{"id":100059,"date":"2021-04-29T10:22:42","date_gmt":"2021-04-29T08:22:42","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/obnovlenie-dns-servera-bind-c-ustraneniem-uyazvimosti-dopuskayushhej-udalyonnoe-vypolnenie-koda"},"modified":"2021-04-29T10:22:42","modified_gmt":"2021-04-29T08:22:42","slug":"obnovlenie-dns-servera-bind-c-ustraneniem-uyazvimosti-dopuskayushhej-udalyonnoe-vypolnenie-koda","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/obnovlenie-dns-servera-bind-c-ustraneniem-uyazvimosti-dopuskayushhej-udalyonnoe-vypolnenie-koda","title":{"rendered":"P\u00ebrdit\u00ebsimi i DNS-serverit BIND me eliminimin e nj\u00eb dob\u00ebsie q\u00eb mund\u00ebson ekzekutimin e kodit nga distanca.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Jan\u00eb publikuar p\u00ebrdit\u00ebsime korrigjuese p\u00ebr deg\u00ebt stabil t\u00eb serverit DNS BIND 9.11.31 dhe 9.16.15, si edhe p\u00ebr deg\u00ebn eksperimentale n\u00eb zhvillim 9.17.12. N\u00eb k\u00ebto l\u00ebshime jan\u00eb zgjidhur tre vulnerabilitete, nj\u00ebra prej t\u00eb cilave (CVE-2021-25216) \u00e7on n\u00eb mbushjen e tamponit. N\u00eb sistemet 32-bit, vulnerabiliteti mund t\u00eb shfryt\u00ebzohet p\u00ebr ekzekutimin e kodit n\u00eb distanc\u00eb nga nj\u00eb sulmues p\u00ebrmes d\u00ebrgimit t\u00eb nj\u00eb k\u00ebrkese GSS-TSIG t\u00eb formuar ve\u00e7mas. N\u00eb sistemet 64-bit, problemi kufizohet n\u00eb ndalimin e procesit named. <\/p>\n

Problemi shfaqet vet\u00ebm kur aktivizohet mekanizmi GSS-TSIG, i cili aktivizohet p\u00ebrmes konfiguroj tkey-gssapi-keytab dhe tkey-gssapi-credential. GSS-TSIG \u00ebsht\u00eb i \u00e7aktivizuar n\u00eb konfigurimin e parazgjedhur dhe p\u00ebrdoret zakonisht n\u00eb mjedise t\u00eb p\u00ebrziera, ku BIND kombinohet me kontrolluesit e domain-it Active Directory, apo gjat\u00eb integrimit me Samba. <\/p>\n

Vulnerabiliteti shkaktohet nga nj\u00eb gabim n\u00eb zbatimin e mekanizmit SPNEGO (Simple and Protected GSSAPI Negotiation Mechanism), i p\u00ebrdorur n\u00eb GSSAPI p\u00ebr t\u00eb r\u00ebn\u00eb dakord p\u00ebr metodat e p\u00ebrdorura nga klienti dhe server<\/a> metodat e mbrojtjes. GSSAPI p\u00ebrdoret si nj\u00eb protokoll n\u00eb nivel t\u00eb lart\u00eb p\u00ebr shk\u00ebmbimin e sigurt t\u00eb \u00e7el\u00ebsave duke p\u00ebrdorur zgjerimin GSS-TSIG, i p\u00ebrdorur gjat\u00eb procesit t\u00eb verifikimit t\u00eb p\u00ebrdit\u00ebsimeve dinamike t\u00eb zonave DNS. <\/p>\n

Duke marr\u00eb parasysh q\u00eb jan\u00eb gjetur m\u00eb par\u00eb vulnerabilitete kritike n\u00eb implementimin e brendsh\u00ebm t\u00eb SPNEGO, implementimi i k\u00ebtij protokoli \u00ebsht\u00eb hequr nga baza e kodit t\u00eb BIND 9. P\u00ebr p\u00ebrdoruesit q\u00eb k\u00ebrkojn\u00eb mb\u00ebshtetje p\u00ebr SPNEGO, rekomandohet t\u00eb p\u00ebrdorin nj\u00eb implementim t\u00eb jasht\u00ebm, t\u00eb ofruar nga biblioteka sistemike GSSAPI (ofrohet n\u00eb MIT Kerberos dhe Heimdal Kerberos). <\/p>\n

P\u00ebrdoruesit e versioneve t\u00eb vjetra t\u00eb BIND, si nj\u00eb rrug\u00eb alternative p\u00ebr t\u00eb bllokuar problemin, mund t\u00eb \u00e7aktivizojn\u00eb GSS-TSIG n\u00eb cil\u00ebsimet (parametrat tkey-gssapi-keytab dhe tkey-gssapi-credential) ose t\u00eb rind\u00ebrtojn\u00eb BIND pa mb\u00ebshtetje p\u00ebr mekanizmin SPNEGO (opsioni \u00ab--disable-isc-spnego\u00bb n\u00eb skriptin \u00abconfigure\u00bb). Mund t\u00eb ndihmoni p\u00ebr t'u mbajtur n\u00eb kontakt me p\u00ebrdit\u00ebsimet n\u00eb shp\u00ebrndarjet e m\u00ebposhtme: Debian, SUSE, Ubuntu, Fedora, Arch Linux, FreeBSD, NetBSD. Paketat RHEL dhe ALT Linux nd\u00ebrtohen pa mb\u00ebshtetje t\u00eb integruar p\u00ebr SPNEGO. <\/p>\n

P\u00ebr m\u00eb tep\u00ebr, n\u00eb p\u00ebrdit\u00ebsimet e shqyrtuara BIND jan\u00eb zgjidhur edhe dy vulnerabilitete t\u00eb tjera: <\/p>\n