{"id":85612,"date":"2020-06-17T19:42:36","date_gmt":"2020-06-17T17:42:36","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/19-udalyonno-ekspluatiruemyh-uyazvimostej-v-tcp-ip-steke-treck"},"modified":"2020-06-17T19:42:36","modified_gmt":"2020-06-17T17:42:36","slug":"19-udalyonno-ekspluatiruemyh-uyazvimostej-v-tcp-ip-steke-treck","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/19-udalyonno-ekspluatiruemyh-uyazvimostej-v-tcp-ip-steke-treck","title":{"rendered":"19 vzdialene zneu\u017eite\u013en\u00fdch zranite\u013enost\u00ed v TCP\/IP stacku Treck","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Vo vlastnom TCP\/IP z\u00e1sobn\u00edku Treck<\/a><\/noindex> zisten\u00e9<\/a><\/noindex> 19 zranite\u013enost\u00ed<\/a><\/noindex>, ktor\u00e9 s\u00fa zneu\u017e\u00edvan\u00e9 prostredn\u00edctvom odosielania \u0161peci\u00e1lne upraven\u00fdch paketov. Zranite\u013enostiam bolo priraden\u00e9 k\u00f3dov\u00e9 meno Ripple20<\/a><\/noindex>. Niektor\u00e9 zranite\u013enosti sa tie\u017e prejavuj\u00fa v TCP\/IP z\u00e1sobn\u00edku KASAGO spolo\u010dnosti Zuken Elmic (Elmic Systems), ktor\u00fd m\u00e1 spolo\u010dn\u00e9 korene s Treck. Z\u00e1sobn\u00edk Treck sa pou\u017e\u00edva v mnoh\u00fdch priemyseln\u00fdch, medic\u00ednskych, komunika\u010dn\u00fdch, zabudovan\u00fdch a spotrebn\u00fdch zariadeniach (od inteligentn\u00fdch \u017eiaroviek po tla\u010diarne a zdroje nepreru\u0161ovan\u00e9ho nap\u00e1jania), ako aj v energetickom, dopravnom, leteckom, obchodnom a ropnom vybaven\u00ed. <\/p>\n

\"19<\/a><\/noindex><\/center><\/p>\n

Medzi v\u00fdznamn\u00e9 ciele \u00fatokov, v ktor\u00fdch sa pou\u017e\u00edva TCP\/IP z\u00e1sobn\u00edk Treck, patr\u00ed sie\u0165ov\u00e9 tla\u010diarne HP a \u010dipy Intel. Probl\u00e9my v TCP\/IP z\u00e1sobn\u00edku Treck sa uk\u00e1zali by\u0165 pr\u00ed\u010dinou ned\u00e1vnych \u010fal\u0161\u00edch zranite\u013enost\u00ed<\/a><\/noindex> v podsystemoch Intel AMT a ISM, ktor\u00e9 s\u00fa zneu\u017e\u00edvan\u00e9 prostredn\u00edctvom odosielania sie\u0165ov\u00e9ho paketu. Existenciu zranite\u013enost\u00ed potvrdili v\u00fdrobcovia Intel, HP, Hewlett Packard Enterprise, Baxter, Caterpillar, Digi, Rockwell Automation a Schneider Electric. \u010eal\u0161\u00edch
\n66 v\u00fdrobcov<\/a><\/noindex>, ktor\u00fdch produkty pou\u017e\u00edvaj\u00fa TCP\/IP z\u00e1sobn\u00edk Treck, zatia\u013e nereagovalo na probl\u00e9my. 5 v\u00fdrobcov, medzi ktor\u00fdmi je AMD, ozn\u00e1milo, \u017ee ich produkty nie s\u00fa vystaven\u00e9 t\u00fdmto probl\u00e9mom.<\/p>\n

\"19<\/a><\/noindex><\/center><\/p>\n

Probl\u00e9my boli n\u00e1jden\u00e9 v implement\u00e1cii protokolov IPv4, IPv6, UDP, DNS, DHCP, TCP, ICMPv4 a ARP, a s\u00fa sp\u00f4soben\u00e9 nespr\u00e1vnou pr\u00e1cou s parametrami s ve\u013ekos\u0165ou \u00fadajov (pou\u017e\u00edvanie po\u013ea s ve\u013ekos\u0165ou bez overenia skuto\u010dnej ve\u013ekosti \u00fadajov), chybami v overovan\u00ed vstupu, dvojit\u00fdm uvo\u013enen\u00edm pam\u00e4te, \u010d\u00edtan\u00edm z oblasti mimo vyrovn\u00e1vacej pam\u00e4te, cel\u00fdmi \u010d\u00edseln\u00fdmi preplneniami, nespr\u00e1vnou kontrolou pr\u00edstupu a probl\u00e9mami pri spracovan\u00ed re\u0165azcov s nulov\u00fdm odde\u013eova\u010dom. <\/p>\n

Dve najnebezpe\u010dnej\u0161ie probl\u00e9my (CVE-2020-11896, CVE-2020-11897), ktor\u00fdm bol priraden\u00fd stupe\u0148 CVSS 10, umo\u017e\u0148uj\u00fa vykona\u0165 svoj k\u00f3d na zariaden\u00ed prostredn\u00edctvom odosielania \u0161peci\u00e1lne upraven\u00fdch paketov IPv4\/UDP alebo IPv6. Prv\u00fd kritick\u00fd probl\u00e9m sa prejavuje na zariadeniach s podporou IPv4 tunelov, a druh\u00fd vo verzi\u00e1ch vydan\u00fdch pred 04.06.2009 s podporou IPv6. \u010eal\u0161ia kritick\u00e1 zranite\u013enos\u0165 (CVSS 9) sa nach\u00e1dza v DNS resolveri (CVE-2020-11901) a umo\u017e\u0148uje vykonanie k\u00f3du prostredn\u00edctvom odosielania \u0161peci\u00e1lne upraven\u00e9ho DNS dotazu (probl\u00e9m bol pou\u017eit\u00fd na demon\u0161tr\u00e1ciu hacku Schneider Electric APC UPS a prejavuje sa na zariadeniach s podporou DNS).<\/p>\n

\u010eal\u0161ie zranite\u013enosti CVE-2020-11898, CVE-2020-11899, CVE-2020-11902, CVE-2020-11903, CVE-2020-11905 umo\u017e\u0148uj\u00fa cez zasielanie \u0161peci\u00e1lne form\u00e1tovan\u00fdch paketov IPv4\/ICMPv4, IPv6OverIPv4, DHCP, DHCPv6 alebo IPv6 z\u00edska\u0165 obsah oblast\u00ed pam\u00e4te syst\u00e9mu. Ostatn\u00e9 probl\u00e9my m\u00f4\u017eu vies\u0165 k v\u00fdpadku slu\u017eieb alebo \u00fanikom zvy\u0161kov\u00fdch \u00fadajov zo syst\u00e9mov\u00fdch vyrovn\u00e1vac\u00edch pam\u00e4t\u00ed.<\/p>\n

V\u00e4\u010d\u0161ina zranite\u013enost\u00ed bola odstr\u00e1nen\u00e1 vo verzii Treck 6.0.1.67 (probl\u00e9m CVE-2020-11897 bol odstr\u00e1nen\u00fd vo verzii 5.0.1.35, CVE-2020-11900 vo verzii 6.0.1.41, CVE-2020-11903 vo verzii 6.0.1.28, CVE-2020-11908 vo verzii 4.7.1.27). Ke\u010f\u017ee pr\u00edprava aktualiz\u00e1ci\u00ed firmv\u00e9ru pre konkr\u00e9tne zariadenia m\u00f4\u017ee trva\u0165 dlho alebo m\u00f4\u017ee by\u0165 nemo\u017en\u00e1 (technol\u00f3gia Treck je na trhu u\u017e viac ako 20 rokov, mnoh\u00e9 zariadenia zostali bez podpory alebo ich je problematick\u00e9 aktualizova\u0165), administr\u00e1torom sa odpor\u00fa\u010da izolova\u0165 problematick\u00e9 zariadenia a nastavi\u0165 na syst\u00e9moch na kontrolu paketov, firewalloch alebo smerova\u010doch normaliz\u00e1ciu alebo blokovanie fragmentovan\u00fdch paketov, zablokova\u0165 IP tunely (IPv6-in-IPv4 a IP-in-IP), zablokova\u0165 \u201esource routing\u201c, aktivova\u0165 kontrolu nespr\u00e1vnych mo\u017enost\u00ed v TCP paketo, blokova\u0165 nepou\u017e\u00edvan\u00e9 riadiace ICMP spr\u00e1vy (MTU Update a Address Mask), zak\u00e1za\u0165 IPv6 multicast a presmerova\u0165 DNS po\u017eiadavky na zabezpe\u010den\u00fd rekurz\u00edvny DNS server.<\/p>\n


\n
\r\n \"Prehrajte\r\n
<\/div>\r\n <\/div><\/center><\/p>\n

<\/a><\/noindex><\/p>\n

Zdroj: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043f\u0440\u043e\u043f\u0440\u0438\u0435\u0442\u0430\u0440\u043d\u043e\u043c TCP\/IP \u0441\u0442\u0435\u043a\u0435 Treck \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 19 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u043e \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f Ripple20. \u041d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0442\u0430\u043a\u0436\u0435 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u0432 TCP\/IP-\u0441\u0442\u0435\u043a\u0435 KASAGO \u043e\u0442 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Zuken Elmic (Elmic Systems), \u0438\u043c\u0435\u044e\u0449\u0435\u043c \u043e\u0431\u0449\u0438\u0435 \u043a\u043e\u0440\u043d\u0438 c Treck. \u0421\u0442\u0435\u043a Treck \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u0432\u043e \u043c\u043d\u043e\u0433\u0438\u0445 \u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u044b\u0445, \u043c\u0435\u0434\u0438\u0446\u0438\u043d\u0441\u043a\u0438\u0445, \u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445, \u0432\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0438 \u043f\u043e\u0442\u0440\u0435\u0431\u0438\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 (\u043e\u0442 \u0443\u043c\u043d\u044b\u0445 \u043b\u0430\u043c\u043f \u0434\u043e \u043f\u0440\u0438\u043d\u0442\u0435\u0440\u043e\u0432 \u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":85613,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-85612","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd4719 vzdialene zneu\u017eite\u013en\u00fdch zranite\u013enost\u00ed v TCP\/IP stacku Treck | ProHoster","description":"V propriet\u00e1rnom TCP\/IP stacku Treck bolo identifikovan\u00fdch","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/19-udalyonno-ekspluatiruemyh-uyazvimostej-v-tcp-ip-steke-treck","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd4719 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 TCP\/IP-\u0441\u0442\u0435\u043a\u0435 Treck | ProHoster","og:description":"\u0412 \u043f\u0440\u043e\u043f\u0440\u0438\u0435\u0442\u0430\u0440\u043d\u043e\u043c TCP\/IP \u0441\u0442\u0435\u043a\u0435 Treck \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/19-udalyonno-ekspluatiruemyh-uyazvimostej-v-tcp-ip-steke-treck","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-17T17:42:36+00:00","article:modified_time":"2020-06-17T17:42:36+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"85612","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 13:55:50","updated":"2022-09-28 01:40:49","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/85612","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=85612"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/85612\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/85613"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=85612"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=85612"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=85612"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}