ืืขืจ ืืขืฆืื ืก, ืืื ืคืจื ืืืืขืจ, ืขืก ืืขื ืขื ืืขืืืขื ืืืืืืกืคึผืจืขื ืจืืคื ืคึฟืึทืจ ืขืงืกืื ืฆื ืืืื ืืขืจืืืึทื ืืืงื ืฆื ืืืขืจืกืืข 4.92 ืจืขืื ืฆื ืืขืจ ืืืึทืื ืขืจืึทืืืืืื ืคืื CVE-2019-10149 (). ืืื ืืขืฆืื ืก ืขืก ืคืืจืงืขืจื ืืืืก ืึทื ืื Sustes ืืึทืืืืึทืจืข ืืึทืฉืืึธืกื ืฆื ื ืืฆื ืืขื ืืืึทืื ืขืจืึทืืืืืื.
ืืืฆื ืึทืืข ืืขื ืข ืืืึธืก ืขืจืืืฉืึทื ืืื ืืขืจืืืึทื ืืืงื ืงืขื ืขื "ืคืจืืืขื" ืืืืืขืจ: ืืืืฃ ืืืื 21, 2019, ืคืึธืจืฉืขืจ ืืขืจืึธื ืก ืืืกืงืึทืืืขืจื ืึท ืงืจืืืืฉ ืืืึทืื ืขืจืึทืืืืืื ืืื ืขืงืกืื ืืขืื ืึทืจืืืขืจืคืืจื ืึทืืขื ื (MTA) ืืืขื ื ืืฆื TLS ืคึฟืึทืจ ืืืขืจืกืืขืก ืคืื ืงืกื ืืืงืก ืฆื ืงืกื ืืืงืก ืื ืงืืืกืืื, ืึทืืึทืืื ื ืืืืึทื ืืืกืคืืจื ืงืึธื ืืื ืคึผืจืืืืืืืืฉื ืจืขืื ().
ืืืึทืื ืขืจืึทืืืืืื
ืื ืืืึทืื ืขืจืึทืืืืืื ืืื ืคืึธืจืฉืืขืื ืืืขื ื ืืฆื ืืืืืข ืื GnuTLS ืืื OpenSSL ืืืืืจืขืจืื ืืืขื ืืจืื ืื ืึท ืืืืขืจ TLS ืคึฟืึทืจืืื ืืื ื.
ืืืื ืืขืจ ืืขืืืขืืึธืคึผืขืจ Heiko Schlittermann, ืื ืงืึทื ืคืืืืขืจืืืฉืึทื ืืขืงืข ืืื ืขืงืกืื ืืื ื ืืฉื ื ืืฆื TLS ืืืจื ืคืขืืืงืืึทื, ืึธืืขืจ ืคืืืข ืืืกืืจืืืืืฉืึทื ื ืืึทืื ืื ื ืืืืืง ืกืขืจืืืคืืงืึทืฅ ืืขืฉืึทืก ืื ืกืืึทืืืจืื ื ืืื ืืขืื ืึท ืืืืขืจ ืงืฉืจ. ืืืื ื ืืึทืขืจ ืืืขืจืกืืขืก ืคืื ืขืงืกืื ืื ืกืืึทืืืจื ืื ืึธืคึผืฆืืข tls_advertise_hosts=* ืืื ืืืฉืขื ืขืจืืื ืื ื ืืืืืง ืกืขืจืืืคืืงืึทืฅ.
ืืขืคึผืขื ืืก ืืืืฃ ืื ืงืึทื ืคืืืืขืจืืืฉืึทื. ืจืืึฟ ืืืกืืจืึธืก ืืขืื ืขืก ืืืจื ืคืขืืืงืืึทื, ืึธืืขืจ ืขืงืกืื ืืึทืจืฃ ืึท ืืึทืืืืึทืื + ืฉืืืกื ืฆื ืึทืจืืขืื ืืื ืึท TLS ืกืขืจืืืขืจ. ืืืกืืึธืืข ืืืกืืจืึธืก ืืึทืื ืึท ืกืขืจื ืืขืฉืึทืก ืกืขืืึทืคึผ. ื ืืึทืขืจ ืขืงืกืืืก ืืึธืื ืื tls_advertise_hosts ืึธืคึผืฆืืข ืืืคืึธืืืื ื ืฆื "*" ืืื ืฉืึทืคึฟื ืึท ืืื ืืขืืชืืขื ืืึทืืืืึทืื, ืืืื ืืึธืจื ืื ืืื ืฆืืืขืฉืืขืื.
ืื ืืืึทืื ืขืจืึทืืืืืื ืืื ืืืื ืืื ืคืึทืืฉ ืคึผืจืึทืกืขืกืื ื ืคืื SNI (Server Name Indication, ืึท ืืขืื ืึธืืึธืืืข ืืึทืงืขื ืขื ืืื 2003 ืืื RFC 3546 ืคึฟืึทืจ ืึท ืงืืืขื ื ืฆื ืืขืื ืื ืจืืืืืง ืืึทืืืืึทืื ืคึฟืึทืจ ืึท ืคืขืื ื ืึธืืขื, ) ืืขืฉืึทืก ืึท TLS ืืึทื ืืฉืืืง. ืึท ืึทืืึทืงืขืจ ืืึทืจืฃ ื ืึธืจ ืฉืืงื ืึทื SNI ืืื ืึท ืฆืืจืืง-ืฉืืึธืื ("") ืืื ืึท ื ืึทื ืืึทืจืึทืงืืขืจ (" ").
ืจืขืกืขืึทืจืืฉืขืจืก ืคืื ืงืืืึทืืืก ืืึธืื ืืืกืงืึทืืืขืจื ืึท ืืฉืืง ืืื ืื string_printing(tls_in.sni) ืคึฟืื ืงืฆืืข, ืืืึธืก ืื ืืืึทืืืื ืคืึทืืฉ ืึทื ืืืืืคื ืคืื "". ืืื ืึท ืจืขืืืืืึทื, ืื ืืึทืงืงืืึทืฉ ืืื ืืขืฉืจืืื ืึทื ืขืกืงืึทืคึผื ืฆื ืื ืืจืืง ืฉืคึผืืืงืข ืืขืืขืจ ืืขืงืข. ืืขืจ ืืขืงืข ืืื ืืขืจื ืึธื ืืืืขื ืขื ืืื ืคึผืจืืืืืืืืฉื ืจืขืื ืืืจื ืื spool_read_header () ืคึฟืื ืงืฆืืข, ืืืึธืก ืคืืจื ืฆื ืืืืคื ืึธืืืืขืจืคืืึธื.
ืขืก ืืื ืืืื ืฆื ืืืืขืจืงื ืึทื ืืื ืืขื ืืึธืืขื ื, ืขืงืกืื ืืขืืืขืืึธืคึผืขืจืก ืืึธืื ืืืฉืืคื ืึท ืคึผืึธืง ืคืื ืืืึทืื ืขืจืึทืืืืืืื ืืื ืื ืืืจืืคืืจืื ื ืคืื ืงืึทืืึทื ืื ืืืืฃ ืึท ืืืืึทื ืฉืคึผืืจืขืืืืืง ืกืขืจืืืขืจ, ืึธืืขืจ ืขืก ืืื ื ืึธื ื ืืฉื ืขืคื ืืืขื ืื ืืืฆื. ืจืขืื ืฆื ืืขืจ ืื ืคืื ืขืงืกืคึผืืืืืืืฉืึทื ืคืื ืืขื ืืฉืืง, ืขืก ืืื ื ืึธืจ ืึท ืขื ืื ืคืื ืฆืืื ืืื ืืึทื ืฅ ืงืืจืฅ.
ื ืืขืจ ืืืืืืื ืืขืจื ืขื ืืืจื Qualys ืงืขื ืขื ืืืื ืืขืคึฟืื ืขื .
ื ืืฆื SNI ืืื TLS
ื ืืืขืจ ืคืื ืคึผืึทืืขื ืืฉืึทืื ืฉืคึผืืจืขืืืืืง ืฆืืืืจ ืกืขืจืืืขืจืก
ืืืื ืฆื ืกืืึทืืืกืืืง ืคืื ืึท ืืจืืืก ืืึธืกืืื ื ืฉืคึผืืึทืืขืจ E-Soft ืื ืง ืืื ื ืกืขืคืืขืืืขืจ 1, ืืืืฃ ืจืขื ืืึทื ืกืขืจืืืขืจืก, ืืืขืจืกืืข 4.92 ืืื ืืขื ืืฆื ืืื ืืขืจ ืืื 70% ืคืื ืืื ืืช.
ืืืขืจืกืืข
ื ืืืขืจ ืคืื ืกืขืจืืืขืจืก
ืคึผืจืึธืฆืขื ื
4.92.1
6471
ืงืกื ืืืงืก%
4.92
376436
ืงืกื ืืืงืก%
4.91
58179
ืงืกื ืืืงืก%
4.9
5732
ืงืกื ืืืงืก%
4.89
10700
ืงืกื ืืืงืก%
4.87
14177
ืงืกื ืืืงืก%
4.84
9937
ืงืกื ืืืงืก%
ืื ืืขืจืข ืืืขืจืกืืขืก
25568
ืงืกื ืืืงืก%
ืื ืคืืจืืข E-Soft Inc
ืืืื ืืืจ ื ืืฆื ืึท ืืืื ืืึธืืึธืจ , ืืขืืึธืื ืคืื 5,250,000 ืืื ืื ืกืขืจืืืขืจ ืืึทืืึทืืืืก:
- ืืืขืื 3,500,000 ื ืืฆื ืขืงืกืื 4.92 (ืืืขืื 1,380,000 ื ืืฆื ืกืกื / ืืืก);
- ืืืืขืจ 74,000 ื ืืฆื 4.92.1 (ืืืขืื 25,000 ื ืืฆื SSL / TLS).
ืืืื, ืขืคื ืืืขื ืืึทืืืืกื ืืื ืฆืืืจืืืืขื ืขืงืกืื ืคึผืึทืืขื ืืฉืึทืื ืฉืคึผืืจืขืืืืืง ืกืขืจืืืขืจืก ื ืืืขืจ ืืืขืื 1.5M.
ืืืื ืคึฟืึทืจ ืขืงืกืื ืกืขืจืืืขืจืก ืืื ืฉืึธืืึทื
ืฉืืฅ
- ืื ืกืืืคึผืืึทืกื, ืึธืืขืจ ื ืืฉื ืจืขืงืึทืืขื ืืื, ืึธืคึผืฆืืข ืืื ื ืืฉื ืฆื ื ืืฆื TLS, ืืืึธืก ืืืขื ืคืืจื ืฆื ืืืืฆืคึผืึธืกื ืึทืจืืืงืืขื.
- ืฆื ืืืกืืืืื ืขืงืกืคึผืืืืืืืฉืึทื ืคืื ืื ืืืึทืื ืขืจืึทืืืืืื, ืขืก ืืืึธืื ืืืื ืืขืจ ืืืืืขืจ ืฆื ืืขืจืืืึทื ืืืงื ืฆื ืื ืืืขืจืกืืข .
- ืืืื ืขืก ืืื ืืืืืขืืืขื ืฆื ืืขืจืืืึทื ืืืงื ืึธืืขืจ ืื ืกืืึทืืืจื ืึท ืคึผืึทืืฉื ืืืขืจืกืืข, ืืืจ ืงืขื ืขื ืฉืืขืื ืึทื ืึทืงื ืืื ืื ืขืงืกืื ืงืึทื ืคืืืืขืจืืืฉืึทื ืคึฟืึทืจ ืื ืึธืคึผืฆืืข acl_smtp_mail ืืื ืื ืคืืืืขื ืืข ืืืืื:
# to be prepended to your mail acl (the ACL referenced # by the acl_smtp_mail main config option) deny condition = ${if eq{}{${substr{-1}{1}{$tls_in_sni}}}} deny condition = ${if eq{}{${substr{-1}{1}{$tls_in_peerdn}}}}
ืืงืืจ: www.habr.com