00cencercarea de verificare utiliz\u00e2nd aceste chei duce la executarea unor opera\u021biuni consumatoare de resurse, care pot \u00eenc\u0103rca complet CPU-ul \u0219i bloca procesarea altor cereri (de exemplu, s-a afirmat c\u0103 \u00een timpul unui atac asupra BIND, procesarea altor cereri a fost oprit\u0103 timp de 16 ore).      <\/p>\n<li class=\"l\"> CVE-2023-50868 (nume de cod NSEC3) \u2014 o \u00eentrerupere a serviciului din cauza realiz\u0103rii unor calcule semnificative pentru generarea hash-urilor \u00een \u00eenregistr\u0103rile NSEC3 (Next Secure v3) atunci c\u00e2nd se proceseaz\u0103 r\u0103spunsuri DNSSEC special concepute. Metoda de atac este similar\u0103 cu prima vulnerabilitate, cu excep\u021bia faptului c\u0103 pe serverul DNS al atacatorului se creeaz\u0103 un set de \u00eenregistr\u0103ri NSEC3 RRSET special conceput.      <\/ul>\n<p>Se observ\u0103 c\u0103 apari\u021bia vulnerabilit\u0103\u021bilor men\u021bionate mai sus este cauzat\u0103 de definirea \u00een specifica\u021bia DNSSEC a posibilit\u0103\u021bii de a trimite serverului DNS toate cheile criptografice disponibile, \u00een condi\u021biile \u00een care rezolverele trebuie s\u0103 proceseze orice chei primite, p\u00e2n\u0103 c\u00e2nd verificarea nu se finalizeaz\u0103 cu succes sau toate cheile primite nu sunt verificate.    <\/p>\n<p>Pentru a bloca vulnerabilit\u0103\u021bile din rezolvatoare, num\u0103rul maxim de chei DNSSEC implicate \u00een procesul de construire a lan\u021bului de \u00eencredere este limitat, la fel ca num\u0103rul maxim de calcule ale hash-urilor pentru NSEC3, iar tentativele de verificare pentru fiecare RRSET (combina\u021bii de chei \u0219i semn\u0103turi) \u0219i fiecare r\u0103spuns sunt, de asemenea, limitate. <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/ro\/server\/dts-los-angeles\/\"   title=\"server\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"3614\">server<\/a>.     <\/p>\n<p>Vulnerabilit\u0103\u021bile au fost remediate \u00een actualiz\u0103rile Unbound (1.19.1), PowerDNS Recursor (4.8.6, 4.9.3, 5.0.2), Knot Resolver (5.7.1), dnsmasq (2.90) \u0219i BIND (9.16.48, 9.18.24 \u0219i 9.19.21). Statutul remedierii vulnerabilit\u0103\u021bilor \u00een distribu\u021bii poate fi evaluat pe paginile urm\u0103toare: Debian, Ubuntu, SUSE, RHEL, Fedora, Arch Linux, Gentoo, Slackware, NetBSD, FreeBSD.            <\/p>\n<p>\u00cen versiunile serverului DNS BIND 9.16.48, 9.18.24 \u0219i 9.19.21 au fost corectate \u0219i alte c\u00e2teva vulnerabilit\u0103\u021bi:  <\/p>\n<ul>\n<li class=\"l\"> CVE-2023-4408 \u2014 analiza mesajelor DNS mari poate duce la generarea unei \u00eenc\u0103rc\u0103ri ridicate pe CPU.\n<li class=\"l\"> CVE-2023-5517 \u2014 solicitarea unei zone inverse special concepute poate duce la o terminare nea\u0219teptat\u0103 din cauza declan\u0219\u0103rii unei verific\u0103ri assert. Problema apare doar \u00een configura\u021biile cu setarea \u201enxdomain-redirect\u201d activat\u0103.\n<li class=\"l\"> CVE-2023-5679 \u2014 determinarea recursiv\u0103 a gazdelor poate duce la o terminare nea\u0219teptat\u0103 din cauza declan\u0219\u0103rii unei verific\u0103ri assert pe sistemele cu suport activat pentru DNS64 \u0219i \u201eserve-stale\u201d (set\u0103rile stale-cache-enable \u0219i stale-answer-enable).\n<li class=\"l\"> CVE-2023-6516 \u2014 solicit\u0103rile recursive special concepute pot duce la epuizarea memoriei disponibile procesului.    <\/ul>\n<p>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=60599\">opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 DNSSEC \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0435 DNS-\u0440\u0435\u0437\u043e\u043b\u0432\u0435\u0440\u044b BIND, PowerDNS, dnsmasq, Knot Resolver \u0438 Unbound. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043e\u0442\u043a\u0430\u0437\u0430 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438 DNS-\u0440\u0435\u0437\u043e\u043b\u0432\u0435\u0440\u043e\u0432, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u044e\u0449\u0438\u0445 \u0432\u0430\u043b\u0438\u0434\u0430\u0446\u0438\u044e \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 DNSSEC, \u0438\u0437-\u0437\u0430 \u0432\u043e\u0437\u043d\u0438\u043a\u043d\u043e\u0432\u0435\u043d\u0438\u044f \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043d\u0430 CPU, \u043c\u0435\u0448\u0430\u044e\u0449\u0435\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0434\u0440\u0443\u0433\u0438\u0445 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432. \u0414\u043b\u044f \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u043d\u0430 DNS-\u0440\u0435\u0437\u043e\u043b\u0432\u0435\u0440, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0439 DNSSEC, \u0437\u0430\u043f\u0440\u043e\u0441, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0438\u0439 \u043a \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044e \u043a \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0439 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-113594","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 DNSSEC \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0435 DNS-\u0440\u0435\u0437\u043e\u043b\u0432\u0435\u0440\u044b BIND, PowerDNS, dnsmasq, Knot Resolver \u0438 Unbound.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-keytrap-i-nsec3-zatragivayushhie-bolshinstvo-realizaczij-dnssec\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 KeyTrap \u0438 NSEC3, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0435 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0439 DNSSEC | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 DNSSEC \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0435 DNS-\u0440\u0435\u0437\u043e\u043b\u0432\u0435\u0440\u044b BIND, PowerDNS, dnsmasq, Knot Resolver \u0438 Unbound.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-keytrap-i-nsec3-zatragivayushhie-bolshinstvo-realizaczij-dnssec\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2024-02-14T20:02:42+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2024-02-14T20:02:42+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilit\u0103\u021bile KeyTrap \u0219i NSEC3, care afecteaz\u0103 cele mai multe implement\u0103ri DNSSEC | ProHoster","description":"\u00cen diverse implement\u0103ri ale protocolului DNSSEC au fost identificate dou\u0103 vulnerabilit\u0103\u021bi care afecteaz\u0103 rezolvatoarele DNS BIND, PowerDNS, dnsmasq, Knot Resolver \u0219i Unbound.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-keytrap-i-nsec3-zatragivayushhie-bolshinstvo-realizaczij-dnssec","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 KeyTrap \u0438 NSEC3, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0435 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0439 DNSSEC | ProHoster","og:description":"\u0412 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 DNSSEC \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0435 DNS-\u0440\u0435\u0437\u043e\u043b\u0432\u0435\u0440\u044b BIND, PowerDNS, dnsmasq, Knot Resolver \u0438 Unbound.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-keytrap-i-nsec3-zatragivayushhie-bolshinstvo-realizaczij-dnssec","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-02-14T20:02:42+00:00","article:modified_time":"2024-02-14T20:02:42+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"113594","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-22 15:29:23","updated":"2026-02-22 15:29:23","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/113594","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=113594"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/113594\/revisions"}],"predecessor-version":[{"id":162142,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/113594\/revisions\/162142"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=113594"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=113594"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=113594"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}