{"id":2112,"date":"2020-05-26T22:31:41","date_gmt":"2020-05-27T03:31:41","guid":{"rendered":"https:\/\/cert.pa\/?p=2112"},"modified":"2020-05-26T22:31:53","modified_gmt":"2020-05-27T03:31:53","slug":"csirt-panama-aviso-2020-05-26-dns-actualizaciones-de-vulnerabilidades-que-afectan-al-protocolo-dns","status":"publish","type":"post","link":"https:\/\/cert.pa\/?p=2112","title":{"rendered":"CSIRT Panam\u00e1 Aviso 2020-05-26 DNS: Actualizaciones de vulnerabilidades que afectan al protocolo DNS."},"content":{"rendered":"\n<p>Gravedad:Media\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Vulnerabilidad: CVE-2020-8616 \/ CVE-2020-12662 \/ CVE-2020-10995 \/ <\/p>\n\n\n\n<p>Fecha de publicaci\u00f3n: Mayo 26, 2020<br>\u00daltima revisi\u00f3n: Mayo 26, 2020<br><br><\/p>\n\n\n\n<p><strong>Sistemas Afectados:<\/strong><br>\nVulnerabilidades en el protocolo DNS que afecta a todas los servidores que\npresten el servicio, ya sea opensource o comerciales.<\/p>\n\n\n\n<p><strong>I. Descripci\u00f3n<\/strong><br>\nActualizaci\u00f3n de seguridad que afecta al protocolo DNS, incluido los servicios\nDNS comerciales como Cloudflare, Google, Amazon, Microsoft, Oracle (DYN),\nVerisign, IBM Quad9 e ICANN, quienes han parchado sus productos.<\/p>\n\n\n\n<p><strong>II. Impacto<\/strong><\/p>\n\n\n\n<p>Acad\u00e9micos de la\nUniversidad de Tel Aviv y el Centro Interdisciplinario en Herzliya, Israel, han\nrevelado detalles sobre una nueva falla que afecta el protocolo DNS que puede\nexplotarse para lanzar ataques de denegaci\u00f3n de servicio (DDoS) amplificados y\na gran escala para atacar sitios web espec\u00edficos, a esta falla la han\ndenominado NXNSAttack.<\/p>\n\n\n\n<p>La t\u00e9cnica NXNSAttack\ntiene diferentes facetas y variaciones, pero los pasos b\u00e1sicos se detallan a\ncontinuaci\u00f3n:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Un atacante env\u00eda una\nconsulta DNS a un servidor DNS recursivo. La solicitud es para un dominio como\n\u00abattacker.com\u00bb, que se administra a trav\u00e9s de un servidor DNS autoritativo\ncontrolado por el atacante.<\/li><li>Dado que el servidor DNS\nrecursivo no est\u00e1 autorizado para resolver este dominio, reenv\u00eda la operaci\u00f3n\nal servidor DNS autoritativo malintencionado del atacante.<\/li><li>El servidor DNS malicioso\nresponde al servidor DNS recursivo con un mensaje que equivale a \u00abEstoy\ndelegando esta operaci\u00f3n de resoluci\u00f3n de DNS a esta gran lista de servidores\nde nombres\u00bb. La lista contiene miles de subdominios para un sitio web v\u00edctima.<\/li><li>El servidor DNS recursivo\nreenv\u00eda la consulta DNS a todos los subdominios de la lista, creando un aumento\nen el tr\u00e1fico para el servidor DNS autorizado de la v\u00edctima. <\/li><\/ul>\n\n\n\n<p><strong>III. Referencia a soluciones, herramientas e\ninformaci\u00f3n<\/strong><strong><\/strong><\/p>\n\n\n\n<p>Aplicar las actualizaciones o bien aplicar las\nmedidas de mitigaci\u00f3n publicadas seg\u00fan el fabricante. <\/p>\n\n\n\n<p><strong>Fuentes:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>NXNSAttack. 2020. nxnsattack.com. Recopilado\nen:&nbsp;<a href=\"https:\/\/lists.apache.org\/thread.html\/r77eae567ed829da9012cadb29af17f2df8fa23bf66faf88229857bb1%40%3cannounce.tomcat.apache.org\"> http:\/\/www.nxnsattack.com\/<\/a><\/li><li>Paper NXNSAttack.\n2020. nxnsattack.com. Recopilado en:\nhttp:\/\/www.nxnsattack.com\/shafir2020-nxnsattack-paper.pdf<\/li><li>National\nVulnerability Database. CVE-2020-8616 Detail. NIST&nbsp; GOV. Recopilado en: <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2020-8616\">https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2020-8616<\/a><\/li><li>National\nVulnerability Database. CVE-2020- 12662 Detail. NIST&nbsp; GOV. Recopilado en: https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2020-12662<\/li><li>National\nVulnerability Database. CVE-2020- 12662 Detail. NIST&nbsp; GOV. Recopilado en: https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2020-10995<\/li><li>National\nVulnerability Database. CVE-2020- 12662 Detail. NIST&nbsp; GOV. Recopilado en: https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2020-12667<\/li><li>CVE-2020-8616.\nISC. 19 de Mayo 2020. Recopilado en: https:\/\/kb.isc.org\/docs\/cve-2020-8616<\/li><li>CVE-2020-12662\nand CVE-2020-12663. Recopilado en: https:\/\/nlnetlabs.nl\/downloads\/unbound\/CVE-2020-12662_2020-12663.txt<\/li><li>Windows\nDNS Server Denial of Service Vulnerability. 19 de Mayo 2020. Recopilado en:\nhttps:\/\/portal.msrc.microsoft.com\/en-us\/security-guidance\/advisory\/ADV200009<\/li><li>PowerDNS Security Advisory 2020-01: Denial of\nService. 19 de Mayo 2020. Recopilado en: https:\/\/doc.powerdns.com\/recursor\/security-advisories\/powerdns-advisory-2020-01.html<\/li><li>CSIRT Chile. 21 de mayo del 2020. Vulnerabilidades.\nRecopilado en: https:\/\/www.csirt.gob.cl\/vulnerabilidades\/9vsa20-00221-01\/<\/li><\/ul>\n\n\n\n<p><strong>Informaci\u00f3n de contacto<\/strong><br>\nCSIRT PANAMA<br>\nComputer Security Incident Response Team Autoridad Nacional para la Innovacion\nGubernamental<br>\nE-Mail: info@cert.pa<br>\nPhone: +507 520-CERT (2378)<br>\nWeb: https:\/\/cert.pa<br>\nTwitter: @CSIRTPanama<br>\nKey ID: 16F2B124<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Gravedad:Media\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Vulnerabilidad: CVE-2020-8616 \/ CVE-2020-12662 \/ CVE-2020-10995 \/ Fecha de publicaci\u00f3n: Mayo 26, 2020\u00daltima revisi\u00f3n: Mayo 26, 2020 Sistemas Afectados: Vulnerabilidades en el protocolo DNS que afecta a todas los servidores que presten el servicio,&#8230;<\/p>\n","protected":false},"author":4,"featured_media":2113,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"footnotes":""},"categories":[4],"tags":[],"class_list":["post-2112","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-avisos-de-seguridad"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts\/2112","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2112"}],"version-history":[{"count":1,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts\/2112\/revisions"}],"predecessor-version":[{"id":2114,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/posts\/2112\/revisions\/2114"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=\/wp\/v2\/media\/2113"}],"wp:attachment":[{"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2112"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2112"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cert.pa\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2112"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}