ืงืขืจืขืงืืืื ืืขืจืืืึทื ืืืงืื ืืขื ืืขื ืขื ืืจืืืก ืคึฟืึทืจ ืื ืกืืึทืืื ืฆืืืืืื ืคืื ืื BIND DNS ืกืขืจืืืขืจ 9.11.31 ืืื 9.16.15, ืืื ืืขืืื ื ืืื ืื ืืงืกืคึผืขืจืืขื ืึทื ืฆืืืืึทื 9.17.12, ืืืึธืก ืืื ืืื ืึทื ืืืืืงืืื ื. ืื ื ืืึทืข ืจืืืืกืื ืึทืืจืขืก ืืจืื ืืืึทืื ืขืจืึทืืืืืืื, ืืืื ืขืจ ืคืื ืืืึธืก (CVE-2021-25216) ื ืึท ืืึทืคืขืจ ืึธืืืืขืจืคืืึธื. ืืืืฃ 32-ืืืกื ืกืืกืืขืืขื, ืื ืืืึทืื ืขืจืึทืืืืืื ืงืขื ืขื ืืืื ืขืงืกืคึผืืืืืึทื ืฆื ืจืืืึธืืืื ืืืกืคืืจื ืึท ืึทืืึทืงืขืจ ืก ืงืึธื ืืืจื ืฉืืงื ืึท ืกืคึผืขืฆืืขื ืงืจืึทืคืืขื GSS-TSIG ืืขืื. ืืืืฃ 64 ืกืืกืืขืืขื ืื ืคึผืจืึธืืืขื ืืื ืืืืืืขื ืฆื ืื ืงืจืึทื ืคืื ืื ืืขืืืืกื ืคึผืจืึธืฆืขืก.
ืืขืจ ืคึผืจืึธืืืขื ืืื ืืืืื ืืจืืืก ืืืขื ืื GSS-TSIG ืืขืงืึทื ืืืึทื ืืื ืขื ืืืืึทืื, ืึทืงืืืืืืืืื ืืื ืื tkey-gssapi-keytab ืืื tkey-gssapi-ืงืจืขืืขื ืฉืึทื ืกืขืืืื ืืก. GSS-TSIG ืืื ืคืึทืจืงืจืืคึผืื ืืื ืื ืคืขืืืงืืึทื ืงืึทื ืคืืืืขืจืืืฉืึทื ืืื ืืื ืืืคึผืืงืื ืืขื ืืฆื ืืื ืืขืืืฉื ืื ืืืืืจืึทื ืืึทื ืฅ ืืื BIND ืืื ืงืึทืืืืื ื ืืื ืึทืงืืืืืข Directory ืคืขืื ืงืึทื ืืจืึธืืืขืจื, ืึธืืขืจ ืืืขื ืื ืืึทืืจืืืืื ื ืืื Samba.
ืื ืืืึทืื ืขืจืึทืืืืืื ืืื ืืขืคึฟืืจื ืืืจื ืึท ืืขืืช ืืื ืื ืืืคึผืืึทืืขื ืืืืฉืึทื ืคืื ืื SPNEGO (Simple and Protected GSSAPI Negotiation Mechanism) ืืขืงืึทื ืืืึทื, ืืขื ืืฆื ืืื GSSAPI ืฆื ืคืึทืจืืึทื ืืืขื ืื ืฉืืฅ ืืขืืืึธืืก ืืขื ืืฆื ืืืจื ืืขื ืงืืืขื ื ืืื ืกืขืจืืืขืจ. GSSAPI ืืื ืืขื ืืฆื ืืื ืึท ืืืื-ืืืจืื ืคึผืจืึธืืึธืงืึธื ืคึฟืึทืจ ืืืืขืจ ืฉืืืกื ืืืขืงืกื ืืื ืื GSS-TSIG ืคืึทืจืืขื ืืขืจืื ื ืืขื ืืฆื ืืื ืืขื ืคึผืจืึธืฆืขืก ืคืื ืึธืืขื ืืึทืงืืืืื ื ืืื ืึทืืืฉ ืื ืก ืืึธื ืข ืืขืจืืืึทื ืืืงืื ืืขื.
ืืืืึทื ืงืจืืืืฉ ืืืึทืื ืขืจืึทืืืืืืื ืืื ืื ืืขืืืื-ืืื ืืืคึผืืึทืืขื ืืืืฉืึทื ืคืื SPNEGO ืืึธืื ืฉืืื ืืขืคึฟืื ืขื ืคืจืืขืจ, ืื ืืืคึผืืึทืืขื ืืืืฉืึทื ืคืื ืืขื ืคึผืจืึธืืึธืงืึธื ืืื ืึทืืืขืงืืขื ืืืขื ืคืื ืื BIND 9 ืงืึธื ืืึทืืข. ืกืืกืืขื ืืืืืืึธืืขืง (ืฆืืืขืฉืืขืื ืืื MIT Kerberos ืืื Heimdal Kerberos).
ื ืืฆืขืจืก ืคืื ืขืืืขืจืข ืืืขืจืกืืขืก ืคืื BIND, ืืื ืึท ืืืึธืจืงืึทืจืึธืื ื ืคึฟืึทืจ ืืืึทืงืื ื ืืขื ืคึผืจืึธืืืขื, ืงืขื ืขื ืืืกืืืืึทื GSS-TSIG ืืื ืื ืกืขืืืื ืืก (ืึธืคึผืฆืืขืก tkey-gssapi-keytab ืืื tkey-gssapi-credential) ืึธืืขืจ ืจืืืืื BIND ืึธื ืฉืืืฆื ืคึฟืึทืจ ืื SPNEGO ืืขืงืึทื ืืืึทื (ืึธืคึผืฆืืข "- -disable-isc-spnego" ืืื ืฉืจืืคื "ืงืึธื ืคืืืืจืข"). ืืืจ ืงืขื ืขื ืฉืคึผืืจ ืื ืึทืืืืืืึทืืืืึทืื ืคืื ืืขืจืืืึทื ืืืงืื ืืขื ืืื ืืืกืืจืืืืืฉืึทื ื ืืืืฃ ืื ืคืืืืขื ืืข ืืืขืืขืจ: Debian, SUSE, Ubuntu, Fedora, Arch Linux, FreeBSD, NetBSD. RHEL ืืื ALT ืืื ืืงืก ืคึผืึทืงืึทืืืฉืึทื ืืขื ืขื ืืขืืืื ืึธื ืืขืืืืจื SPNEGO ืฉืืืฆื.
ืึทืืืืืืึธื ืึทืืื, ืฆืืืื ืืขืจ ืืืึทืื ืขืจืึทืืืืืืื ืืขื ืขื ืคืึทืจืคืขืกืืืงื ืืื ืื BIND ืืขืจืืืึทื ืืืงืื ืืขื ืืื ืงืฉืื:
- CVE-2021-25215 - ืืขืจ ืืขืืืืกื ืคึผืจืึธืฆืขืก ืงืจืึทืฉื ืืืขื ืคึผืจืึทืกืขืกืื ื DNAME ืจืขืงืึธืจืืก (ืจืืืขืจืขืงื ืคึผืจืึทืกืขืกืื ื ืคืื ืืืื ืคืื ืกืืืืึธืืึทืื ืก), ืืืึธืก ืคืืจื ืฆื ืื ืึทืืืฉืึทื ืคืื ืืืคึผืืืงืึทืื ืฆื ืื ANSWER ืึธืคึผืืืืืื ื. ื ืืฆื ืื ืืืึทืื ืขืจืึทืืืืืื ืืืืฃ ืึทืืึธืจืึทืืืืืืื ืื ืก ืกืขืจืืืขืจืก ืจืืงืืืืืขืจื ืขื ืืขืจืื ืืขื ืฆื ืื ืคึผืจืึทืกืขืกื ืื ืก ืืึธื ืขืก, ืืื ืคึฟืึทืจ ืจืขืงืืจืกืืืืข ืกืขืจืืืขืจืก, ืื ืคึผืจืึธืืืขืืึทืืืง ืจืขืงืึธืจื ืงืขื ืขื ืืืื ืืืงืืืขื ื ืึธื ืงืึธื ืืึทืงื ืืื ืื ืึทืืึธืจืึทืืืืืืื ืกืขืจืืืขืจ.
- CVE-2021-25214 - ืืขืจ ืืขืืืืกื ืคึผืจืึธืฆืขืก ืงืจืึทืฉืื ืืืขื ืคึผืจืึทืกืขืกืื ื ืึท ืกืคึผืขืฆืืขื ืงืจืึทืคืืขื ืื ืงืึทืืื ื IXFR ืืขืื (ืืขื ืืฆื ืฆื ืื ืงืจืึทืืขื ืืึทืื ืึทืจืืืขืจืคืืจื ืขื ืืขืจืื ืืขื ืืื ืื ืก ืืึธื ืขืก ืฆืืืืฉื ืื ืก ืกืขืจืืืขืจืก). ืืขืจ ืคึผืจืึธืืืขื ืึทืคืขืงืฅ ืืืืื ืกืืกืืขืืขื ืืืึธืก ืืึธืื ืขืจืืืืื ืื ืก ืืึธื ืข ืืจืึทื ืกืคืขืจืก ืคืื ืื ืึทืืึทืงืขืจ ืก ืกืขืจืืืขืจ (ืืืืฉืึทืืืึทืื ืืึธื ืข ืืจืึทื ืกืคืขืจืก ืืขื ืขื ืืขื ืืฆื ืฆื ืกืื ืืงืจืึทื ืืื ืืขื ืืื ืฉืงืืึทืฃ ืกืขืจืืืขืจืก ืืื ืืขื ืขื ืกืึทืืขืงืืืืืื ืขืจืืืืื ืืืืื ืคึฟืึทืจ ืืจืึทืกืืืืขืจืื ืกืขืจืืืขืจืก). ืืื ืึท ืืืืขืจืืืื ืืืึธืจืงืึทืจืึธืื ื, ืืืจ ืงืขื ืขื ืืืกืืืืึทื IXFR ืฉืืืฆื ื ืืฆื ืื "ืจืขืงืืืขืกื-ixfr ืงืืื;" ืืึทืฉืืขืืืงื.
ืืงืืจ: opennet.ru