{"id":74131,"date":"2020-03-14T14:42:14","date_gmt":"2020-03-14T11:42:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/obnovite-routeros-na-vashem-mikrotik"},"modified":"2020-03-14T14:42:14","modified_gmt":"2020-03-14T11:42:14","slug":"obnovite-routeros-na-vashem-mikrotik","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/obnovite-routeros-na-vashem-mikrotik","title":{"rendered":"Aktualizujte RouterOS na va\u0161om MikroTik","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Aktualizujte
\nVe\u010der 10. marca za\u010dal podporn\u00fd t\u00edm Mail.ru dost\u00e1va\u0165 s\u0165a\u017enosti od pou\u017e\u00edvate\u013eov na nemo\u017enos\u0165 pripojenia k IMAP\/SMTP serverom Mail.ru cez po\u0161tov\u00e9 programy. Pri tom niektor\u00e9 pripojenia nepre\u0161li a niektor\u00e9 zobrazovali chybu certifik\u00e1tu. Chyba bola sp\u00f4soben\u00e1 t\u00fdm, \u017ee \u201eserver\u201c odosiela samopodpisovan\u00fd certifik\u00e1t TLS.
\n<\/a><\/noindex>\u00a0
\n\"Aktualizujte
\nZa dva dni pri\u0161lo viac ako 10 s\u0165a\u017enost\u00ed od pou\u017e\u00edvate\u013eov z najr\u00f4znej\u0161\u00edch siet\u00ed a s najr\u00f4znej\u0161\u00edmi zariadeniami, \u010do robilo malovravdepodobn\u00fa probl\u00e9m v sieti jedn\u00e9ho poskytovate\u013ea. Podrobnej\u0161ia anal\u00fdza probl\u00e9mu odhalila, \u017ee doch\u00e1dza k podmienke servera imap.mail.ru (ako aj in\u00fdch po\u0161tov\u00fdch serverov a slu\u017eieb) na \u00farovni DNS. \u010ealej, s akt\u00edvnou pomocou na\u0161ich pou\u017e\u00edvate\u013eov, sme zistili, \u017ee pr\u00ed\u010dina spo\u010d\u00edva v nespr\u00e1vnom z\u00e1pise v cache ich routera, ktor\u00fd z\u00e1rove\u0148 funguje ako lok\u00e1lny DNS resolver, pri\u010dom v mnoh\u00fdch (ale nie v\u0161etk\u00fdch) pr\u00edpadoch bolo zariadenie MikroTik, ve\u013emi popul\u00e1rne v mal\u00fdch firemn\u00fdch sie\u0165ach a u mal\u00fdch poskytovate\u013eov internetu.<\/p>\n

V \u010dom je probl\u00e9m<\/h2>\n

\nV septembri 2019 v\u00fdskumn\u00edci objavili <\/a><\/noindex>nieko\u013eko zranite\u013enost\u00ed v MikroTik RouterOS (CVE-2019-3976, CVE-2019-3977, CVE-2019-3978, CVE-2019-3979), ktor\u00e9 umo\u017e\u0148ovali realizova\u0165 \u00fatok DNS cache poisoning, t.j. mo\u017enos\u0165 zmeny DNS z\u00e1znamov v DNS cache routera, pri\u010dom CVE-2019-3978 umo\u017e\u0148uje \u00fato\u010dn\u00edkovi ne\u010daka\u0165, a\u017e sa niekto z vn\u00fatornej siete obr\u00e1ti na jeho DNS server, aby otr\u00e1vil cache resolvera, ale iniciova\u0165 tak\u00fdto dotaz s\u00e1m cez port 8291 (UDP a TCP). Zranite\u013enos\u0165 bola opraven\u00e1 MikroTik vo verzi\u00e1ch RouterOS 6.45.7 (stable) a 6.44.6 (long-term) 28. okt\u00f3bra 2019, av\u0161ak pod\u013ea v\u00fdskumov <\/a><\/noindex>v\u00e4\u010d\u0161ina pou\u017e\u00edvate\u013eov v s\u00fa\u010dasnej dobe neinstalovala opravy.<\/p>\n

Je zjavn\u00e9, \u017ee t\u00e1to probl\u00e9m je v s\u00fa\u010dasnosti akt\u00edvne zneu\u017e\u00edvan\u00e1 \u201ena\u017eivo\u201c.<\/p>\n

\u010c\u00edm je to nebezpe\u010dn\u00e9<\/h2>\n

\n\u00dato\u010dn\u00edk m\u00f4\u017ee zmeni\u0165 DNS z\u00e1znam ak\u00e9hoko\u013evek hosta, ku ktor\u00e9mu sa pou\u017e\u00edvate\u013e vn\u00fatornej siete obracia, a tak zachyti\u0165 prev\u00e1dzku k nemu. Ak sa citliv\u00e9 inform\u00e1cie pren\u00e1\u0161aj\u00fa bez \u0161ifrovania (napr\u00edklad cez http:\/\/ bez TLS) alebo pou\u017e\u00edvate\u013e s\u00fahlas\u00ed s prijat\u00edm falo\u0161n\u00e9ho certifik\u00e1tu, \u00fato\u010dn\u00edk m\u00f4\u017ee z\u00edska\u0165 v\u0161etky \u00fadaje, ktor\u00e9 sa pren\u00e1\u0161aj\u00fa cez pripojenie, ako napr\u00edklad prihlasovacie meno alebo heslo. Bohu\u017eia\u013e, prax ukazuje, \u017ee ak m\u00e1 pou\u017e\u00edvate\u013e mo\u017enos\u0165 prija\u0165 falo\u0161n\u00fd certifik\u00e1t, vyu\u017eije ju.<\/p>\n

Pre\u010do pr\u00e1ve servery SMTP a IMAP a \u010do chr\u00e1nilo pou\u017e\u00edvate\u013eov<\/h2>\n

\nPre\u010do sa \u00fato\u010dn\u00edci sna\u017eili zachyti\u0165 pr\u00e1ve SMTP\/IMAP prenosy e-mailov\u00fdch aplik\u00e1ci\u00ed a nie webov\u00fd prenos, aj ke\u010f v\u00e4\u010d\u0161ina pou\u017e\u00edvate\u013eov pristupuje k e-mailu cez prehliada\u010d po HTTPS?<\/p>\n

Nie v\u0161etky e-mailov\u00e9 programy funguj\u00face na z\u00e1klade SMTP a IMAP\/POP3 chr\u00e1nia pou\u017e\u00edvate\u013ea pred chybami, ktor\u00fdmi by mohli posla\u0165 svoje prihlasovacie meno a heslo cez nezabezpe\u010den\u00e9 alebo skompromitovan\u00e9 spojenie, hoci pod\u013ea \u0161tandardu RFC 8314<\/a><\/noindex>, prijat\u00e9mu e\u0161te v roku 2018 (a realizovan\u00e9mu v Mail.ru ove\u013ea sk\u00f4r), by mali chr\u00e1ni\u0165 pou\u017e\u00edvate\u013ea pred zachyten\u00edm hesla cez ak\u00e9ko\u013evek nezabezpe\u010den\u00e9 spojenie. Navy\u0161e, zatia\u013e \u010do v e-mailov\u00fdch klientoch sa ve\u013emi zriedka pou\u017e\u00edva protokol OAuth (je podporovan\u00fd e-mailov\u00fdmi servermi Mail.ru), bez neho sa prihlasovacie meno a heslo pren\u00e1\u0161aj\u00fa pri ka\u017edej rel\u00e1cii.<\/p>\n

Prehliada\u010de m\u00f4\u017eu by\u0165 trochu lep\u0161ie chr\u00e1nen\u00e9 pred \u00fatokmi typu Man-in-the-Middle. Na v\u0161etk\u00fdch kritick\u00fdch dom\u00e9nach mail.ru je okrem HTTPS povolen\u00e1 politika HSTS (HTTP strict transport security). Pri zapnutom HSTS modern\u00fd prehliada\u010d ned\u00e1va pou\u017e\u00edvate\u013eovi jednoduch\u00fa mo\u017enos\u0165 prija\u0165 falo\u0161n\u00fd certifik\u00e1t, aj ke\u010f to pou\u017e\u00edvate\u013e chce. Okrem HSTS chr\u00e1nilo pou\u017e\u00edvate\u013eov to, \u017ee od roku 2017 servery SMTP, IMAP a POP3 Mail.ru zakazuj\u00fa prenos hesla cez nezabezpe\u010den\u00e9 spojenie; v\u0161etci na\u0161i pou\u017e\u00edvatelia pou\u017e\u00edvali TLS na pr\u00edstup cez SMTP, POP3 a IMAP, a preto je mo\u017en\u00e9 zachyti\u0165 prihlasovacie meno a heslo len ak sa pou\u017e\u00edvate\u013e rozhodne prija\u0165 zmenen\u00fd certifik\u00e1t.<\/p>\n

Pre mobiln\u00fdch pou\u017e\u00edvate\u013eov v\u017edy odpor\u00fa\u010dame pou\u017e\u00edva\u0165 aplik\u00e1cie Mail.ru na pr\u00edstup k e-mailu, preto\u017ee pr\u00e1ca s e-mailom v nich je bezpe\u010dnej\u0161ia ako v prehliada\u010doch alebo zabudovan\u00fdch SMTP\/IMAP klientoch.<\/p>\n

\u010co je potrebn\u00e9 urobi\u0165<\/h2>\n

\nJe potrebn\u00e9 aktualizova\u0165 firmv\u00e9r MikroTik RouterOS na bezpe\u010dn\u00fa verziu. Ak to z nejak\u00e9ho d\u00f4vodu nie je mo\u017en\u00e9, je potrebn\u00e9 filtrova\u0165 prenosy pod\u013ea portu 8291 (tcp a udp), \u010do s\u0165a\u017e\u00ed vyu\u017e\u00edvanie probl\u00e9mu, aj ke\u010f to neodstr\u00e1ni mo\u017enosti pas\u00edvnej injekcie do DNS cache. Internetov\u00fdm poskytovate\u013eom by malo by\u0165 odpor\u00fa\u010dan\u00e9 filtrova\u0165 tento port vo svojich sie\u0165ach, aby chr\u00e1nili firemn\u00fdch pou\u017e\u00edvate\u013eov.\u00a0<\/p>\n

V\u0161etk\u00fdm pou\u017e\u00edvate\u013eom, ktor\u00ed prijali pozmenen\u00fd certifik\u00e1t, sa d\u00f4razne odpor\u00fa\u010da, aby si okam\u017eite zmenili heslo k e-mailu a in\u00fdm slu\u017eb\u00e1m, pre ktor\u00e9 bol tento certifik\u00e1t prijat\u00fd. My na na\u0161ej strane budeme informova\u0165 pou\u017e\u00edvate\u013eov, ktor\u00ed sa prihlasuj\u00fa do e-mailu cez zranite\u013en\u00e9 zariadenia.<\/p>\n

P.S. Existuje aj s\u00favisiaca zranite\u013enos\u0165, ktor\u00e1 je pop\u00edsan\u00e1 v pr\u00edspevku LukaSafonov<\/a><\/noindex> "Zranite\u013enos\u0165 Backport v RouterOS ohrozuje stovky tis\u00edc zariaden\u00ed<\/a><\/noindex>.
\n
Zdroj: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412\u0435\u0447\u0435\u0440\u043e\u043c 10 \u043c\u0430\u0440\u0442\u0430 \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 Mail.ru \u043d\u0430\u0447\u0430\u043b\u0430 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u0436\u0430\u043b\u043e\u0431\u044b \u043e\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043d\u0430 \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a IMAP\/SMTP \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c Mail.ru \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0447\u0430\u0441\u0442\u044c \u043a\u043e\u043d\u043d\u0435\u043a\u0442\u043e\u0432 \u043d\u0435 \u043f\u0440\u043e\u0445\u043e\u0434\u0438\u043b\u0430, \u0430 \u0447\u0430\u0441\u0442\u044c \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u044e\u0442 \u043e\u0448\u0438\u0431\u043a\u0443 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430. \u041e\u0448\u0438\u0431\u043a\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u0442\u0435\u043c, \u0447\u0442\u043e \u00ab\u0441\u0435\u0440\u0432\u0435\u0440\u00bb \u043e\u0442\u0434\u0430\u0435\u0442 \u0441\u0430\u043c\u043e\u043f\u043e\u0434\u043f\u0438\u0441\u0430\u043d\u044b\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 TLS. \u00a0 \u0417\u0430 \u0434\u0432\u0430 \u0434\u043d\u044f \u043f\u0440\u0438\u0448\u043b\u043e \u0431\u043e\u043b\u0435\u0435 10 \u0436\u0430\u043b\u043e\u0431 \u043e\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0441\u0430\u043c\u044b\u0445 \u0440\u0430\u0437\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":74132,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-74131","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Aktualizujte RouterOS na va\u0161om MikroTik | ProHoster","description":"Ve\u010der 10. marca slu\u017eba podpory Mail.ru za\u010dala.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/obnovite-routeros-na-vashem-mikrotik","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0431\u043d\u043e\u0432\u0438\u0442\u0435 RouterOS \u043d\u0430 \u0432\u0430\u0448\u0435\u043c MikroTik | ProHoster","og:description":"\u0412\u0435\u0447\u0435\u0440\u043e\u043c 10 \u043c\u0430\u0440\u0442\u0430 \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 Mail.ru \u043d\u0430\u0447\u0430\u043b\u0430.","og:url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/obnovite-routeros-na-vashem-mikrotik","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-14T11:42:14+00:00","article:modified_time":"2020-03-14T11:42:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"74131","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:20:27","updated":"2022-09-30 20:30:09","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/74131","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=74131"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/74131\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/74132"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=74131"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=74131"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=74131"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}