Kusagadzikana kwakadzama (CVE-2023-32154) kwakaonekwa muRouterOS inoshanda sisitimu inoshandiswa muMikroTik routers, iyo inobvumira mushandisi asina kutenderwa kuita kure kure kodhi pachishandiso nekutumira yakanyatsogadzirwa IPv6 router kushambadzira (RA, Router Advertisement).
Dambudziko rinokonzerwa nekushaikwa kwechokwadi chechokwadi che data rinouya kubva kunze mukuita basa rekugadzirisa IPv6 RA (Router Advertisement) zvikumbiro, izvo zvakaita kuti zvikwanise kunyora data kupfuura miganhu yeiyo yakagoverwa buffer uye kuronga kuitiswa kwekodhi yako. nemidzi ropafadzo. Kusagadzikana kunoonekwa muMikroTik RouterOS v6.xx uye v7.xx mapazi, apo IPv6 RA inogoneswa muzvirongwa zvekugamuchira IPv6 RA mameseji ("ipv6/settings/ set accept-router-advertisements=ehe" kana "ipvXNUMX/settings/ set forward=hapana bvuma-router -advertisements=hongu-kana-kuendesa-yakaremara").
Iko mukana wekushandisa kusagadzikana mukuita kwakaratidzwa pamakwikwi ePwn2Own muToronto, panguva iyo vatsvakurudzi vakaona dambudziko racho vakagamuchira mubairo we $ 100,000 nokuda kwekubira kwematanho akawanda ezvivakwa nekurwisa Mikrotik router uye kuishandisa se. chitubu chekurwisa zvimwe zvikamu zvetiweki yenzvimbo (vapanduki vakazowana kutonga kweCanon printer, ruzivo rwekusagadzikana uko kwakaburitswa pachena).
Ruzivo rwekusagadzikana rwakatanga kuburitswa chigamba chisati chagadzirwa nemugadziri (0-zuva), asi RouterOS 7.9.1, 6.49.8, 6.48.7, 7.10beta8 zvigadziriso zvinogadzirisa kusagadzikana zvakatoburitswa. Zvinoenderana neruzivo kubva kuZDI (Zero Day Initiative) purojekiti, iyo inomhanyisa makwikwi ePwn2Own, mugadziri akaziviswa nezvekusagadzikana kweZvita 29, 2022. Vamiriri veMikroTik vanoti havana kugamuchira chiziviso uye vakangodzidza nezve dambudziko muna Chivabvu 10, mushure mekutumira yambiro yekupedzisira yekuzivisa. Pamusoro pezvo, mushumo wekusagadzikana unotaura kuti ruzivo nezve chimiro chedambudziko rwakataurirwa kumumiriri weMikroTik iye pachake panguva yemakwikwi ePwn2Own muToronto, asi maererano neMikroTik, vashandi veMikroTik havana kutora chikamu muchiitiko chero chipi zvacho.
Source: opennet.ru