{"id":74131,"date":"2020-03-14T14:42:14","date_gmt":"2020-03-14T11:42:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/obnovite-routeros-na-vashem-mikrotik"},"modified":"2020-03-14T14:42:14","modified_gmt":"2020-03-14T11:42:14","slug":"obnovite-routeros-na-vashem-mikrotik","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/obnovite-routeros-na-vashem-mikrotik","title":{"rendered":"P\u00ebrdit\u00ebsoni RouterOS n\u00eb MikroTik tuaj","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"P\u00ebrdit\u00ebsoni
\nM\u00eb 10 mars, n\u00eb mbr\u00ebmje, sh\u00ebrbimi i mb\u00ebshtetjes s\u00eb Mail.ru filloi t\u00eb merrte ankesa nga p\u00ebrdoruesit p\u00ebr pamund\u00ebsin\u00eb e lidhjes me server\u00ebt IMAP\/SMTP t\u00eb Mail.ru p\u00ebrmes programeve t\u00eb post\u00ebs elektronike. Disa lidhje nuk kalonin, nd\u00ebrsa disa tregonin nj\u00eb gabim t\u00eb certifikat\u00ebs. Gabimi shkaktohet nga fakti se \"serveri\" jep nj\u00eb certifikat\u00eb vet\u00eb-n\u00ebnshkruese TLS.
\n<\/a><\/noindex>\u00a0
\n\"P\u00ebrdit\u00ebsoni
\nGjat\u00eb dy dit\u00ebve, erdh\u00ebn m\u00eb shum\u00eb se 10 ankesa nga p\u00ebrdorues t\u00eb ndrysh\u00ebm nga rrjete t\u00eb ndryshme dhe me pajisje t\u00eb ndryshme, duke e b\u00ebr\u00eb t\u00eb pamundur q\u00eb problemi t\u00eb ishte n\u00eb rrjetin e ndonj\u00eb provajderi t\u00eb vet\u00ebm. Nj\u00eb analiz\u00eb m\u00eb e detajuar e problemit zbuloi se kishte nj\u00eb z\u00ebvend\u00ebsim t\u00eb serverit imap.mail.ru (ashtu si dhe t\u00eb tjer\u00eb server\u00eb dhe sh\u00ebrbime t\u00eb post\u00ebs) n\u00eb nivelin DNS. M\u00eb pas, me ndihm\u00ebn aktive t\u00eb p\u00ebrdoruesve tan\u00eb, ne gjet\u00ebm se shkaku ishte nj\u00eb sh\u00ebnim i gabuar n\u00eb cache-in e ruterit t\u00eb tyre, i cili p\u00ebrve\u00e7 k\u00ebsaj funksionon si nj\u00eb zgjidh\u00ebs lokal DNS, dhe q\u00eb n\u00eb shum\u00eb (por jo t\u00eb gjitha) raste doli t\u00eb ishte pajisja MikroTik, shum\u00eb e popullarizuar n\u00eb rrjetet e vogla korporative dhe te provajder\u00ebt e vegj\u00ebl t\u00eb Internetit.<\/p>\n

Cila \u00ebsht\u00eb problemi<\/h2>\n

\nN\u00eb shtator 2019, studiuesit gjet\u00ebm <\/a><\/noindex>disa vulnerabilitete n\u00eb MikroTik RouterOS (CVE-2019-3976, CVE-2019-3977, CVE-2019-3978, CVE-2019-3979), q\u00eb lejonin nj\u00eb sulm t\u00eb helmit t\u00eb cache-it DNS, dmth. mund\u00ebsin\u00eb p\u00ebr t\u00eb z\u00ebvend\u00ebsuar sh\u00ebnimet DNS n\u00eb cache-in e ruterit, dhe CVE-2019-3978 lejon sulmuesin q\u00eb t\u00eb mos pres\u00eb q\u00eb dikush nga rrjeti i brendsh\u00ebm t\u00eb lidhet p\u00ebr nj\u00eb sh\u00ebnim n\u00eb serverin e tij DNS, p\u00ebr t\u00eb helmuar cache-in e zgjidh\u00ebsit, por t\u00eb inicijoj\u00eb nj\u00eb k\u00ebrkes\u00eb p\u00ebrmes portit 8291 (UDP dhe TCP) vet\u00eb. Vulnerabiliteti u rregullua nga MikroTik n\u00eb versionet RouterOS 6.45.7 (stable) dhe 6.44.6 (long-term) m\u00eb 28 tetor 2019, por sipas studimeve <\/a><\/noindex>shumica e p\u00ebrdoruesve n\u00eb k\u00ebt\u00eb moment nuk i kishin instaluar patch-et.<\/p>\n

\u00cbsht\u00eb e qart\u00eb se tani ky problem po eksploatohet aktivisht \"n\u00eb jet\u00ebt\".<\/p>\n

\u00c7far\u00eb rreziku paraqet<\/h2>\n

\nSulmuesi mund t\u00eb z\u00ebvend\u00ebsoj\u00eb sh\u00ebnimin DNS t\u00eb \u00e7do hosti q\u00eb p\u00ebrdoruesi i rrjetit t\u00eb brendsh\u00ebm i qaset, duke k\u00ebshtu kapur trafikun p\u00ebr t\u00eb. N\u00ebse informacioni sensitv transmetohet pa enkriptim (p\u00ebr shembull n\u00eb http:\/\/ pa TLS) ose p\u00ebrdoruesi pranon t\u00eb marr\u00eb nj\u00eb certifikat\u00eb t\u00eb rreme, sulmuesi mund t\u00eb marr\u00eb t\u00eb gjitha t\u00eb dh\u00ebnat q\u00eb d\u00ebrgohen p\u00ebrmes lidhjes, p\u00ebr shembull emrin e p\u00ebrdoruesit ose fjal\u00ebkalimin. Fatkeq\u00ebsisht, praktika tregon se n\u00ebse p\u00ebrdoruesit kan\u00eb mund\u00ebsin\u00eb t\u00eb pranojn\u00eb nj\u00eb certifikat\u00eb t\u00eb rreme, ata e shfryt\u00ebzojn\u00eb at\u00eb.<\/p>\n

Pse vet\u00ebm server\u00ebt SMTP dhe IMAP, dhe \u00e7far\u00eb i shp\u00ebtoi p\u00ebrdoruesve<\/h2>\n

\nPse sulmuesit p\u00ebrpiqeshin t\u00eb kapnin pik\u00ebrisht trafikun SMTP\/IMAP t\u00eb programeve t\u00eb post\u00ebs, dhe jo trafikun e webit, p\u00ebrkund\u00ebr faktit se shumica e p\u00ebrdoruesve hyjn\u00eb n\u00eb post\u00eb p\u00ebrmes nj\u00eb shfletuesi n\u00eb HTTPS?<\/p>\n

Jo t\u00eb gjith\u00eb programet e post\u00ebs q\u00eb funksionojn\u00eb me SMTP dhe IMAP\/POP3 mbrojn\u00eb p\u00ebrdoruesin nga gabimet, duke mos lejuar t\u00eb d\u00ebrgojn\u00eb emrin e p\u00ebrdoruesit dhe fjal\u00ebkalimin p\u00ebrmes nj\u00eb lidhjeje t\u00eb pasigurt ose t\u00eb kompromentuar, ndon\u00ebse sipas standardit RFC 8314<\/a><\/noindex>, i miratuar n\u00eb vitin 2018 (dhe i implementuar n\u00eb Mail.ru shum\u00eb m\u00eb her\u00ebt), ata duhet t\u00eb mbrojn\u00eb p\u00ebrdoruesin nga kapja e fjal\u00ebkalimit p\u00ebrmes \u00e7do lidhjeje t\u00eb pa siguruar. P\u00ebr m\u00eb tep\u00ebr, nd\u00ebrsa n\u00eb klient\u00ebt e post\u00ebs rrall\u00eb p\u00ebrdoret protokolli OAuth (ai p\u00ebrkrah\u00ebt nga server\u00ebt e post\u00ebs Mail.ru), pa t\u00eb, emri i p\u00ebrdoruesit dhe fjal\u00ebkalimi d\u00ebrgohen n\u00eb \u00e7do seanc\u00eb.<\/p>\n

Shfletuesit mund t\u00eb jen\u00eb pak m\u00eb mir\u00eb t\u00eb mbrojtur nga sulmet Man-in-the-Middle. N\u00eb t\u00eb gjitha domenet kritike t\u00eb mail.ru, p\u00ebrve\u00e7 HTTPS \u00ebsht\u00eb aktivizuar politika HSTS (siguria e transportit t\u00eb ngurt\u00eb HTTP). Kur HSTS \u00ebsht\u00eb aktivizuar, shfletuesi modern nuk i jep p\u00ebrdoruesit mund\u00ebsin\u00eb e leht\u00eb p\u00ebr t\u00eb pranuar nj\u00eb certifikat\u00eb t\u00eb rreme, edhe n\u00ebse p\u00ebrdoruesi d\u00ebshiron. P\u00ebrve\u00e7 HSTS, p\u00ebrdoruesit shp\u00ebtojn\u00eb nga fakti se q\u00eb nga viti 2017, server\u00ebt SMTP, IMAP dhe POP3 t\u00eb Mail.ru ndalojn\u00eb transmetimin e fjal\u00ebkalimit p\u00ebrmes nj\u00eb lidhjeje t\u00eb pa siguruar, t\u00eb gjith\u00eb p\u00ebrdoruesit tan\u00eb p\u00ebrdor\u00ebn TLS p\u00ebr qasje n\u00eb SMTP, POP3 dhe IMAP, dhe k\u00ebshtu emri i p\u00ebrdoruesit dhe fjal\u00ebkalimi mund t\u00eb kapen vet\u00ebm n\u00ebse p\u00ebrdoruesi vet\u00eb pranon nj\u00eb certifikat\u00eb t\u00eb z\u00ebvend\u00ebsuar.<\/p>\n

P\u00ebr p\u00ebrdoruesit mobil\u00eb, ne gjithmon\u00eb rekomandojm\u00eb t\u00eb p\u00ebrdorin aplikacionet Mail.ru p\u00ebr t\u00eb hyr\u00eb n\u00eb post\u00eb, pasi puna me post\u00ebn n\u00eb to \u00ebsht\u00eb m\u00eb e sigurt se n\u00eb shfletues ose n\u00eb klient\u00eb t\u00eb inkorporuar SMTP\/IMAP.<\/p>\n

\u00c7far\u00eb duhet t\u00eb b\u00ebni<\/h2>\n

\nDuhet t\u00eb p\u00ebrdit\u00ebsoni firmware-n MikroTik RouterOS n\u00eb nj\u00eb version t\u00eb sigurt. N\u00ebse p\u00ebr ndonj\u00eb arsye kjo nuk \u00ebsht\u00eb e mundur, duhet t\u00eb filtrohet trafiku n\u00eb portin 8291 (tcp dhe udp), kjo do t\u00eb b\u00ebj\u00eb m\u00eb t\u00eb v\u00ebshtir\u00eb shfryt\u00ebzimin e problemit, ndon\u00ebse nuk do t\u00eb eliminoj\u00eb mund\u00ebsin\u00eb e injektimit pasiv n\u00eb cache-in DNS. Provajder\u00ebt e internetit duhet t\u00eb filtrojn\u00eb k\u00ebt\u00eb port n\u00eb rrjetet e tyre p\u00ebr t\u00eb mbrojtur p\u00ebrdoruesit korporativ\u00eb.\u00a0<\/p>\n

T\u00eb gjith\u00eb p\u00ebrdoruesit q\u00eb pranuan nj\u00eb certifikat\u00eb t\u00eb z\u00ebvend\u00ebsuar duhet t\u00eb ndryshojn\u00eb menj\u00ebher\u00eb fjal\u00ebkalimin e post\u00ebs elektronike dhe t\u00eb sh\u00ebrbimeve t\u00eb tjera p\u00ebr t\u00eb cilat u pranuar kjo certifikat\u00eb. Nga ana jon\u00eb, ne do t'i njoftojm\u00eb p\u00ebrdoruesit q\u00eb hyjn\u00eb n\u00eb post\u00eb p\u00ebrmes pajisjeve t\u00eb ndjeshme.<\/p>\n

P.S. Ekziston nj\u00eb vulnerabilitet tjet\u00ebr i lidhur, i p\u00ebrshkruar n\u00eb post. LukaSafonov<\/a><\/noindex> \"Backport vulnerabiliteti n\u00eb RouterOS k\u00ebrc\u00ebnon qindra mij\u00ebra pajisje<\/a><\/noindex>\".
\n
Burimi: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412\u0435\u0447\u0435\u0440\u043e\u043c 10 \u043c\u0430\u0440\u0442\u0430 \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 Mail.ru \u043d\u0430\u0447\u0430\u043b\u0430 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u0436\u0430\u043b\u043e\u0431\u044b \u043e\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043d\u0430 \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a IMAP\/SMTP \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c Mail.ru \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0447\u0430\u0441\u0442\u044c \u043a\u043e\u043d\u043d\u0435\u043a\u0442\u043e\u0432 \u043d\u0435 \u043f\u0440\u043e\u0445\u043e\u0434\u0438\u043b\u0430, \u0430 \u0447\u0430\u0441\u0442\u044c \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u044e\u0442 \u043e\u0448\u0438\u0431\u043a\u0443 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430. \u041e\u0448\u0438\u0431\u043a\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u0442\u0435\u043c, \u0447\u0442\u043e \u00ab\u0441\u0435\u0440\u0432\u0435\u0440\u00bb \u043e\u0442\u0434\u0430\u0435\u0442 \u0441\u0430\u043c\u043e\u043f\u043e\u0434\u043f\u0438\u0441\u0430\u043d\u044b\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 TLS. \u00a0 \u0417\u0430 \u0434\u0432\u0430 \u0434\u043d\u044f \u043f\u0440\u0438\u0448\u043b\u043e \u0431\u043e\u043b\u0435\u0435 10 \u0436\u0430\u043b\u043e\u0431 \u043e\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0441\u0430\u043c\u044b\u0445 \u0440\u0430\u0437\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":74132,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-74131","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47P\u00ebrdit\u00ebsoni RouterOS n\u00eb MikroTik tuaj | ProHoster","description":"M\u00eb 10 mars n\u00eb mbr\u00ebmje, sh\u00ebrbimi i mb\u00ebshtetjes Mail.ru filloi.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/obnovite-routeros-na-vashem-mikrotik","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0431\u043d\u043e\u0432\u0438\u0442\u0435 RouterOS \u043d\u0430 \u0432\u0430\u0448\u0435\u043c MikroTik | ProHoster","og:description":"\u0412\u0435\u0447\u0435\u0440\u043e\u043c 10 \u043c\u0430\u0440\u0442\u0430 \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 Mail.ru \u043d\u0430\u0447\u0430\u043b\u0430.","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/obnovite-routeros-na-vashem-mikrotik","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-14T11:42:14+00:00","article:modified_time":"2020-03-14T11:42:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"74131","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:20:27","updated":"2022-09-30 20:30:09","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/74131","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=74131"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/74131\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/74132"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=74131"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=74131"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=74131"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}