{"id":74131,"date":"2020-03-14T14:42:14","date_gmt":"2020-03-14T11:42:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/obnovite-routeros-na-vashem-mikrotik"},"modified":"2020-03-14T14:42:14","modified_gmt":"2020-03-14T11:42:14","slug":"obnovite-routeros-na-vashem-mikrotik","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/obnovite-routeros-na-vashem-mikrotik","title":{"rendered":"P\u00ebrdit\u00ebsoni RouterOS n\u00eb MikroTik tuaj.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"P\u00ebrdit\u00ebsoni
\nM\u00eb 10 mars, n\u00eb mbr\u00ebmje, sh\u00ebrbimi i mb\u00ebshtetjes s\u00eb Mail.ru filloi t\u00eb merrte ankesa nga p\u00ebrdoruesit p\u00ebr pamund\u00ebsin\u00eb e lidhjes me server\u00ebt IMAP\/SMTP t\u00eb Mail.ru p\u00ebrmes programeve t\u00eb post\u00ebs elektronike. Disa lidhje nuk funksiononin, nd\u00ebrsa disa t\u00eb tjer\u00eb tregonin nj\u00eb gabim certifikate. Gabimi shkaktohej nga fakti se \"serveri\" jep nj\u00eb certifikat\u00eb TLS t\u00eb vet\u00eb-n\u00ebnshkruar.
\n<\/a><\/noindex>\u00a0
\n\"P\u00ebrdit\u00ebsoni
\nN\u00eb dy dit\u00ebt n\u00eb vijim, mb\u00ebrrit\u00ebn m\u00eb shum\u00eb se 10 ankesa nga p\u00ebrdorues t\u00eb rrjeteve t\u00eb ndryshme dhe nga pajisje t\u00eb ndryshme, q\u00eb e b\u00ebnte t\u00eb pak\u00ebndshme problemin nga ndonj\u00eb provajder t\u00eb vet\u00ebm. Nj\u00eb analiz\u00eb m\u00eb e detajuar e problemit zbuloi se ndodhte z\u00ebvend\u00ebsimi i serverit imap.mail.ru (si dhe server\u00ebve dhe sh\u00ebrbimeve t\u00eb tjera t\u00eb post\u00ebs) n\u00eb nivelin DNS. M\u00eb pas, me ndihm\u00ebn aktive t\u00eb p\u00ebrdoruesve tan\u00eb, ne gjet\u00ebm se shkaku ishte nj\u00eb regjistrim i gabuar n\u00eb cache-n e router-it t\u00eb tyre, i cili n\u00eb t\u00eb nj\u00ebjt\u00ebn koh\u00eb \u00ebsht\u00eb nj\u00eb zgjidh\u00ebs lokal DNS, dhe i cili n\u00eb shum\u00eb (por jo t\u00eb gjitha) raste ishte nj\u00eb pajisje MikroTik, shum\u00eb e njohur n\u00eb rrjetet e vogla korporative dhe te provajder\u00ebt e vegj\u00ebl t\u00eb internetit.<\/p>\n

Cila \u00ebsht\u00eb problemi<\/h2>\n

\nN\u00eb shtator 2019, hulumtuesit gjet\u00ebm <\/a><\/noindex>disa vulnerabilitete n\u00eb MikroTik RouterOS (CVE-2019-3976, CVE-2019-3977, CVE-2019-3978, CVE-2019-3979), t\u00eb cilat lejonin kryerjen e nj\u00eb sulmi t\u00eb helmimit t\u00eb caches DNS, dometh\u00ebn\u00eb mund\u00ebsin\u00eb p\u00ebr t\u00eb z\u00ebvend\u00ebsuar regjistrimet DNS n\u00eb cache-n e router-it, p\u00ebr m\u00eb tep\u00ebr, CVE-2019-3978 i mund\u00ebson sulmuesit t\u00eb mos pres\u00eb q\u00eb ndonj\u00eb nga rrjeti i brendsh\u00ebm t\u00eb k\u00ebrkoj\u00eb nj\u00eb regjistrim n\u00eb serverin e tij DNS, p\u00ebr t\u00eb helmuar cache-n e zgjidh\u00ebsit, por t\u00eb filloj\u00eb nj\u00eb k\u00ebrkes\u00eb t\u00eb till\u00eb vet\u00eb p\u00ebrmes portit 8291 (UDP dhe TCP). Vulnerabiliteti u rregullua nga MikroTik n\u00eb versionet e RouterOS 6.45.7 (stable) dhe 6.44.6 (long-term) m\u00eb 28 tetor 2019, megjithat\u00eb sipas hulumtimeve <\/a><\/noindex>m\u00eb shum\u00eb se pjesa m\u00eb e madhe e p\u00ebrdoruesve aktualisht nuk e kan\u00eb instaluar patch-in.<\/p>\n

E dukshme \u00ebsht\u00eb se tani ky problem po shfryt\u00ebzohet aktivisht \"n\u00eb jet\".<\/p>\n

\u00c7far\u00eb rreziku paraqet<\/h2>\n

\nSulmuesi mund t\u00eb z\u00ebvend\u00ebsoj\u00eb regjistrimin DNS t\u00eb cilitdo hosti, me t\u00eb cilin p\u00ebrdoruesi i rrjetit t\u00eb brendsh\u00ebm ka qasje, duke kapur k\u00ebshtu trafikun drejt tij. N\u00ebse informacioni sensitiv transmetohet pa enkriptim (p\u00ebr shembull, me http:\/\/ pa TLS) ose p\u00ebrdoruesi pranon nj\u00eb certifikat\u00eb t\u00eb rreme, sulmuesi mund t\u00eb marr\u00eb t\u00eb gjith\u00eb t\u00eb dh\u00ebnat q\u00eb d\u00ebrgohen p\u00ebrmes lidhjes, t\u00eb tilla si emri i p\u00ebrdoruesit ose fjal\u00ebkalimi. Fatkeq\u00ebsisht, praktika tregon se n\u00ebse p\u00ebrdoruesi ka mund\u00ebsin\u00eb t\u00eb pranoj\u00eb nj\u00eb certifikat\u00eb t\u00eb rreme, ai do ta shfryt\u00ebzoj\u00eb at\u00eb.<\/p>\n

Pse pik\u00ebrisht server\u00ebt SMTP dhe IMAP, dhe \u00e7far\u00eb i shp\u00ebtoi p\u00ebrdoruesit<\/h2>\n

\nPse sulmuesit u p\u00ebrpoq\u00ebn t\u00eb kapnin pik\u00ebrisht trafikun SMTP\/IMAP t\u00eb aplikacioneve t\u00eb post\u00ebs, e jo trafikun n\u00eb web, megjith\u00ebse pjesa m\u00eb e madhe e p\u00ebrdoruesve hyjn\u00eb n\u00eb post\u00eb p\u00ebrmes shfletuesve n\u00eb HTTPS?<\/p>\n

Nuk t\u00eb gjitha programet e post\u00ebs q\u00eb funksionojn\u00eb p\u00ebrmes SMTP dhe IMAP\/POP3 e mbrojn\u00eb p\u00ebrdoruesin nga gabimet, duke mos lejuar q\u00eb ai t\u00eb d\u00ebrgoj\u00eb emrin e p\u00ebrdoruesit dhe fjal\u00ebkalimin p\u00ebrmes nj\u00eb lidhjeje t\u00eb pasigurt ose t\u00eb kompromentuar, megjith\u00ebse sipas standardit RFC 8314<\/a><\/noindex>, i miratuar n\u00eb vitin 2018 (dhe i implementuar n\u00eb Mail.ru shum\u00eb m\u00eb her\u00ebt), ato duhet t\u00eb mbrojn\u00eb p\u00ebrdoruesin nga kapja e fjal\u00ebkalimit p\u00ebrmes \u00e7do lidhjeje t\u00eb pap\u00ebrgatitur. P\u00ebr m\u00eb tep\u00ebr, p\u00ebr momentin n\u00eb klient\u00ebt e post\u00ebs p\u00ebrdorimi i protokollit OAuth \u00ebsht\u00eb shum\u00eb i rrall\u00eb (ai mb\u00ebshtetet nga serverat e post\u00ebs Mail.ru), dhe pa at\u00eb, emri i p\u00ebrdoruesit dhe fjal\u00ebkalimi d\u00ebrgohen n\u00eb \u00e7do seanc\u00eb.<\/p>\n

Shfletuesit mund t\u00eb jen\u00eb pak m\u00eb t\u00eb mbrojtur nga sulmet Man-in-the-Middle. N\u00eb t\u00eb gjitha domenet kritike t\u00eb mail.ru, p\u00ebrve\u00e7 HTTPS, \u00ebsht\u00eb aktivizuar politika HSTS (siguria strikte e transportit HTTP). Me HSTS-n\u00eb t\u00eb aktivizuar, nj\u00eb shfletues modern nuk i ofron p\u00ebrdoruesit nj\u00eb mund\u00ebsi t\u00eb thjesht\u00eb p\u00ebr t\u00eb pranuar nj\u00eb certifikat\u00eb t\u00eb rreme, madje n\u00ebse p\u00ebrdoruesi e d\u00ebshiron k\u00ebt\u00eb. P\u00ebrve\u00e7 HSTS, p\u00ebrdoruesit jan\u00eb shp\u00ebtuar nga fakti se, q\u00eb nga viti 2017, server\u00ebt SMTP, IMAP dhe POP3 t\u00eb Mail.ru ndalojn\u00eb d\u00ebrgimin e fjal\u00ebkalimeve p\u00ebrmes nj\u00eb lidhjeje t\u00eb pasigurt. T\u00eb gjith\u00eb p\u00ebrdoruesit tan\u00eb p\u00ebrdornin TLS p\u00ebr aksesin p\u00ebrmes SMTP, POP3 dhe IMAP, dhe k\u00ebshtu fjal\u00ebkalimi dhe emri i p\u00ebrdoruesit mund t\u00eb kapen vet\u00ebm n\u00ebse p\u00ebrdoruesi vet\u00eb pranon t\u00eb pranoj\u00eb nj\u00eb certifikat\u00eb t\u00eb falsifikuar.<\/p>\n

P\u00ebr p\u00ebrdoruesit e celular\u00ebve, gjithmon\u00eb rekomandojm\u00eb t\u00eb p\u00ebrdorin aplikacionet e Mail.ru p\u00ebr qasje n\u00eb post\u00eb, pasi puna me post\u00ebn n\u00eb to \u00ebsht\u00eb m\u00eb e sigurt se n\u00eb shfletues ose klient\u00eb t\u00eb integruar SMTP\/IMAP.<\/p>\n

\u00c7far\u00eb duhet b\u00ebr\u00eb<\/h2>\n

\nNevoja p\u00ebr t\u00eb p\u00ebrdit\u00ebsuar firmware-n e MikroTik RouterOS n\u00eb nj\u00eb version t\u00eb sigurt. N\u00ebse p\u00ebr ndonj\u00eb arsye kjo \u00ebsht\u00eb e pamundur, duhet t\u00eb filtrohet trafiku p\u00ebrmes portit 8291 (tcp dhe udp), kjo do ta v\u00ebshtir\u00ebsoj\u00eb shfryt\u00ebzimin e problemit, megjithat\u00eb nuk do t\u00eb eliminoj\u00eb mund\u00ebsin\u00eb e injeksionit pasiv n\u00eb DNS-cache. Kujdesit t\u00eb internetit do t'i duhet t\u00eb filtroj\u00eb k\u00ebt\u00eb port n\u00eb rrjetet e tyre p\u00ebr t\u00eb mbrojtur p\u00ebrdoruesit korporativ\u00eb.\u00a0<\/p>\n

T\u00eb gjith\u00eb p\u00ebrdoruesit q\u00eb pranuan certifikat\u00ebn e falsifikuar duhet urgjentisht t\u00eb ndryshojn\u00eb fjal\u00ebkalimin e post\u00ebs elektronike dhe sh\u00ebrbimeve t\u00eb tjera p\u00ebr t\u00eb cilat kjo certifikat\u00eb ishte pranuar. Nga ana jon\u00eb, ne do t\u00eb informojm\u00eb p\u00ebrdoruesit q\u00eb hyjn\u00eb n\u00eb post\u00eb p\u00ebrmes pajisjeve t\u00eb ndjeshme.<\/p>\n

P.S. Ka nj\u00eb dob\u00ebsi tjet\u00ebr t\u00eb lidhur, e p\u00ebrshkruar n\u00eb postim LukaSafonov<\/a><\/noindex> "Vulnerabiliteti Backport n\u00eb RouterOS rrezikon qindra mij\u00ebra pajisje<\/a><\/noindex>.
\n
Burimi: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412\u0435\u0447\u0435\u0440\u043e\u043c 10 \u043c\u0430\u0440\u0442\u0430 \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 Mail.ru \u043d\u0430\u0447\u0430\u043b\u0430 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u0436\u0430\u043b\u043e\u0431\u044b \u043e\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043d\u0430 \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a IMAP\/SMTP \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c Mail.ru \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0447\u0430\u0441\u0442\u044c \u043a\u043e\u043d\u043d\u0435\u043a\u0442\u043e\u0432 \u043d\u0435 \u043f\u0440\u043e\u0445\u043e\u0434\u0438\u043b\u0430, \u0430 \u0447\u0430\u0441\u0442\u044c \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u044e\u0442 \u043e\u0448\u0438\u0431\u043a\u0443 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430. \u041e\u0448\u0438\u0431\u043a\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u0442\u0435\u043c, \u0447\u0442\u043e \u00ab\u0441\u0435\u0440\u0432\u0435\u0440\u00bb \u043e\u0442\u0434\u0430\u0435\u0442 \u0441\u0430\u043c\u043e\u043f\u043e\u0434\u043f\u0438\u0441\u0430\u043d\u044b\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 TLS. \u00a0 \u0417\u0430 \u0434\u0432\u0430 \u0434\u043d\u044f \u043f\u0440\u0438\u0448\u043b\u043e \u0431\u043e\u043b\u0435\u0435 10 \u0436\u0430\u043b\u043e\u0431 \u043e\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0441\u0430\u043c\u044b\u0445 \u0440\u0430\u0437\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":74132,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-74131","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47P\u00ebrdit\u00ebsoni RouterOS n\u00eb MikroTik tuaj | ProHoster","description":"N\u00eb mbr\u00ebmje t\u00eb 10 marsit, sh\u00ebrbimi i mb\u00ebshtetjes Mail.ru filloi.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/obnovite-routeros-na-vashem-mikrotik","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0431\u043d\u043e\u0432\u0438\u0442\u0435 RouterOS \u043d\u0430 \u0432\u0430\u0448\u0435\u043c MikroTik | ProHoster","og:description":"\u0412\u0435\u0447\u0435\u0440\u043e\u043c 10 \u043c\u0430\u0440\u0442\u0430 \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 Mail.ru \u043d\u0430\u0447\u0430\u043b\u0430.","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/obnovite-routeros-na-vashem-mikrotik","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-14T11:42:14+00:00","article:modified_time":"2020-03-14T11:42:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"74131","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:20:27","updated":"2022-09-30 20:30:09","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/74131","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=74131"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/74131\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/74132"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=74131"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=74131"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=74131"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}