Kotsi ea bohlokoa (CVE-2023-32154) e khethiloe ho sistimi ea ts'ebetso ea RouterOS e sebelisoang ho li-routers tsa MikroTik, e lumellang mosebelisi ea sa netefatsoang hore a phethe khoutu e le hole sesebelisoa ka ho romella tsebiso e entsoeng ka mokhoa o khethehileng oa router ea IPv6 (RA, Router Advertisement).
Bothata bo bakoa ke khaello ea netefatso e nepahetseng ea data e tsoang kantle ho ts'ebetso e ikarabellang bakeng sa ho sebetsana le likopo tsa IPv6 RA (Router Advertisement), e entseng hore ho khonehe ho ngola data ho feta meeli ea buffer e fanoeng le ho hlophisa ts'ebetso ea khoutu ea hau. ka litokelo tsa motso. Bofokoli bo iponahatsa makaleng a MikroTik RouterOS v6.xx le v7.xx, ha melaetsa ea IPv6 RA e nolofalitsoe litlhophisong tsa ho amohela melaetsa ("ipv6/settings/ set accept-router-advertisements=yes" kapa "ipv6/settings/ set forward=ha ho amohele-routara -papatso=e-haeba-ho fetisa-e holofetse").
Bokhoni ba ho sebelisa monyetla oa ho ba kotsing ka ts'ebetso bo ile ba bontšoa tlholisanong ea Pwn2Own e Toronto, moo bafuputsi ba ileng ba hlokomela bothata ba ileng ba fumana moputso oa $ 100,000 bakeng sa ho qhekella ka mekhahlelo e mengata ka tlhaselo ea router ea Mikrotik le ho e sebelisa joalo ka ha. sethala sa ho hlasela likarolo tse ling tsa marang-rang a lehae (ka mor'a moo tlhaselo e ile ea nka taolo ea printa ea Canon, moo ts'oaetso e ileng ea senoloa hape).
Lintlha tse mabapi le ho ba kotsing li phatlalalitsoe pele patch e hlahisoa ke moetsi (0-letsatsi), empa lintlafatso tsa RouterOS 7.9.1, 6.49.8, 6.48.7, 7.10beta8 li se li phatlalalitsoe ka ts'oaetso e tsitsitseng. Ho latela tlhaiso-leseling e tsoang ho projeke ea ZDI (Zero Day Initiative), e ts'oereng tlholisano ea Pwn2Own, moetsi o ile a tsebisoa ka ho ba kotsing ka la 29 Tšitoe 2022. Baemeli ba MikroTik ba bolela hore ha baa ka ba fumana tsebiso mme ba ithutile ka bothata feela ka la 10 May, ka mor'a ho romela temoso ea ho qetela mabapi le tlhahiso ea tlhahisoleseding. Ho phaella moo, tlaleho ea ts'oaetso e bolela hore tlhahisoleseding e mabapi le mofuta oa bothata e fetiselitsoe ho moemeli oa MikroTik ka boeena nakong ea tlhōlisano ea Pwn2Own e Toronto, empa ho ea ka MikroTik, basebetsi ba khampani ha baa ka ba kenya letsoho ketsahalong leha e le efe.
Source: opennet.ru