Ripple20, taxaddar u nuglaansho ku jirta Treck's TCP / IP stack oo saameeya aalado kala duwan

Dhawaan warku wuxuu faafiyay taas ilaa 19 nuglaansho ayaa laga helay Treck's lahaanshaha TCP / IP, taas oo looga faa’iideysan karo iyadoo la diro xirmooyin si gaar ah loogu talagalay.

Jilicsanaanta la helay, waxaa loo qoondeeyey magaca lambarka Ripple20 iyo qaar ka mid ah nuglaantaas ayaa sidoo kale ka muuqda Zuken Elmic's (Elmic Systems) KASAGO TCP / IP, oo xididdada la wadaaga Treck.

Waxa walaaca leh ee taxanahan nugul ee la helay ayaa ah taas xidhmooyinka TCP / IP Treck waxaa isticmaala aalado badan warshadaha, caafimaadka, isgaarsiinta, gundhig iyo macaamil, laga bilaabo laambadaha casriga ah ilaa daabacayaasha iyo korantada aan la joojin karin), iyo waliba tamarta, gaadiidka, duulista, ganacsiga iyo soo saarida saliida.

Ku saabsan dayacanka

Bartilmaameedyada xusida mudan ee weerarada iyadoo la adeegsanayo isku darka TCP / IP Treck waxaa ka mid ah daabacadaha shabakada HP iyo Intel chips.

Ku darista dhibaatooyinka on TCP / IP Treck xidhmooyin waxay noqotay sababta u nuglaanta durugsan Dhawaanahan nidaamka 'Intel AMT' iyo 'ISM' ee laga faa'iideysto adoo diraya xirmo shabakad ah.

Intel, HP, Hewlett Packard Enterprise, Baxter, Caterpillar, Digi, Rockwell Automation iyo Schneider Electric ayaa xaqiijiyay nuglaanta. Marka lagu daro 66 soo saareyaasha kale, oo wax soo saarkooda ay isticmaalaan Treck TCP / IP stack, ayaan wali ka jawaabin arrimaha, 5 soo saare, oo ay ku jiraan AMD, ayaa ku dhawaaqay in wax soo saarkooda aysan ku xirneyn arrimo.

Dhibaatooyin ayaa laga helay hirgelinta ee IPv4, IPv6, UDP, DNS, DHCP, TCP, ICMPv4 iyo hab maamuuska ARP, waxaana sabab u ahaa ka shaqeynta khaldan cabirrada cabirka xogta (iyadoo la adeegsanaayo dhul cabir leh iyadoo aan la hubin cabirka dhabta ah ee xogta), khaladaadka marka la baarayo macluumaadka la gelinayo, xusuusta labalaabka ah, laga akhriyo aag ka baxsan bakhaarka, isku-dhafka isku-dhafan, xakamaynta marin-u-helista aan saxda ahayn, iyo dhibaatooyinka ka shaqeynta xargaha eber kala-bixiyaha

Saamaynta nuglaantaas way ku kala duwanaan doontaa isku-darka isku-duwidda iyo xulashooyinka waqtiga-socod ee la isticmaalay markii la sameynayay nidaamyo kala duwan oo gundhig ah Kala duwanaanshahan hirgelinta iyo muuqaalka la'aanta silsiladda sahayda ayaa uga sii dartay dhibaatada ah in si sax ah loo qiimeeyo saameynta u nuglaantaas. 

Marka la soo koobo, weeraryahan fog oo aan la aqoonsan wuxuu isticmaali karaa baakado shabakad si gaar ah loo farsameeyay si uu u sababo diidmada adeegga, u muujiyo macluumaadka, ama u fuliyo koodh aan macquul ahayn.

Labada Arrimood ee Ugu Khatarta badan (CVE-2020-11896, CVE-2020-11897), oo loo qoondeeyay heerka CVSS 10, u oggolow weeraryahan inuu awood u yeesho inuu ku fuliyo koodhkiisa qalabka adoo u diraya xirmooyinka IPv4 / UDP ama IPv6 si cayiman.

Arrinta ugu horreysa ee xasaasiga ah waxay ka muuqataa aaladaha taageerada u leh tunnelyada IPv4, iyo tan labaad oo ku saabsan noocyada IPv6-karti loo siidaayay ka hor Juun 4, 2009. Dayacnaanta kale ee halista ah (CVSS 9) waxay ku jirtaa xallinta DNS (CVE-2020-11901) ) waxayna u oggolaaneysaa koodhku inuu socodsiinayo adoo soo gudbinaya codsi si khaas ah loo farsameeyay oo DNS ah (arrinta waxaa loo isticmaalay in lagu muujiyo Schneider Electric UPS APC hack waxayna u muuqataa qalabka leh taageerada DNS).

Iyadoo dayacanka kale CVE-2020-11898, CVE-2020-11899, CVE-2020-11902, CVE-2020-11903, CVE-2020-11905 le u oggolow inaad ogaato waxa ku jira adoo diraya xirmo meelaha sida gaarka ah loogu farsameeyay IPv4 / ICMPv4, IPv6OverIPv4, DHCP, DHCPv6 ama IPv6 meelaha xasuusta nidaamka. Arrimaha kale waxay u horseedi karaan diidmada adeegga ama ka sii daaya xogta harsan nidaamka keydka.

Inta badan dayacanka ayaa la hagaajiyay ku saabsan sii deynta Treck 6.0.1.67 (arrinta CVE-2020-11897 oo ku xaddidan 5.0.1.35, CVE-2020-11900 ee 6.0.1.41, CVE-2020-11903 at 6.0.1.28, CVE-2020-11908 at 4.7 1.27)

Maaddaama loo diyaarinayo cusbooneysiinta qalabka qalabka gaarka ah waxay noqon kartaa mid waqti badan qaadata ama aan macquul ahayn maadaama Treck stack la keenay muddo ka badan 20 sano, aalado badan ayaa laga tagay iyagoo aan ilaalin ama dhibaato ku ah cusbooneysiinta.

Maamulayaasha waxaa lagula talinayaa inay go'doomiyaan aaladaha dhibaatada leh oo ay jaangooyaan caadi ahaanta ama xayiraan nidaamyada baaritaanka baakadka, firewalls ama router-yada baakadaha kala jaban, xannibi godadka IP-ka (IPv6-in-IPv4 iyo IP-in-IP), xannib « halka laga raacayo ilaha, »awood u siinta kormeerka xulashooyinka khaldan ee baakadaha TCP, xannibi fariimaha xakameynta ICMP ee aan la adeegsan (Cusboonaysiinta MTU iyo Maaskarada Cinwaanka).