Ukulimala okubalulekile kumishini yezokwelapha yokuqapha isiguli

Inkampani ye-CyberMDX kwenziwe obala ulwazi mayelana ubuthakathaka obuyisithupha, okuthinta amadivayisi ezokwelapha ahlukahlukene e-GE Healthcare aklanyelwe ukuqapha izimo zesiguli. Ubuthakathaka obuhlanu bunikezwe izinga eliphezulu kakhulu lobucayi (i-CVSSv3 10 kwangu-10). Ubuthakathaka, obubizwa nge-MDhex, buhilela ngokuyinhloko ukusetshenziswa kweziqinisekiso ezaziwayo, ezifakwe ngaphambilini ezabiwe kuwo wonke umndeni wamadivayisi.

• I-CVE-2020-6961 — Ukusatshalaliswa kokhiye we-SSH owabiwe kuyo yonke imigqa yomkhiqizo, okuvumela abahlaseli ukuthi baxhume kunoma iyiphi idivayisi futhi basebenzise ikhodi kuyo. Lokhiye usetshenziswa futhi ngesikhathi sokulethwa kwesibuyekezo.
• I-CVE-2020-6962 - Iziqinisekiso ezabiwe, ezichazwe kusengaphambili zedivayisi yonke zokufinyelela kokufunda/ukubhala ohlelweni lwefayela le-SMB;
• I-CVE-2020-6963 — ikhono lokusebenzisa izinhlelo zokusebenza ze-MultiMouse kanye ne-Kavoom KM ukulawula kude idivayisi (ukulingisa ikhibhodi, igundane, kanye nebhodi lokunamathisela) ngaphandle kokuqinisekisa;
• I-CVE-2020-6964 - Amapharamitha okuxhumeka kwe-VNC achazwe kusengaphambili kuwo wonke amadivayisi;
• I-CVE-2020-6965 - Ukufakwa kwangaphambilini abasengozini Izinguqulo ze-Webmin ezivumela ukufinyelela kwezimpande okude;
• I-CVE-2020-6966 — Umphathi wokufaka izibuyekezo osetshenziswa kumadivayisi uvumela ukukhwabanisa izibuyekezo (izibuyekezo ziqinisekiswa ngokhiye we-SSH owaziwayo).

Izinkinga zithinta amaseva okuqoqwa kwe-telemetry ye-ApexPro kanye ne-CARESCAPE Telemetry Server, amapulatifomu e-CIC (Clinical Information Center) kanye ne-CSCS (CARESCAPE Central Station), kanye nezinhlelo zokuqapha iziguli ze-B450, B650, kanye ne-B850. Ubuthakathaka buvumela ukulawula okuphelele kwamadivayisi, angasetshenziswa ukwenza izinguquko ezingeni lesistimu yokusebenza, ukukhubaza ama-alamu, noma ukukhohlisa idatha yesiguli.

Ukuze ahlasele, umhlaseli kumele akwazi ukusungula uxhumano lwenethiwekhi kudivayisi, isibonelo, ngokuxhuma kunethiwekhi yesibhedlela. Njengesixazululo sokuphepha inikelwe Hlukanisa i-subnet ngamadivayisi ezokwelapha kunethiwekhi yesibhedlela esijwayelekile bese uvimba amachweba enethiwekhi angu-22, 137, 138, 139, 445, 10000, 5225, 5800, 5900 kanye no-10001 ku-firewall.

Source: opennet.ru