ื ืงืจืืืืฉ ืืืึทืื ืขืจืึทืืืืืื (CVE-2023-32154) ืืื ืืืืขื ืึทืคืืื ืืื ืื RouterOS ืึธืคึผืขืจืืืืื ื ืกืืกืืขื ืืขื ืืฆื ืืื MikroTik ืจืึธืืืขืจืก, ืืืึธืก ืึทืืึทืื ืึทื ืึทื ืึธืืืขื ืืืงืืืืื ืืึทื ืืฆืขืจ ืฆื ืจืืืึธืืืื ืืืกืคืืจื ืงืึธื ืืืืฃ ืื ืืืื ืืืจื ืฉืืงื ืึท ืกืคึผืขืฉืื ืืืืืื ื IPv6 ืจืึทืืืขืจ ืึทื (RA, Router Advertisement).
ืืขืจ ืคึผืจืึธืืืขื ืืื ืืขืคึฟืืจื ืืืจื ืื ืคืขืื ืคืื ืืขืืขืจืืง ืืืขืจืึทืคืึทืงืืืฉืึทื ืคืื ืืึทืื ืืืึธืก ืงืืืขื ืคึฟืื ืึทืจืืืก ืืื ืืขื ืคึผืจืึธืฆืขืก ืคืึทืจืึทื ืืืืึธืจืืืขื ืคึฟืึทืจ ืคึผืจืึทืกืขืกืื ื IPv6 RA (ืจืึธืืืขืจ ืืึทื ืฆืข) ืจืืงืืืขืก, ืืืึธืก ืืขืืืื ืขืก ืืขืืืขื ืฆื ืฉืจืืึทืื ืืึทืื ืืืืึทืืขืจ ืคืื ืื ืืืืื ืคืื ืื ืึทืืึทืงืืืืื ืืึทืคืขืจ ืืื ืึธืจืืึทื ืืืืจื ืื ืืืจืืคืืจืื ื ืคืื ืืืื ืงืึธื ืืื ืืืึธืจืฆื ืคึผืจืืืืืืึทืืืฉืึทื. ืื ืืืึทืื ืขืจืึทืืืืืื ืืื ืืจืืืก ืืื ืื MikroTik RouterOS v6.xx ืืื v7.xx ืฆืืืืืื, ืืืขื IPv6 RA ืืื ืขื ืืืืึทืื ืืื ืื ืกืขืืืื ืืก ืคึฟืึทืจ ืจืืกืืืืื ื IPv6 RA ืึทืจืืืงืืขื ("ipv6/settings/ set accept-router-advertisements=yes" ืึธืืขืจ "ipvXNUMX/settings/ ืฉืืขืื ืคืึธืจืืืก = ื ืื ืึธื ื ืขืืขื-ืจืึธืืืขืจ - ืืึทื ืฆืข = ืืึธ-ืืืื-ืคืึธืจืืืขืจืืื ื-ืคืึทืจืงืจืืคึผืื").
ืื ืคืืืืงืืื ืฆื ื ืืฆื ืื ืืืึทืื ืขืจืึทืืืืืื ืืื ืคืืจ ืืื ืืขืืึทื ืกืืจืืืืื ืืื ืื Pwn2Own ืคืึทืจืืขืกื ืืื ืืึธืจืึธื ืืึธ, ืืขืฉืึทืก ืืืึธืก ืื ืจืืกืขืจืืฉืขืจื ืืืึธืก ืืืืขื ืึทืคืืื ืืขื ืคึผืจืึธืืืขื ืืืงืืืขื ืึท ืืึทืืืื ืื ื ืคืื $ 100,000 ืคึฟืึทืจ ืึท ืืืืื-ืืื ืข ืืึทืง ืคืื ืื ืื ืคืจืึทืกืืจืึทืงืืฉืขืจ ืืื ืึท ืืึทืคืึทืื ืืืืฃ ืื ืืืงืจืึธืืืง ืจืึทืืืขืจ ืืื ื ืืฆื ืขืก ืืื ืึท ืกืคึผืจืื ืืืึธืจื ืคึฟืึทืจ ืึท ืืึทืคืึทืื ืืืืฃ ืื ืืขืจืข ืงืึทืืคึผืึธืื ืึทื ืฅ ืคืื ืื ืืืืข ื ืขืฅ (ืฉืคึผืขืืขืจ ืึทืืึทืงืขืจื ืคืืจืืื ื ืงืึธื ืืจืึธื ืคืื ืึท ืงืึทื ืึธื ืืจืืงืขืจ, ืืื ืคึฟืึธืจืืึทืฆืืข ืืืขืื ืื ืืืึทืื ืขืจืึทืืืืืื ืืื ืืืึธืก ืืื ืืืื ืืืกืงืืึธืืื).
ืืื ืคึฟืึธืจืืึทืฆืืข ืืืขืื ืื ืืืึทืื ืขืจืึทืืืืืื ืืื ืืืืืขืก ืืจืืืก ืืืืืขืจ ืื ืืึทืืข ืืื ืืขืืืขื ืืืฉืืคื ืืืจื ืืขืจ ืคืึทืืจืืงืึทื ื (0-ืืึธื), ืึธืืขืจ RouterOS 7.9.1, 6.49.8, 6.48.7, 7.10beta8 ืืขืจืืืึทื ืืืงืื ืืขื ืืืึธืก ืคืึทืจืจืืืื ืื ืืืึทืื ืขืจืึทืืืืืื ืืขื ืขื ืฉืืื ืืจืืืก. ืืืื ืืื ืคึฟืึธืจืืึทืฆืืข ืคืื โโืื ZDI (Zero Day Initiative) ืคึผืจืืืขืงื, ืืืึธืก ืืืืคื ืื Pwn2Own ืคืึทืจืืขืกื, ืืขืจ ืคืึทืืจืืงืึทื ื ืืื ืืขืืืขื ื ืึธืืืึทืคืืื ืืืขืื ืื ืืืึทืื ืขืจืึทืืืืืื ืืืืฃ 29 ืืขืฆืขืืืขืจ 2022. ืื ืคืืจืฉืืืืขืจืก ืคืื ืืืงืจืึธืืืง ืคืึธืืขืจื ืึทื ืืื ืืึธืื ื ืืฉื ืืึทืงืืืขื ืึธื ืืึธื ืืื ื ืึธืจ ืืขืืขืจื ื ืืืขืื ืืขื ืคึผืจืึธืืืขื ืืืืฃ ืืื 10, ื ืึธื ืฉืืงื ืื ืืขืฆื ืึทื ืืคึผืืขืงืื ื ืืืืจืขื ืื ื. ืืื ืึทืืืฉืึทื, ืืขืจ ืืืึทืื ืขืจืึทืืืืืื ืืึทืจืืื ืืขืจืืื ื ืึทื ืืื ืคึฟืึธืจืืึทืฆืืข ืืืขืื ืื ื ืึทืืืจ ืคืื ืืขื ืคึผืจืึธืืืขื ืืื ืงืึทืืืื ืึทืงืืืืื ืฆื ืึท MikroTik ืคืืจืฉืืืืขืจ ืืื ืืขื ืืฉ ืืขืฉืึทืก ืื Pwn2Own ืคืึทืจืืขืกื ืืื ืืึธืจืึธื ืืึธ, ืึธืืขืจ ืืืื MikroTik, MikroTik ืขืืคึผืืืืื ืืึธืื ื ืืฉื ืึธื ืืืื ื ืขืืขื ืืื ืืขืจ ืืขืฉืขืขื ืืฉ ืืื ืงืืื ืงืึทืคึผืึทืฆืืืขื.
ืืงืืจ: opennet.ru