??????? ?? ???? ?? ?????????? ?????? ?? ??? ???? ?? ?? ?????? ?????? ????? ????? ([?]SLP) ????? ????????? ???? ??? ??? ?? ???????? ???? ????? ????? ????? ????? ???? ???? ????? ??????????? ???? ????.
Pedro Umbelino ? Marco Lux ?????? Bitsight ? Curesec ?? ?????? ?? ?? The Hacker News ?? ?????? ?????? ??? ????????[?]: «???????? ?? ?? ??? ?????????? ??????????? ???????? ????????? ?? ????????? ????????? ???? ?????????? ????? ?????? ????? ????? ????? (DoS) ?? ???? ???? ?????? ??????? ???? ?? ?????? ?????? ?? ?? ?? ??? ?? ????????? ????? ?????? ?? ?????? ????? ??? ????? ??????.»
???? ?????? ?? ??? ?????????? ?? ????? CVE-2023-29552 (?????? ?/? ?? ????? CVSS) ?? ?? ??? ?????? ???? ???? ??? ?? ???? ?????? ????? ? ??? ?? ????? ????? SLP ?? ?? ?? ???? ??????? ?? ????? ????? ??? ????? ???? ??????.
??? ???? VMWare ESXi Hypervisor? ????????? Konica Minolta? ??????? Planex? ????? ?????? ??????? IBM (IMM)? SMC IPMI ? ??? ??? ????? ???? ???.
?? ???? ???? ?? ??????? ??????????? ?? ????? ????????? SLP ?? ?????? ????????????? ????????? ????? ?????? ??????? ??????? ???????? ?????? ???? ? ??????? ?????.
SLP ?? ?????? ??? ????? ??? ?? ?? ????????? ? ???? ????????? ????? ?????? ????? ?? ?? ?? ???? ???? ????? ???????? ??????? ???? ? ???? ????? ???? ???? ????.
??????????? ??????????? ?? CVE-2023-29552 ???????? ?? ????? ????? ??? ?? ?? ????????? ???? SLP ???? ?????????? ?? ???? ????? ???????[?] ??????? ??? ? ?? ???? ??? ?? ?? ?????? ???? ??? ???.
???? ????? ??? ???? ???? ???? ?? ????? ???? ????? ??? ??? ??? ?? ?? ???? SLP ?? ?? ???? UDP 427 ????? ? «???????? ?? ?? ????? ?? SLP ????????? ?????? ?? ?? ???» ??? ???? ? ?? ????? ?? ??????? ?? ?? ????? ?? ?????? ?? IP ?????? ???????? ???? ???? ??? ???[?].»
??????? ????????? ???????? ???? ?????? ?? ???? ????? ????? ??? ?? ???? ?? ????? DoS ?? ????? ???? ??????. ???? ???? ???? ?? ??????? ????? ?????? SLP ?? ?? ?????????? ?? ???????? ?? ??????? ???? ????? ??????? ????? ?? ?????? ??? ?????? UDP ? ???? TCP 427 ?? ????? ????.
?????? ????????: «????? ????????? ????? ???? ? ?????? ??? ?? ???? ?????? ??? ??? ?? ??? ?? ??????? ???? ????? ?????? ?? ????? ???? ???? ?? ????? ???? ? ????? ?????? ????? ?????».
???? ????? ?? Cloudflare ?? ??????[?] ?????????? ??? ?? “?????? ???? ???? ????? DDoS ????? ?? SLP ?? ???????? ????? ?????? ?????????? ?????? ????” ???? ????? ????? ?? ????? ???? ????? DDoS ?????? ???????.
??? ?????????? ?????? ???? ????? ????? ?????? ? ????? ??????? ???????????? (CISA) ?? ?? ??? ??? ???? ???? ?? ?? ???? ????? ??????? ?? ??????????? ?? SLP ???? “????? ????? DoS ?? ?????? ????? ???? ?? ??????? ?? ???????? ???? ????” ????? ???? ???.
??? ????? ???[?]: «?????? ?????? ????? ????? (SLP? [?]RFC 2608) ?? ????? ?? ??? ??? ????? ???? ????? ?????? ?? ????? ?????? ?? ??? ???. ??? ???????? ?? ????? ????? ??? ?? ?? ?????? UDP ????[?] ???? ????? ?? ???? ????? ????? (DoS) ?? ???? ????? ?????????? ??????? ???.
??? ???????? ????? ?? ??? ??????? ?? ?? ??? ?????? ???? ??? ?? ?????????? SLP VMware ???? ???????? ????? ?? ????????? [?]ESXiArgs ?? ????? ?????? ?? ????? ??? ???? ???? ??????????? ???? ????.
??????????? ????? ?????????? ??? ?? ??? ??? ?? ????? ???? ? ????? ???? ??? ?? ???????? ESXi (???? ESXi 7.x ? ??x) ??? ????? ???? ????????? ? ??? ???? ???????? ????????? ?? ??? ????? ???? ?????? ?? ?? ????? ???????? ????? (EoGS[10]) ?????????.
Edward Hawkins ?? VMware ?????????? ???[??]: «?????? ????? ???? ??????? ?? CVE-2023-29552? ????? ?? ?? ?? ?????? ???????? ??? ??? ?? ??? ????? ?????????? ???? ?????. ?????? ?????? ?? ???? ???????? ???? ?????? ESXi ???? ??????? ???? ???? ?? ???? ESXi ????? ?? ???? ???????? ?????????????? ???? ?????? ? ?????? SLP ?? ??????? ????[??].»
?????
[?] https://en.wikipedia.org/wiki/Service_Location_Protocol
[?] https://www.bitsight.com/blog/new-high-severity-vulnerability-cve-2023-29552-discovered-service-location-protocol-slp
[?] https://www.netscout.com/what-is-ddos/what-is-reflection-amplification-attack
[?] https://www.cloudflare.com/learning/ddos/glossary/ip-spoofing/
[?] https://blog.cloudflare.com/slp-new-ddos-amplification-vector/
[?] https://www.cisa.gov/news-events/alerts/2023/04/25/abuse-service-location-protocol-may-lead-dos-attacks
[?] https://www.rfc-editor.org/rfc/rfc2165.html
[?] https://www.cisa.gov/news-events/alerts/2014/01/17/udp-based-amplification-attacks
[?] https://thehackernews.com/2023/02/esxiargs-ransomware-hits-over-500-new.html
[??] https://www.vmware.com/support/lifecycle-policies.html
[??] https://blogs.vmware.com/security/2023/04/vmware-response-to-cve-2023-29552-reflective-denial-of-service-dos-amplification-vulnerability-in-slp.html
[??] https://kb.vmware.com/s/article/76372
[??] https://thehackernews.com/2023/04/new-slp-vulnerability-could-let.html
??????? : ???? ??????
???? : ???? ???? ??????? ???? ????
