{"id":73151,"date":"2020-03-07T14:42:03","date_gmt":"2020-03-07T11:42:03","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-pppd-i-lwip-pozvolyayushhaya-udalyonno-vypolnit-kod-s-pravami-root"},"modified":"2020-03-07T14:42:03","modified_gmt":"2020-03-07T11:42:03","slug":"uyazvimost-v-pppd-i-lwip-pozvolyayushhaya-udalyonno-vypolnit-kod-s-pravami-root","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-pppd-i-lwip-pozvolyayushhaya-udalyonno-vypolnit-kod-s-pravami-root","title":{"rendered":"O vulnerabilitate \u00een pppd \u0219i lwIP permite executarea de cod de la distan\u021b\u0103 cu privilegii de root","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00cen pachetul pppd a fost identificat\u0103<\/a><\/noindex> vulnerabilitatea<\/a><\/noindex> (CVE-2020-8597<\/a><\/noindex>), permite executarea propriului cod prin trimiterea de cereri de autentificare special formulate c\u0103tre sisteme care utilizeaz\u0103 protocolul PPP (Point-to-Point Protocol) sau PPPoE (PPP over Ethernet). Aceste protocoale sunt utilizate de obicei de furnizorii de servicii pentru a organiza conexiuni prin Ethernet sau DSL, \u0219i sunt de asemenea folosite \u00een unele VPN-uri (de exemplu, pptpd \u0219i openfortivpn<\/a><\/noindex>). Pentru a verifica expunerea sistemelor dumneavoastr\u0103 la aceast\u0103 problem\u0103 preg\u0103tit<\/a><\/noindex> prototipul exploatului.<\/p>\n

Vulnerabilitatea este provocat\u0103 de un overflow de buffer \u00een implementarea protocolului de autentificare EAP (Extensible Authentication Protocol). Atacul poate fi efectuat \u00eenainte de autentificare, prin trimiterea unui pachet de tip EAPT_MD5CHAP, care con\u021bine un nume de gazd\u0103 foarte lung, ce nu \u00eencap \u00een buffer-ul alocat. Duplicatul din codul de verificare a dimensiunii c\u00e2mpului rhostname permite atacatorului s\u0103 scrie date dincolo de buffer \u00een stiv\u0103, reu\u0219ind astfel s\u0103 execute codul s\u0103u de la distan\u021b\u0103 cu privilegii de root. Vulnerabilitatea se manifest\u0103 at\u00e2t pe partea serverului, c\u00e2t \u0219i pe client, adic\u0103 nu numai serverul poate fi atacat, ci \u0219i clientul care \u00eencearc\u0103 s\u0103 se conecteze la un server controlat de atacator (de exemplu, un atacator poate sparge mai \u00eent\u00e2i serverul prin vulnerabilitate \u0219i apoi \u00eencepe s\u0103 afecteze clien\u021bii conecta\u021bi).<\/p>\n

Problema afecteaz\u0103 versiunile pppd<\/a><\/noindex> de la 2.4.2 la 2.4.8 inclusiv \u0219i a fost remediat\u0103 sub forma patch<\/a><\/noindex>. Vulnerabilitatea este de asemenea implic\u0103<\/a><\/noindex> stiv\u0103 lwIP<\/a><\/noindex>, dar \u00een configura\u021bia implicit\u0103 \u00een lwIP, suportul EAP nu este activat.<\/p>\n

Starea remedierii problemei \u00een distribu\u021bii poate fi consultat\u0103 pe aceste pagini: Debian<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, RHEL<\/a><\/noindex>, Fedora<\/a><\/noindex>, SUSE<\/a><\/noindex>, OpenWRT<\/a><\/noindex>, Arch<\/a><\/noindex>, NetBSD<\/a><\/noindex>. \u00cen RHEL, OpenWRT \u0219i SUSE, pachetul pppd este compilat cu activarea protec\u021biei \u201eStack Smashing Protection\u201d (modul \u201e-fstack-protector\u201d \u00een gcc), ceea ce limiteaz\u0103 exploatarea prin c\u0103dere. Pe l\u00e2ng\u0103 distribu\u021bii, vulnerabilitatea a fost confirmat\u0103 \u0219i \u00een unele produse. Cisco<\/a><\/noindex> (CallManager), TP-LINK<\/a><\/noindex> \u0219i Synology (DiskStation Manager, VisualStation VS960HD \u0219i Router Manager), care folosesc cod pppd sau lwIP.<\/p>\n

<\/a><\/noindex><\/p>\n

Sursa: opennet.ro<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043f\u0430\u043a\u0435\u0442\u0435 pppd \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-8597), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0441\u0432\u043e\u0439 \u043a\u043e\u0434 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u043d\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u043a \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u043c \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b PPP (Point-to-Point Protocol) \u0438\u043b\u0438 PPPoE (PPP over Ethernet). \u0414\u0430\u043d\u043d\u044b\u0435 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u044b \u043e\u0431\u044b\u0447\u043d\u043e \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u044e\u0442\u0441\u044f \u043f\u0440\u043e\u0432\u0430\u0439\u0434\u0435\u0440\u0430\u043c\u0438 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0447\u0435\u0440\u0435\u0437 Ethernet \u0438\u043b\u0438 DSL, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0432 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445 VPN (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, pptpd \u0438 openfortivpn). \u0414\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u043d\u043e\u0441\u0442\u0438 \u0441\u0432\u043e\u0438\u0445 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-73151","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Vulnerabilitate \u00een pppd \u0219i lwIP, care permite executarea de cod de la distan\u021b\u0103 cu privilegii de root | ProHoster","description":"O vulnerabilitate a fost descoperit\u0103 \u00een pachetul pppd.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-pppd-i-lwip-pozvolyayushhaya-udalyonno-vypolnit-kod-s-pravami-root","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 pppd \u0438 lwIP, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root | ProHoster","og:description":"\u0412 \u043f\u0430\u043a\u0435\u0442\u0435 pppd \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-pppd-i-lwip-pozvolyayushhaya-udalyonno-vypolnit-kod-s-pravami-root","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-07T11:42:03+00:00","article:modified_time":"2020-03-07T11:42:03+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"73151","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:38:40","updated":"2022-09-28 04:48:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/73151","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=73151"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/73151\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=73151"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=73151"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=73151"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}