{"id":85612,"date":"2020-06-17T19:42:36","date_gmt":"2020-06-17T17:42:36","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/19-udalyonno-ekspluatiruemyh-uyazvimostej-v-tcp-ip-steke-treck"},"modified":"2020-06-17T19:42:36","modified_gmt":"2020-06-17T17:42:36","slug":"19-udalyonno-ekspluatiruemyh-uyazvimostej-v-tcp-ip-steke-treck","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/19-udalyonno-ekspluatiruemyh-uyazvimostej-v-tcp-ip-steke-treck","title":{"rendered":"19 vulnereve t\u00eb shfryt\u00ebzuara n\u00eb distanc\u00eb n\u00eb stek-in TCP\/IP Treck","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

N\u00eb grumbullin proprietar TCP\/IP Treck<\/a><\/noindex> identifikuar<\/a><\/noindex> 19 dob\u00ebsi<\/a><\/noindex>, t\u00eb shfryt\u00ebzuara p\u00ebrmes d\u00ebrgimit t\u00eb paketave t\u00eb formatuara n\u00eb m\u00ebnyr\u00eb t\u00eb ve\u00e7ant\u00eb. Dob\u00ebsive iu \u00ebsht\u00eb caktuar emri kod Ripple20<\/a><\/noindex>. Disa dob\u00ebsi gjithashtu shfaqen n\u00eb grumbullin TCP\/IP KASAGO nga Zuken Elmic (Elmic Systems), i cili ka rr\u00ebnj\u00eb t\u00eb p\u00ebrbashk\u00ebta me Treck. Grumbulli Treck p\u00ebrdoret n\u00eb shum\u00eb pajisje industriale, mjek\u00ebsore, komunikimi, t\u00eb integruara dhe konsumatorike (nga llamba inteligjente deri te printerat dhe burimet e energjis\u00eb nuk t\u00eb nd\u00ebrpriten), si dhe n\u00eb pajisjet e energjis\u00eb, transportit, aviacionit, tregtis\u00eb dhe nxjerrjes s\u00eb naft\u00ebs. <\/p>\n

\"19<\/a><\/noindex><\/center><\/p>\n

Mes objekteve t\u00eb dukshme p\u00ebr sulme q\u00eb p\u00ebrdorin grumbullin TCP\/IP Treck, mund t\u00eb p\u00ebrmenden printerat rrjet\u00eb HP dhe \u00e7ipit Intel. Problemet n\u00eb grumbullin TCP\/IP Treck ishin shkaku i dob\u00ebsive t\u00eb fundit t\u00eb larguara<\/a><\/noindex> n\u00eb n\u00ebn sistemi Intel AMT dhe ISM, t\u00eb shfryt\u00ebzuara p\u00ebrmes d\u00ebrgimit t\u00eb paket\u00ebs rrjet. Prania e dob\u00ebsive \u00ebsht\u00eb konfirmuar nga prodhuesit Intel, HP, Hewlett Packard Enterprise, Baxter, Caterpillar, Digi, Rockwell Automation dhe Schneider Electric. Po ashtu
\n66 prodhues<\/a><\/noindex>, n\u00eb produktet q\u00eb p\u00ebrdorin stek TCP\/IP Treck, nuk jan\u00eb p\u00ebrgjigjur p\u00ebr problemet. 5 prodhues, p\u00ebrfshir\u00eb AMD, deklaruan se produktet e tyre nuk kan\u00eb probleme.<\/p>\n

\"19<\/a><\/noindex><\/center><\/p>\n

Problemet jan\u00eb gjetur n\u00eb zbatimin e protokolleve IPv4, IPv6, UDP, DNS, DHCP, TCP, ICMPv4 dhe ARP, dhe jan\u00eb t\u00eb shkaktuara nga trajtimi i gabuar i parametrave me madh\u00ebsi t\u00eb dh\u00ebnash (p\u00ebrdorimi i fush\u00ebs me madh\u00ebsi pa kontrolluar madh\u00ebsin\u00eb faktike t\u00eb t\u00eb dh\u00ebnave), gabimeve n\u00eb verifikimin e informacionit t\u00eb hyrjes, lirimit t\u00eb dyfisht\u00eb t\u00eb memories, leximit jasht\u00eb zon\u00ebs s\u00eb tamponit, mbushjeve integer, kontrollit t\u00eb pap\u00ebrshtatsh\u00ebm t\u00eb aksesit dhe problemeve n\u00eb trajtimin e vargjeve me ndar\u00ebs zero. <\/p>\n

Dy problemet m\u00eb t\u00eb rrezikshme (CVE-2020-11896, CVE-2020-11897) me nivele CVSS 10 mund\u00ebsojn\u00eb ekzekutimin e kodit t\u00eb personalizuar n\u00eb pajisje p\u00ebrmes d\u00ebrgimit t\u00eb pakove t\u00eb strukturuara n\u00eb nj\u00eb m\u00ebnyr\u00eb t\u00eb ve\u00e7ant\u00eb IPv4\/UDP ose IPv6. Problemi i par\u00eb kritik shfaqet n\u00eb pajisje q\u00eb mb\u00ebshtesin t\u00fcnelet IPv4, dhe i dyti n\u00eb versione q\u00eb jan\u00eb l\u00ebshuar para dat\u00ebs 04.06.2009 q\u00eb mb\u00ebshtesin IPv6. Nj\u00eb tjet\u00ebr dob\u00ebsi kritike (CVSS 9) \u00ebsht\u00eb e pranishme n\u00eb DNS-resolver (CVE-2020-11901) dhe lejon ekzekutimin e kodit p\u00ebrmes d\u00ebrgimit t\u00eb nj\u00eb k\u00ebrkese DNS t\u00eb strukturuar n\u00eb m\u00ebnyr\u00eb t\u00eb ve\u00e7ant\u00eb (problemi \u00ebsht\u00eb p\u00ebrdorur p\u00ebr t\u00eb demonstruar nj\u00eb hack t\u00eb Schneider Electric APC UPS dhe shfaqet n\u00eb pajisje q\u00eb mb\u00ebshtesin DNS).<\/p>\n

Dob\u00ebsi t\u00eb tjera CVE-2020-11898, CVE-2020-11899, CVE-2020-11902, CVE-2020-11903, CVE-2020-11905 mund\u00ebsojn\u00eb q\u00eb p\u00ebrmes d\u00ebrgimit t\u00eb pakove t\u00eb strukturuara n\u00eb nj\u00eb m\u00ebnyr\u00eb t\u00eb ve\u00e7ant\u00eb IPv4\/ICMPv4, IPv6OverIPv4, DHCP, DHCPv6 ose IPv6 t\u00eb zbulojn\u00eb p\u00ebrmbajtjen e zonave t\u00eb memories s\u00eb sistemit. Problemet e tjera mund t\u00eb \u00e7ojn\u00eb n\u00eb refuzim sh\u00ebrbimi ose n\u00eb rrjedhjen e t\u00eb dh\u00ebnave mbetje nga buferat e sistemit.<\/p>\n

Shumica e dob\u00ebsive jan\u00eb rregulluar n\u00eb versionin Treck 6.0.1.67 (problemi CVE-2020-11897 \u00ebsht\u00eb rregulluar n\u00eb 5.0.1.35, CVE-2020-11900 n\u00eb 6.0.1.41, CVE-2020-11903 n\u00eb 6.0.1.28, CVE-2020-11908 n\u00eb 4.7.1.27). Duke qen\u00eb se p\u00ebrgatitja e p\u00ebrdit\u00ebsimeve t\u00eb firmware p\u00ebr pajisje specifike mund t\u00eb marr\u00eb koh\u00eb t\u00eb gjat\u00eb ose mund t\u00eb jet\u00eb e pamundur (stoku Treck \u00ebsht\u00eb n\u00eb dispozicion p\u00ebr m\u00eb shum\u00eb se 20 vjet, shum\u00eb pajisje kan\u00eb mbetur pa mb\u00ebshtetje ose \u00ebsht\u00eb e v\u00ebshtir\u00eb p\u00ebr t'u p\u00ebrdit\u00ebsuar), administratoret rekomandohen t\u00eb izolojn\u00eb pajisjet problematike dhe t\u00eb konfigurojn\u00eb n\u00eb sistemet e inspektimit t\u00eb pakove, firewalls ose router-at normalizimin ose bllokimin e pakove t\u00eb fraksionuara, t\u00eb bllokojn\u00eb IP-tunelat (IPv6-in-IPv4 dhe IP-in-IP), t\u00eb bllokojn\u00eb 'source routing', t\u00eb aktivizojn\u00eb inspektimin e opsioneve t\u00eb pap\u00ebrshtatshme n\u00eb paketat TCP, t\u00eb bllokojn\u00eb mesazhet kontrolle ICMP t\u00eb pap\u00ebrdorura (MTU Update dhe Address Mask), t\u00eb ndalojn\u00eb multicast IPv6 dhe t\u00eb ridrejtojn\u00eb k\u00ebrkesat DNS n\u00eb nj\u00eb server t\u00eb mbrojtur DNS-rekurziv.<\/p>\n


\n
\r\n \"Luaj\r\n
<\/div>\r\n <\/div><\/center><\/p>\n

<\/a><\/noindex><\/p>\n

Burimi: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043f\u0440\u043e\u043f\u0440\u0438\u0435\u0442\u0430\u0440\u043d\u043e\u043c TCP\/IP \u0441\u0442\u0435\u043a\u0435 Treck \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 19 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u043e \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f Ripple20. \u041d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0442\u0430\u043a\u0436\u0435 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u0432 TCP\/IP-\u0441\u0442\u0435\u043a\u0435 KASAGO \u043e\u0442 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Zuken Elmic (Elmic Systems), \u0438\u043c\u0435\u044e\u0449\u0435\u043c \u043e\u0431\u0449\u0438\u0435 \u043a\u043e\u0440\u043d\u0438 c Treck. \u0421\u0442\u0435\u043a Treck \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u0432\u043e \u043c\u043d\u043e\u0433\u0438\u0445 \u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u044b\u0445, \u043c\u0435\u0434\u0438\u0446\u0438\u043d\u0441\u043a\u0438\u0445, \u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445, \u0432\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0438 \u043f\u043e\u0442\u0440\u0435\u0431\u0438\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 (\u043e\u0442 \u0443\u043c\u043d\u044b\u0445 \u043b\u0430\u043c\u043f \u0434\u043e \u043f\u0440\u0438\u043d\u0442\u0435\u0440\u043e\u0432 \u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":85613,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-85612","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd4719 vulnerabilitete t\u00eb shfryt\u00ebzuara n\u00eb distanc\u00eb n\u00eb stek\u00ebn TCP\/IP Treck | ProHoster","description":"N\u00eb stek\u00ebn propriatere TCP\/IP Treck jan\u00eb identifikuar 19 vulnerabilitete q\u00eb shfryt\u00ebzohen p\u00ebrmes d\u00ebrgimit t\u00eb paketave t\u00eb formuluara n\u00eb m\u00ebnyr\u00eb speciale. Vulnerabiliteteve u \u00ebsht\u00eb caktuar emri n\u00eb kod Ripple20. Disa vulnerabilitete shfaqen gjithashtu n\u00eb stek\u00ebn TCP\/IP KASAGO nga kompania Zuken Elmic (Elmic Systems), e cila ka rr\u00ebnj\u00eb t\u00eb p\u00ebrbashk\u00ebta me Treck. Steka Treck p\u00ebrdoret n\u00eb shum\u00eb pajisje industriale, mjek\u00ebsore, komunikimi, t\u00eb integruara dhe konsumator\u00ebve (nga llamba t\u00eb men\u00e7ura deri te printer\u00ebt dhe)","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/19-udalyonno-ekspluatiruemyh-uyazvimostej-v-tcp-ip-steke-treck","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd4719 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 TCP\/IP-\u0441\u0442\u0435\u043a\u0435 Treck | ProHoster","og:description":"\u0412 \u043f\u0440\u043e\u043f\u0440\u0438\u0435\u0442\u0430\u0440\u043d\u043e\u043c TCP\/IP \u0441\u0442\u0435\u043a\u0435 Treck \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 19 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u043e \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f Ripple20. \u041d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0442\u0430\u043a\u0436\u0435 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u0432 TCP\/IP-\u0441\u0442\u0435\u043a\u0435 KASAGO \u043e\u0442 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Zuken Elmic (Elmic Systems), \u0438\u043c\u0435\u044e\u0449\u0435\u043c \u043e\u0431\u0449\u0438\u0435 \u043a\u043e\u0440\u043d\u0438 c Treck. \u0421\u0442\u0435\u043a Treck \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u0432\u043e \u043c\u043d\u043e\u0433\u0438\u0445 \u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u044b\u0445, \u043c\u0435\u0434\u0438\u0446\u0438\u043d\u0441\u043a\u0438\u0445, \u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445, \u0432\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0438 \u043f\u043e\u0442\u0440\u0435\u0431\u0438\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 (\u043e\u0442 \u0443\u043c\u043d\u044b\u0445 \u043b\u0430\u043c\u043f \u0434\u043e \u043f\u0440\u0438\u043d\u0442\u0435\u0440\u043e\u0432 \u0438","og:url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/19-udalyonno-ekspluatiruemyh-uyazvimostej-v-tcp-ip-steke-treck","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-17T17:42:36+00:00","article:modified_time":"2020-06-17T17:42:36+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"85612","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 13:55:50","updated":"2022-09-28 01:40:49"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/85612","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=85612"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/85612\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/85613"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=85612"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=85612"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=85612"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}