{"id":113594,"date":"2024-02-14T22:02:42","date_gmt":"2024-02-14T20:02:42","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-keytrap-i-nsec3-zatragivayushhie-bolshinstvo-realizaczij-dnssec"},"modified":"2024-02-14T22:02:42","modified_gmt":"2024-02-14T20:02:42","slug":"uyazvimosti-keytrap-i-nsec3-zatragivayushhie-bolshinstvo-realizaczij-dnssec","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimosti-keytrap-i-nsec3-zatragivayushhie-bolshinstvo-realizaczij-dnssec","title":{"rendered":"Vulnerabilitetet KeyTrap dhe NSEC3, q\u00eb prekin shumic\u00ebn e realizimeve t\u00eb DNSSEC.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
N\u00eb implementimet e ndryshme t\u00eb protokollit DNSSEC jan\u00eb identifikuar dy dob\u00ebsi q\u00eb prekin DNS-resolv\u00e9r\u00ebt BIND, PowerDNS, dnsmasq, Knot Resolver dhe Unbound. Dob\u00ebsit\u00eb lejojn\u00eb q\u00eb t\u00eb shkaktohet nj\u00eb\u62d2ador n\u00eb sh\u00ebrbimin e DNS-resolv\u00e9r\u00ebve q\u00eb kryejn\u00eb validimin p\u00ebrmes DNSSEC, p\u00ebr shkak t\u00eb nj\u00eb ngarkese t\u00eb lart\u00eb n\u00eb CPU, e cila pengon p\u00ebrpunimin e k\u00ebrkesave t\u00eb tjera. P\u00ebr t\u00eb kryer nj\u00eb sulm, mjafton t\u00eb d\u00ebrgohet n\u00eb DNS-resolv\u00e9rin q\u00eb p\u00ebrdor DNSSEC nj\u00eb k\u00ebrkes\u00eb q\u00eb \u00e7on n\u00eb thirrjen e nj\u00eb zone DNS t\u00eb p\u00ebrgatitur posa\u00e7\u00ebrisht n\u00eb serverin e sulmuesit. <\/p>\n
Problemet e zbuluara: <\/p>\n
\n
CVE-2023-50387 (emri kodor KeyTrap) \u2014 synimi p\u00ebr DNS- zona t\u00eb dizajnuara posa\u00e7\u00ebrisht shkakton d\u00ebshtim t\u00eb sh\u00ebrbimit p\u00ebr shkak t\u00eb krijimit t\u00eb nj\u00eb ngarkese t\u00eb konsiderueshme n\u00eb CPU dhe nj\u00eb koh\u00ebzgjatje t\u00eb gjat\u00eb p\u00ebr verifikimin DNSSEC. P\u00ebr t\u00eb kryer sulmin, \u00ebsht\u00eb e nevojshme t\u00eb vendosni nj\u00eb zon\u00eb domain me konfigurime keqdash\u00ebse n\u00eb serverin DNS t\u00eb kontrolluar nga sulmuesi dhe t\u00eb b\u00ebni q\u00eb ky server t\u00eb k\u00ebrkoj\u00eb n\u00eb k\u00ebt\u00eb zon\u00eb nga serveri DNS rekurziv, d\u00ebshtimin e sh\u00ebrbimit t\u00eb t\u00eb cilit e arrin sulmuesi.\n
Konfigurimet e d\u00ebmshme p\u00ebrfshijn\u00eb p\u00ebrdorimin p\u00ebr zon\u00ebn e nj\u00eb kombinimi t\u00eb \u00e7el\u00ebsave, regjistrimeve RRSET dhe n\u00ebnshkrimeve dixhitale q\u00eb konfliktin me nj\u00ebri-tjetrin. P\u00ebrpjekja p\u00ebr t\u00eb verifikuar duke p\u00ebrdorur k\u00ebto \u00e7el\u00ebsa \u00e7on n\u00eb ekzekutimin e operacioneve t\u00eb gjat\u00eb q\u00eb k\u00ebrkojn\u00eb shum\u00eb burime, t\u00eb cilat mund t\u00eb ngarkojn\u00eb plot\u00ebsisht CPU-n\u00eb dhe t\u00eb bllokojn\u00eb p\u00ebrpunimin e k\u00ebrkesave t\u00eb tjera (p\u00ebr shembull, raportohet se gjat\u00eb nj\u00eb sulmi ndaj BIND-it, \u00ebsht\u00eb arritur q\u00eb t\u00eb ndalohet p\u00ebrpunimi i k\u00ebrkesave t\u00eb tjera p\u00ebr 16 or\u00eb). <\/p>\n
CVE-2023-50868 (emri kodor NSEC3) \u2014 d\u00ebshtim i sh\u00ebrbimit p\u00ebr shkak t\u00eb kryerjes s\u00eb llogaritjeve t\u00eb konsiderueshme gjat\u00eb llogaritjes s\u00eb hash-eve n\u00eb sh\u00ebnimet NSEC3 (Next Secure v3) kur p\u00ebrpunohen p\u00ebrgjigjet e dizajnuara posa\u00e7\u00ebrisht DNSSEC. Metoda e sulmit \u00ebsht\u00eb e ngjashme me dob\u00ebsin\u00eb e par\u00eb, p\u00ebrve\u00e7 faktit se n\u00eb serverin DNS t\u00eb sulmuesit krijohet nj\u00eb set i dizajnuar posa\u00e7\u00ebrisht i regjistrimeve NSEC3 RRSET. <\/ul>\n
V\u00ebren se shfaqja e dob\u00ebsive t\u00eb p\u00ebrmendura m\u00eb sip\u00ebr \u00ebsht\u00eb shkaktuar nga p\u00ebrcaktimi n\u00eb specifikimin e DNSSEC t\u00eb mund\u00ebsis\u00eb p\u00ebr t\u00eb d\u00ebrguar nga serveri DNS t\u00eb gjitha \u00e7el\u00ebsat kriptografik\u00eb t\u00eb disponuesh\u00ebm, p\u00ebr aq sa resolv\u00e9r\u00ebt duhet t\u00eb p\u00ebrpunojn\u00eb \u00e7do \u00e7el\u00ebs t\u00eb marr\u00eb, derisa verifikimi t\u00eb p\u00ebrfundoj\u00eb me sukses ose t\u00eb kontrollohen t\u00eb gjitha \u00e7el\u00ebsat e marr\u00eb. <\/p>\n
Si masat p\u00ebr bllokimin e vulnerabiliteteve n\u00eb rezolvert, numri maksimal i \u00e7elzave DNSSEC t\u00eb angazhuar n\u00eb procesin e nd\u00ebrtimit t\u00eb zinxhirit t\u00eb besimit \u00ebsht\u00eb i kufizuar, si dhe numri maksimal i llogaritjeve t\u00eb hash-it p\u00ebr NSEC3, si dhe p\u00ebrs\u00ebritjet e provave p\u00ebr \u00e7do RRSET (kombinimet e \u00e7elzave dhe n\u00ebnshkrimeve) dhe \u00e7do p\u00ebrgjigje. server\u00eb<\/a>. <\/p>\n