Dhawaan macluumaad muhiim ah ayaa laga sii daayay afar baylahnimo oo ku jirta qaybaha Realtek SDK, oo ay adeegsadaan soosaarayaasha aaladaha kala duwan ee bilaa wireless -ka ah qalabkooda. Arrimaha la ogaaday waxay u oggolaanayaan weeraryahan aan la xaqiijin inuu meel fog ka fuliyo koodh aalad sare.
Waxaa lagu qiyaasaa in arrimuhu waxay saameeyaan ugu yaraan 200 nooc oo aaladood oo ka kala yimid 65 iibiyeyaal kala duwan, oo ay ku jiraan moodooyin kala duwan oo router-ka wireless-ka ah ee Asus, A-Link, Beeline, Belkin, Buffalo, D-Link, Edison, Huawei, LG, Logitec, MT -Link, Netgear, Realtek, Smartlink, UPVEL, ZTE iyo Zyxel.
Dhibaatada wuxuu ka kooban yahay fasallo kala duwan oo ah qalabka wireless-ku-saleysan ee RTL8xxx SoCLaga bilaabo jiheeyayaasha bilaa-waayirka ah iyo cod-weyneyaasha Wi-Fi illaa kamaradaha IP-ga iyo aaladaha caqliga leh ee xakamaynta iftiinka.
Aaladaha ku saleysan jajabyada RTL8xxx waxay adeegsadaan qaab dhismeed ku lug leh rakibidda laba SoCs: kan ugu horreeya wuxuu rakibayaa qalabka soo-saaraha ee ku saleysan Linux, kan labaadna wuxuu maamulaa jawi Linux oo caato ah oo gaar ah iyadoo la hirgelinayo howlaha marin-u-helidda. Dadweynaha deegaanka labaad waxay ku salaysan yihiin qaybaha caadiga ah ee ay Realtek ka bixisay SDK. Qaybahan, iyo waxyaabo kale, waxay ka baaraandegayaan xogta la helay taasoo ka dhalatay dirista codsiyada dibadda.
Nuglaansho saamayn ku yeesho badeecadaha isticmaalaya Realtek SDK v2.x, Realtek "Jungle" SDK v3.0-3.4 iyo Realtek "Luna" SDK ilaa nooca 1.3.2.
Marka laga hadlayo qayb ka mid ah tilmaanta dayacanka la aqoonsaday, waxaa muhiim ah in la xuso in labadii hore loo xilsaaray heerka darnaanta 8.1 iyo inta soo hartay, 9.8.
- XAFLAD-2021-35392: Buffer ayaa ku qulqulaya mini_upnpd iyo geedi socodka wscd ee hirgeliya shaqeynta "WiFi Simple Config" (mini_upnpd waxay qabataa SSDP iyo baakadaha wscd, marka lagu daro taageeridda SSDP, waxay wax ka qabataa codsiyada UPnP ee ku saleysan borotokoolka HTTP). Qaabkan, weeraryahanku wuxuu ku fulin karaa koodhkaaga isagoo u diraya codsiyada UPnP SUBSCRIBE oo si gaar ah loo farsameeyay oo leh lambar deked aad u sarreeya oo ku yaal goobta soo -celinta.
- XAFLAD-2021-35393: u nuglaanta darawalada "WiFi Simple Config", oo soo ifbaxay marka la isticmaalayo borotokoolka SSDP (wuxuu adeegsadaa UDP iyo qaab codsi oo la mid ah HTTP). Dhibaatada waxaa sabab u ah adeegsiga 512-byte buffer go'an marka la farsameynayo cabirka "ST: upnp" ee fariimaha M-SEARCH ee ay diraan macaamiisha si loo go'aamiyo helitaanka adeegyada shabakadda.
- XAFLAD-2021-35394: Waa u nuglaanta hannaanka MP Daemon, kaas oo mas'uul ka ah fulinta qalliinnada ogaanshaha (ping, traceroute). Dhibaatadu waxay oggolaanaysaa in la beddelo amarradaada sababtuna tahay ansaxinta aan ku filnayn ee doodaha marka la adeegsanayo adeegyada dibadda.
- XAFLAD-2021-35395: waa nuglaansho taxane ah oo ku jira isku -xirnaanta shabakadda oo ku saleysan http / bin / websaytyada iyo / bin / boa server. Jilicsanaanta caadiga ah ayaa lagu aqoonsaday labada server, oo ay sababtay ansixin dood la'aan ka hor inta aan la fulin adeegsiga dibadda iyadoo la adeegsanayo nidaamka (). Kala duwanaanshuhu wuxuu ku yimaadaa oo keliya adeegsiga API -yada kala duwan ee weerarka.
Labada darawalba kuma aysan darin ka -hortagga weerarada CSRF iyo farsamada “dib -u -dhiska DNS”, kaas oo u oggolaanaya codsiyada in laga diro shabakadda dibedda iyadoo xaddidaysa gelitaanka is -dhexgalka kaliya shabakadda gudaha. Nidaamyadu waxay sidoo kale adeegsadeen koontada kormeeraha / kormeeraha ee hore loo qeexay.
Hagaajinta ayaa horay loogu sii daayay Realtek "Luna" SDK cusboonaysiinta 1.3.2a, iyo Realtek "Jungle" SDK patches ayaa sidoo kale loo diyaarinayaa siideynta. Wax hagaajin ah looma qorsheynin Realtek SDK 2.x, maadaama dayactirka laantaan mar hore la joojiyay. Tusaalooyinka ka -faa'iideysiga wax -qabadka ayaa la siiyay dhammaan nuglaanta, taas oo u oggolaanaysa inay ku socodsiiyaan koodhkooda aaladda.
Sidoo kale, aqoonsiga dhowr nuglaansho oo dheeraad ah ayaa lagu arkay habka UDPServer. Siday noqotay, mid ka mid ah dhibaatooyinka ayaa horeba waxaa u ogaaday cilmi -baarayaal kale sannadkii 2015, laakiin si buuxda looma hagaajin. Dhibaatada waxaa sabab u ah la'aanta ansaxinta saxda ah ee doodaha loo gudbiyay shaqada nidaamka () waxaana laga faa'iideysan karaa iyadoo la diro xariiq sida 'orf; ls 'ilaa dekedda shabakadda 9034.
source: https://www.iot-inspector.com