{"id":100059,"date":"2021-04-29T10:22:42","date_gmt":"2021-04-29T08:22:42","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/obnovlenie-dns-servera-bind-c-ustraneniem-uyazvimosti-dopuskayushhej-udalyonnoe-vypolnenie-koda"},"modified":"2021-04-29T10:22:42","modified_gmt":"2021-04-29T08:22:42","slug":"obnovlenie-dns-servera-bind-c-ustraneniem-uyazvimosti-dopuskayushhej-udalyonnoe-vypolnenie-koda","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/obnovlenie-dns-servera-bind-c-ustraneniem-uyazvimosti-dopuskayushhej-udalyonnoe-vypolnenie-koda","title":{"rendered":"P\u00ebrdit\u00ebsimi i serverit DNS BIND me eliminimin e nj\u00eb vulnerabiliteti q\u00eb lejon ekzekutimin e kodit n\u00eb distanc\u00eb","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Jan\u00eb publikuar p\u00ebrdit\u00ebsime korrigjuese p\u00ebr deg\u00ebt stabile t\u00eb serverit DNS BIND 9.11.31 dhe 9.16.15, si dhe p\u00ebr deg\u00ebn eksperimentale n\u00eb zhvillim 9.17.12. N\u00eb l\u00ebshimet e reja jan\u00eb eliminuar tri vulnerabilitete, nj\u00ebra prej t\u00eb cilave (CVE-2021-25216) \u00e7on n\u00eb mbushjen e bufit. N\u00eb sistemet 32-bit, vulnerabiliteti mund t\u00eb shfryt\u00ebzohet p\u00ebr ekzekutimin n\u00eb distanc\u00eb t\u00eb kodit nga nj\u00eb sulmues p\u00ebrmes d\u00ebrgimit t\u00eb nj\u00eb k\u00ebrkese t\u00eb formuar posa\u00e7\u00ebrisht GSS-TSIG. N\u00eb sistemet 64-bit, problemi kufizohet n\u00eb r\u00ebnien e procesit named. <\/p>\n

Problemi manifeston vet\u00ebm kur mekanizmi GSS-TSIG \u00ebsht\u00eb aktivizuar p\u00ebrmes konfigurimeve tkey-gssapi-keytab dhe tkey-gssapi-credential. GSS-TSIG \u00ebsht\u00eb i \u00e7aktivizuar n\u00eb konfigurimin default dhe zakonisht p\u00ebrdoret n\u00eb ambiente t\u00eb p\u00ebrziera, ku BIND kombinohet me kontrollet e domenit Active Directory, ose gjat\u00eb integrimit me Samba. <\/p>\n

Vulnerabiliteti \u00ebsht\u00eb shkaktuar nga nj\u00eb gabim n\u00eb implementimin e mekanizmit SPNEGO (Simple and Protected GSSAPI Negotiation Mechanism), i p\u00ebrdorur n\u00eb GSSAPI p\u00ebr t\u00eb r\u00ebn\u00eb dakord mbi p\u00ebrdorimin e klientit dhe serverin<\/a> metodave t\u00eb mbrojtjes. GSSAPI p\u00ebrdoret si nj\u00eb protokoll n\u00eb nivel t\u00eb lart\u00eb p\u00ebr shk\u00ebmbimin e sigurt t\u00eb \u00e7el\u00ebsave p\u00ebrmes zgjerimit GSS-TSIG, q\u00eb aplikohet gjat\u00eb procesit t\u00eb verifikimit t\u00eb dinamik\u00ebs s\u00eb p\u00ebrdit\u00ebsimeve t\u00eb zonave DNS. <\/p>\n

T\u00eb dh\u00ebnat e rrezikshme t\u00eb shk\u00ebmbimit p\u00ebr implikimin e shfryt\u00ebzimit t\u00eb SPNEGO, gjithashtu jan\u00eb gjetur m\u00eb her\u00ebt; zbatimi i k\u00ebtij protokoli \u00ebsht\u00eb hequr nga baza kode e BIND 9. P\u00ebrdoruesit q\u00eb kan\u00eb nevoj\u00eb p\u00ebr mb\u00ebshtetje SPNEGO rekomandohet t\u00eb p\u00ebrdorin nj\u00eb zbatim t\u00eb jasht\u00ebm, q\u00eb ofrohet nga biblioteka sistemike GSSAPI (e ofruar n\u00eb MIT Kerberos dhe Heimdal Kerberos). <\/p>\n

P\u00ebrdoruesit eVersioneve t\u00eb vjetra BIND mund t\u00eb \u00e7aktivizojn\u00eb GSS-TSIG n\u00eb cil\u00ebsimet e tyre (parametrat tkey-gssapi-keytab dhe tkey-gssapi-credential) si nj\u00eb zgjidhje p\u00ebr t\u00eb bllokuar problemin, ose t\u00eb rikompilojn\u00eb BIND pa mb\u00ebshtetje p\u00ebr mekanizmin SPNEGO (opsioni «—disable-isc-spnego» n\u00eb skriptin «configure»). Mund t\u00eb ndiqni shfaqjen e p\u00ebrdit\u00ebsimeve n\u00eb distribuimet e m\u00ebposhtme: Debian, SUSE, Ubuntu, Fedora, Arch Linux, FreeBSD, NetBSD. Paketat RHEL dhe ALT Linux krijohen pa mb\u00ebshtetje t\u00eb integruar p\u00ebr SPNEGO. <\/p>\n

P\u00ebrve\u00e7 k\u00ebsaj, n\u00eb p\u00ebrdit\u00ebsimet e shqyrtuara t\u00eb BIND jan\u00eb eliminuar dy vulosje t\u00eb tjera: <\/p>\n