ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™ ืื™ืŸ ppppd ืื•ืŸ lwIP ืึทื– ืึทืœืึทื•ื– ื“ื•ืจื›ืคื™ืจื•ื ื’ ืคื•ืŸ ื•ื•ื™ื™ึทื˜ ืงืึธื“ ืžื™ื˜ ื•ื•ืึธืจืฆืœ ืคึผืจื™ื•ื•ื™ืœืึทื“ื–ืฉืึทื–

ืื™ืŸ ืคึผืขืงืœ pppd ื™ื™ื“ืขื ืึทืคื™ื™ื“ ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™ (CVE-2020-8597), ืึทืœืึทื•ื™ื ื’ ืื™ืจ ืฆื• ื•ื™ืกืคื™ืจืŸ ื“ื™ื™ืŸ ืงืึธื“ ื“ื•ืจืš ืฉื™ืงืŸ ืกืคึผืขืฆื™ืขืœ ื“ื™ื–ื™ื™ื ื“ ืึธื˜ืขื ื˜ืึทืงื™ื™ืฉืึทืŸ ืจื™ืงื•ื•ืขืก ืฆื• ืกื™ืกื˜ืขืžืขืŸ ื ื™ืฆืŸ ื“ื™ PPP (Point-to-Point Protocol) ืึธื“ืขืจ PPPoE (PPP over Ethernet) ืคึผืจืึธื˜ืึธืงืึธืœ. ื“ื™ ืคึผืจืึธื˜ืึธืงืึธืœืก ื–ืขื ืขืŸ ื™ื•ื–ืฉืึทื•ื•ืึทืœื™ ื’ืขื ื™ืฆื˜ ื“ื•ืจืš ืคึผืจืึทื•ื•ื™ื™ื“ืขืจื– ืฆื• ืึธืจื’ืึทื ื™ื–ื™ืจืŸ ืงืึทื ืขืงืฉืึทื ื– ื“ื•ืจืš ืขื˜ื”ืขืจื ืขื˜ ืึธื“ืขืจ ื“ืกืœ, ืื•ืŸ ื–ืขื ืขืŸ ืื•ื™ืš ื’ืขื ื™ืฆื˜ ืื™ืŸ ืขื˜ืœืขื›ืข ื•ื•ืคึผืŸ (ืœืžืฉืœ, pptpd ืื•ืŸ openfortivpn). ืฆื• ืงืึธื ื˜ืจืึธืœื™ืจืŸ ืื•ื™ื‘ ื“ื™ื™ืŸ ืกื™ืกื˜ืขืžืขืŸ ื–ืขื ืขืŸ ืึทืคืขืงื˜ืึทื“ ื“ื•ืจืš ื“ืขื ืคึผืจืึธื‘ืœืขื ืฆื•ื’ืขื’ืจื™ื™ื˜ ื ื•ืฆืŸ ืคึผืจืึธื•ื˜ืึทื˜ื™ื™ืคึผ.

ื“ื™ ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™ ืื™ื– ื’ืขืคึฟื™ืจื˜ ื“ื•ืจืš ืึท ื‘ืึทืคืขืจ ืึธื•ื•ื•ืขืจืคืœืึธื• ืื™ืŸ ื“ื™ ื™ืžืคึผืœืึทืžืขื ื˜ื™ื™ืฉืึทืŸ ืคื•ืŸ ื“ื™ EAP (ืขืงืกื˜ืขื ืกื™ื‘ืœืข ืึทื•ื˜ื”ืขื ื˜ื™ืงืึทื˜ื™ืึธืŸ ืคึผืจืึธื˜ืึธืงืึธืœ) ืึธื˜ืขื ื˜ืึทืงื™ื™ืฉืึทืŸ ืคึผืจืึธื˜ืึธืงืึธืœ. ื“ื™ ื‘ืึทืคืึทืœืŸ ืงืขื ืขืŸ ื–ื™ื™ืŸ ื“ื•ืจื›ื’ืขืงืึธื›ื˜ ืื™ืŸ ื“ื™ ืคืึทืจ-ืึธื˜ืขื ื˜ืึทืงื™ื™ืฉืึทืŸ ื‘ื™ื ืข ื“ื•ืจืš ืฉื™ืงืŸ ืึท ืคึผืึทืงืึทื˜ ืžื™ื˜ ื˜ื™ืคึผ EAPT_MD5CHAP, ืึทืจื™ื™ึทื ื’ืขืจืขื›ื ื˜ ืึท ื–ื™ื™ืขืจ ืœืึทื ื’ ื‘ืึทืœืขื‘ืึธืก ื ืึธืžืขืŸ ื•ื•ืึธืก ืื™ื– ื ื™ืฉื˜ ืคึผืึทืกื™ืง ืื™ืŸ ื“ื™ ืึทืœืึทืงื™ื™ื˜ื™ื“ ื‘ืึทืคืขืจ. ืจืขื›ื˜ ืฆื• ืึท ื–ืฉื•ืง ืื™ืŸ ื“ื™ ืงืึธื“ ืคึฟืึทืจ ืงืึธื ื˜ืจืึธืœื™ืจื•ื ื’ ื“ื™ ื’ืจื™ื™ืก ืคื•ืŸ ื“ื™ ืจื”ืึธืกื˜ื ืึทืžืข ืคืขืœื“, ืึท ืึทื˜ืึทืงืขืจ ืงืขืŸ ืึธื•ื•ื•ืขืจืจื™ื™ื˜ ื“ืึทื˜ืŸ ืึทืจื•ื™ืก ื“ื™ ื‘ืึทืคืขืจ ืื•ื™ืฃ ื“ืขื ืึธื ืœื™ื™ื’ืŸ ืื•ืŸ ื“ืขืจื’ืจื™ื™ื›ืŸ ื•ื•ื™ื™ึทื˜ ื“ื•ืจื›ืคื™ืจื•ื ื’ ืคื•ืŸ ื–ื™ื™ืขืจ ืงืึธื“ ืžื™ื˜ ื•ื•ืึธืจืฆืœ ืจืขื›ื˜. ื“ื™ ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™ ืžืึทื ืึทืคืขืกืฅ ื–ื™ืš ืื•ื™ืฃ ื“ื™ ืกืขืจื•ื•ืขืจ ืื•ืŸ ืงืœื™ืขื ื˜ ื–ื™ื™ื˜ืŸ, ื“.ื”. ื ื™ื˜ ื‘ืœื•ื™ื– ื“ืขืจ ืกืขืจื•ื•ืขืจ ืงืขื ืขืŸ ื–ื™ื™ืŸ ืึทื˜ืึทืงื™ืจื˜, ืึธื‘ืขืจ ืื•ื™ืš ืึท ืงืœื™ืขื ื˜ ื˜ืจื™ื™ื ื’ ืฆื• ืคืึทืจื‘ื™ื ื“ืŸ ืฆื• ืึท ืกืขืจื•ื•ืขืจ ืงืึทื ื˜ืจืึธื•ืœื“ ื“ื•ืจืš ื“ื™ ืึทื˜ืึทืงืขืจ (ืœืžืฉืœ, ืึท ืึทื˜ืึทืงืขืจ ืงืขื ืขืŸ ืขืจืฉื˜ืขืจ ื›ืึทืง ื“ื™ ืกืขืจื•ื•ืขืจ ื“ื•ืจืš ืึท ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™, ืื•ืŸ ื“ืขืžืึธืœื˜ ืึธื ื”ื™ื™ื‘ืŸ ืฆื• ื‘ืึทืคืึทืœืŸ ืงืึทื ืขืงื˜ื™ื ื’ ืงืœื™ื™ืึทื ืฅ).

ื“ืขืจ ืคึผืจืึธื‘ืœืขื ืึทืคืขืงืฅ ื•ื•ืขืจืกื™ืขืก ppd ืคื•ืŸ 2.4.2 ืฆื• 2.4.8 ื™ื ืงืœื•ืกื™ื•ื• ืื•ืŸ ื™ืœื™ืžืึทื ื™ื™ื˜ืึทื“ ืื™ืŸ ื“ื™ ืคืึธืจืขื ืœืึทื˜ืข. ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™ ืื•ื™ืš ืึทืคืขืงืฅ ืึธื ืœื™ื™ื’ืŸ lwIP, ืึธื‘ืขืจ ื“ื™ ืคืขืœื™ืงื™ื™ึทื˜ ืงืึทื ืคื™ื’ื™ืขืจื™ื™ืฉืึทืŸ ืื™ืŸ lwIP ืงืขืŸ ื ื™ืฉื˜ ื’ืขื‘ืŸ EAP ืฉื˜ื™ืฆืŸ.

ื“ื™ ืกื˜ืึทื˜ื•ืก ืคื•ืŸ ืคื™ืงืกื™ืจ ื“ืขื ืคึผืจืึธื‘ืœืขื ืื™ืŸ ืคืึทืจืฉืคึผืจื™ื™ื˜ื•ื ื’ ืงื™ืฅ ืงืขื ืขืŸ ื–ื™ื™ืŸ ื•ื•ื™ื•ื“ ืื•ื™ืฃ ื“ื™ ื‘ืœืขื˜ืขืจ: ื“ืขื‘ื™ืึทืŸ, ื•ื‘ื•ื ื˜ื•, rhel, ืคืขื“ืึธืจืึท, sususe, openwrt, ืึทืจื˜ืฉ, ื ืขื˜ื‘ืกื“. ืื•ื™ืฃ RHEL, OpenWRT ืื•ืŸ SUSE, ื“ื™ ppppd ืคึผืขืงืœ ืื™ื– ื’ืขื‘ื•ื™ื˜ ืžื™ื˜ ื“ื™ "ืกื˜ืึทืง ืกืžืึทืฉื™ื ื’ ืคึผืจืึทื˜ืขืงืฉืึทืŸ" ืฉื•ืฅ ืขื ื™ื™ื‘ืึทืœื“ (ื“ื™ "-ืคืกื˜ืึทืง-ืคึผืจืึธื˜ืขืงื˜ืึธืจ" ืžืึธื“ืข ืื™ืŸ ื’ืงืง), ื•ื•ืึธืก ืœื™ืžืึทืฅ ืขืงืกืคึผืœื•ื™ื˜ื™ื™ืฉืึทืŸ ืฆื• ื“ื•ืจื›ืคืึทืœ. ืื™ืŸ ืึทื“ื™ืฉืึทืŸ ืฆื• ื“ื™ืกื˜ืจื™ื‘ื™ื•ืฉืึทื ื–, ื“ื™ ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™ ืื™ื– ืื•ื™ืš ื‘ืืฉื˜ืขื˜ื™ืงื˜ ืื™ืŸ ืขื˜ืœืขื›ืข ืคึผืจืึธื“ื•ืงื˜ืŸ ืกื™ืกืงืึธ (ืจื•ืคืŸ ืคืึทืจื•ื•ืึทืœื˜ืขืจ) TP LINK ืื•ืŸ ืกื™ื ืึธืœืึธื’ื™ (ื“ื™ืกืงืกื˜ืึทื˜ื™ืึธืŸ ืžืึทื ืึทื’ืขืจ, ื•ื•ื™ืกื•ืึทืœ ืกื˜ื™ื™ืฉืึทืŸ ื•ื•ืก960ื”ื“ ืื•ืŸ ืจืึทื•ื˜ืขืจ ืžืึทื ืึทื’ืขืจ) ื ื™ืฆืŸ ืคึผืคึผืคึผื“ ืึธื“ืขืจ ืœื•ื•ื™ืคึผ ืงืึธื“.

ืžืงื•ืจ: opennet.ru

ืœื™ื™ื’ืŸ ืึท ื‘ืึทืžืขืจืงื•ื ื’