I-Ripple20, uthotho lokuba semngciphekweni kwi-Treck's TCP / IP stack echaphazela izixhobo ezahlukeneyo

Kutshanje iindaba ziye zaqhekeka malunga nokuchaphazeleka okungama-19 kwafunyanwa kwisitaki se-TCP esifanelekileyo se-TCP / se-IP, enokusetyenziswa ngokuthumela iipakeji eziyilelwe ngokukodwa.

Ubuthathaka obufunyenweyo, babelwa igama lekhowudi Ripple20 kwaye obunye bobu buthathaka buvela kwiZuken Elmic's (Elmic Systems) KASAGO TCP / IP stack, ekwabelana ngayo ngeengcambu ezifanayo noTrck.

Into exhalabisayo malunga noluhlu lwezinto ezisemngciphekweni ezifumanekayo kukuba Isitaki se-TCP / se-IP Treck sisetyenziswa zizixhobo ezininzi ezemizi-mveliso, ezonyango, ezonxibelelwano, ezigxunyekwe kunye nomthengi, ukusuka kwizibane ezikrelekrele ukuya kubashicileli kunye nonikezelo lwamandla olungaphazamiseki), nakwizinto zamandla, ezothutho, ezokubhabha, ezorhwebo kunye nezixhobo zemveliso yeoyile.

Malunga nokuba semngciphekweni

Iithagethi ezaziwayo zokuhlaselwa kusetyenziswa i-TCP / IP Treck stack Babandakanya iiprinta zenethiwekhi ze-HP kunye neetshipsi zeIntel.

Ukubandakanywa kweengxaki kwi-TCP / IP Treck stack yajika yaba sisizathu sobuthathaka ekude Kutshanje kwiinkqubo ze-Intel AMT kunye ne-ISM zixhaphakile ngokuthumela ipakethi yenethiwekhi.

Intel, HP, Hewlett Packard Enterprise, Baxter, Caterpillar, Digi, Rockwell Automation kunye no Schneider Electric baqinisekisa ubungozi. Ukongeza kuma-66 abanye abavelisi, iimveliso zabo zisebenzisa i-Treck TCP / IP stack, engekaphenduli kwimicimbi, abavelisi aba-5, kubandakanya i-AMD, babhengeze ukuba iimveliso zabo azikho phantsi kwemicimbi.

Iingxaki zifunyenwe ekuphunyezweni ye-IPv4, IPv6, UDP, DNS, DHCP, TCP, ICMPv4 kunye neeprothokholi ze-ARP, kwaye zibangelwe kukusombulula ngokungachanekanga iiparameter ezinobungakanani bedatha (kusetyenziswa umhlaba onobungakanani ngaphandle kokujonga ubungakanani bedatha), iimpazamo xa ujonga ulwazi lwegalelo, imemori ephindwe kabini, funda Indawo engaphandle kwempazamo, ukuphuphuma kwenani elipheleleyo, ulawulo olungalunganga lokufikelela, kunye neengxaki zokulungisa umtya ngokwahlulahlula zero.

Iziphumo zolu buthathaka ziya kwahluka ngenxa yokudityaniswa kokudityaniswa kunye nexesha lokubaleka elisetyenzisiweyo xa kuphuhliswa iinkqubo ezahlukeneyo zokungena. Le yantlukwano yokuphunyezwa kunye nokungabikho kokubonakala kokunikezelwa kwempahla kuye kwayandisa ingxaki yokuvavanya ngokuchanekileyo ifuthe lobu buthathaka. 

Ngamafutshane, umhlaseli ongagunyaziswanga ekude unokusebenzisa iipakethe zenethiwekhi ezenziwe ngokukodwa ukwenza ukwaliwa kwenkonzo, ukuveza ulwazi, okanye ukwenza ikhowudi yokuchasana nomthetho.

Ezona ngxaki zimbini ziyingozi (CVE-2020-11896, CVE-2020-11897), Ezabelwe inqanaba le-CVSS le-10, vumela umhlaseli ukuba akwazi ukwenza ikhowudi yakhe kwisixhobo ngokuthumela iipakethi ze-IPv4 / UDP okanye ze-IPv6 ngendlela ethile.

Umcimbi wokuqala obalulekileyo uvela kwizixhobo ezixhasa i-IPv4 tunnels, kwaye eyesibini kwiinguqulelo ze-IPv6 ezikhutshwe ngaphambi koJuni 4, 2009. Olunye ubungozi obubaluleke kakhulu (i-CVSS 9) lukhona kwisisombululo se-DNS (CVE-2020-11901 ) kwaye ivumela ikhowudi ukuba iqhubeke ngokungenisa isicelo esenziwe ngokukodwa se-DNS (umba wawusetyenziselwa ukubonisa isuntswana le-Schneider Electric UPS APC kwaye livela kwizixhobo ezinenkxaso ye-DNS).

Ngexesha obunye ubuthathaka CVE-2020-11898, CVE-2020-11899, CVE-2020-11902, CVE-2020-11903, CVE-2020-11905 le vumela ukwazi umxholo ngokuthumela iiphakheji eyenzelwe ngokukodwa IPv4 / ICMPv4, IPv6OverIPv4, DHCP, DHCPv6 okanye iindawo zememori ze-IPv6 zenkqubo. Eminye imiba inokukhokelela ekwaleni inkonzo okanye ukuvuza kwedatha eyintsalela evela kwinkqubo ye-buffers.

Uninzi lobuthathaka lwalungisiwe Kwi-Treck 6.0.1.67 ukukhutshwa (i-CVE-2020-11897 ekhutshwe kwi-5.0.1.35, i-CVE-2020-11900 kwi-6.0.1.41, i-CVE-2020-11903 kwi-6.0.1.28, i-CVE-2020-11908 kwi-4.7. (B) 1.27).

Ukusukela ukulungiselela uhlaziyo lwefirmware kwizixhobo ezithile kunokuthatha ixesha okanye kungenzeki njengoko isitaki seTreck sele sinikezelwe ngaphezulu kweminyaka engama-20, izixhobo ezininzi zishiyiwe zingalindelwanga okanye zinzima ukuzihlaziya.

Abalawuli bayacetyiswa ukuba babeke bodwa izixhobo ezinengxaki kwaye baqwalasele ukuqhelaniswa okanye ukubhloka kwiinkqubo zokuhlola iipakethi, ii-firewalls okanye iipakethi eziqhekeziweyo, vimba imigudu ye-IP (IPv6-in-IPv4 kunye ne-IP-in-IP), vimba i « Ukuhamba ngomthombo », yenza ukuhlolwa kokukhetha okungalunganga kwiipakethi ze-TCP, kuthintele imiyalezo yolawulo ye-ICMP engasetyenziswanga (Uhlaziyo lweMTU kunye neMask yeeDilesi).