{"id":114452,"date":"2024-03-20T12:25:49","date_gmt":"2024-03-20T10:25:49","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-na-nekotorye-protokoly-na-osnove-udp-privodyashhaya-k-zacziklivaniyu-obmena-paketami"},"modified":"2024-03-20T12:25:49","modified_gmt":"2024-03-20T10:25:49","slug":"ataka-na-nekotorye-protokoly-na-osnove-udp-privodyashhaya-k-zacziklivaniyu-obmena-paketami","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/ataka-na-nekotorye-protokoly-na-osnove-udp-privodyashhaya-k-zacziklivaniyu-obmena-paketami","title":{"rendered":"En attack mot vissa protokoll baserade p\u00e5 UDP som leder till cykler i paketutbytet","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

CERT-koordinationscentret (Computer Emergency Response Team) har publicerat en varning om en serie s\u00e5rbarheter i implementationer av olika applikationsprotokoll som anv\u00e4nder UDP som transportprotokoll. S\u00e5rbarheterna kan utnyttjas f\u00f6r att arrangera en \u00f6verbelastningsattack p\u00e5 grund av m\u00f6jligheten till cykler i paketutbytet mellan tv\u00e5 v\u00e4rdar. Till exempel kan angripare orsaka att tillg\u00e4nglig n\u00e4tverkskapacitet tar slut, blockera n\u00e4tverkstj\u00e4nsters funktion (till exempel genom att skapa h\u00f6g belastning och \u00f6verskrida gr\u00e4nsen f\u00f6r f\u00f6rfr\u00e5gningsintensitet) och implementera trafikf\u00f6rst\u00e4rkare f\u00f6r DDoS-attacker. <\/p>\n

Bland de protokoll vars vissa implementationer \u00e4r s\u00e5rbara n\u00e4mns DNS, NTP, TFTP, Echo (RFC862), Chargen (RFC864) och QOTD (RFC865). S\u00e5rbarheten (CVE-2024-2169) har bekr\u00e4ftats i vissa produkter fr\u00e5n f\u00f6retag som Cisco, Microsoft, Broadcom, Brother, Honeywell (CVE-2024-1309) och MikroTik. F\u00f6r att f\u00f6rhindra s\u00e5rbarheterna rekommenderas det att aktivera blockering av spoofing (uRPF) p\u00e5 brandv\u00e4ggar, begr\u00e4nsa \u00e5tkomst till on\u00f6diga UDP-tj\u00e4nster och konfigurera begr\u00e4nsning av trafikintensitet (rate-limit och QoS). <\/p>\n

S\u00e5rbarheterna beror p\u00e5 att UDP-protokollet inte \u00e4r skyddat mot adressf\u00f6rfalskning \u2014 i avsaknad av skydd mot f\u00f6rfalskning p\u00e5 transitroutrar kan en angripare ange IP-adressen till en valfri server i UDP-paketet och skicka detta paket till en annan server, som sedan skickar svaret till den angivna, falska adressen. Angreppsmetoden g\u00e5r ut p\u00e5 att skapa en situation d\u00e4r paketutbytet mellan servrar med s\u00e5rbara protokollimplementationer g\u00e5r i loop. Till exempel kan den m\u00e5linriktade servern svara p\u00e5 det mottagna paketet med en felkod, medan servern vars adress har f\u00f6rfalskats av angriparen kommer att ge sitt svar, vilket i sin tur \u00e5terigen leder till att ett paket med felkod returneras. P\u00e5 s\u00e5 s\u00e4tt servrar<\/a> kommer de att spela paket ping-pong o\u00e4ndligt.

\"En<\/center> <\/p>\n

Det \u00e4r anm\u00e4rkningsv\u00e4rt att denna typ av angrepp inte \u00e4r ny och har servern<\/a> NTP-tidsynkronisering, en av attackformer, \u00e5tg\u00e4rdades redan 2009 (CVE-2009-3563) i versioner 4.2.4p8 och 4.2.5. Attacken gick ut p\u00e5 att skicka ett NTP-paket med en falsk adress och inst\u00e4lld flagga MODE_PRIVATE, vilket vid bearbetning ledde till att den m\u00e5linriktade servern returnerade ett svar om att privat l\u00e4ge inte kunde anv\u00e4ndas, med flaggan MODE_PRIVATE fortfarande inst\u00e4lld i svaret. F\u00f6ljaktligen kunde \u00e4ven en annan server inte bearbeta denna flagga och returnerade sitt svar, vilket ledde till en cykel av paketutbyte mellan tv\u00e5 NTP-servrar. F\u00f6r DNS-protokollet publicerades en varning om denna typ av attack redan 1996. <\/p>\n

En global skanning av adresser p\u00e5 internet har visat att det f\u00f6r n\u00e4rvarande finns minst 23 000 s\u00e5rbara TFTP-servrar, 63 000 DNS-servrar, 89 000 NTP-servrar, 56 000 Echo\/RFC862-tj\u00e4nster, 22 000 Chargen\/RFC864-tj\u00e4nster och 21 000 QOTD\/RFC865-tj\u00e4nster online. Det antas att n\u00e4r det g\u00e4ller NTP-servrar beror f\u00f6rekomsten av os\u00e4krade s\u00e5rbarheter p\u00e5 anv\u00e4ndningen av mycket gamla versioner av ntpd som sl\u00e4pptes f\u00f6re 2010. Echo-, Chargen- och QOTD-tj\u00e4nster \u00e4r ursprungligen s\u00e5rbara p\u00e5 grund av sin arkitektur. Situationen med TFTP- och DNS-servrar kr\u00e4ver en genomg\u00e5ng med deras administrat\u00f6rer. Servrarna atftpd och tftpd p\u00e5verkas inte av problemet d\u00e5 de anv\u00e4nder ett slumpm\u00e4ssigt nummer f\u00f6r den avs\u00e4ndande n\u00e4tverksporten vid svar. Bland de s\u00e5rbara DNS-servrarna n\u00e4mns dproxy-nexgen. I Microsofts produkter manifesteras problemet i WDS (Windows Deployment Services), medan det i Cisco-produkter finns i routrar av serierna 2800 och 2970.
\n
K\u00e4lla: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043e\u0440\u0434\u0438\u043d\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0439 \u0446\u0435\u043d\u0442\u0440 CERT (\u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0430 \u0440\u0435\u0430\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430 \u0447\u0440\u0435\u0437\u0432\u044b\u0447\u0430\u0439\u043d\u044b\u0435 \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u0438), \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0435 \u043e \u0441\u0435\u0440\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u044b\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u043e\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0442\u0440\u0430\u043d\u0441\u043f\u043e\u0440\u0442\u0430 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b UDP. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0433\u0443\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043e\u0442\u043a\u0430\u0437\u0430 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438 \u0438\u0437-\u0437\u0430 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0437\u0430\u0446\u0438\u043a\u043b\u0438\u0432\u0430\u043d\u0438\u044f \u043e\u0431\u043c\u0435\u043d\u0430 \u043f\u0430\u043a\u0435\u0442\u0430\u043c\u0438 \u043c\u0435\u0436\u0434\u0443 \u0434\u0432\u0443\u043c\u044f \u0445\u043e\u0441\u0442\u0430\u043c\u0438. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u043c\u043e\u0433\u0443\u0442 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0439 \u043f\u0440\u043e\u043f\u0443\u0441\u043a\u043d\u043e\u0439 \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0441\u0435\u0442\u0438, \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":114453,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-114452","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Attack p\u00e5 vissa UDP-baserade protokoll som leder till cykler av paketutbyte | ProHoster","description":"CERT-koordinationscentret (Computer Emergency Response Team) har publicerat en varning om en serie s\u00e5rbarheter i implementeringar av olika applikationsprotokoll som anv\u00e4nder dessa som transport.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/ataka-na-nekotorye-protokoly-na-osnove-udp-privodyashhaya-k-zacziklivaniyu-obmena-paketami","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 \u043d\u0430 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u044b \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 UDP, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0437\u0430\u0446\u0438\u043a\u043b\u0438\u0432\u0430\u043d\u0438\u044e \u043e\u0431\u043c\u0435\u043d\u0430 \u043f\u0430\u043a\u0435\u0442\u0430\u043c\u0438 | ProHoster","og:description":"\u041a\u043e\u043e\u0440\u0434\u0438\u043d\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0439 \u0446\u0435\u043d\u0442\u0440 CERT (\u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0430 \u0440\u0435\u0430\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430 \u0447\u0440\u0435\u0437\u0432\u044b\u0447\u0430\u0439\u043d\u044b\u0435 \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u0438), \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0435 \u043e \u0441\u0435\u0440\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u044b\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u043e\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0442\u0440\u0430\u043d\u0441\u043f\u043e\u0440\u0442\u0430.","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/ataka-na-nekotorye-protokoly-na-osnove-udp-privodyashhaya-k-zacziklivaniyu-obmena-paketami","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-03-20T10:25:49+00:00","article:modified_time":"2024-03-20T10:25:49+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"114452","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-09 16:53:32","updated":"2026-02-09 21:37:58","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/114452","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=114452"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/114452\/revisions"}],"predecessor-version":[{"id":159859,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/114452\/revisions\/159859"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media\/114453"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=114452"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=114452"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=114452"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}