|
|
[ °ø Áö ] Samba Ãë¾àÁ¡ º¸¾È ¾÷µ¥ÀÌÆ® ±Ç°í |
|
2017-09-22 |
|
|
¾È³çÇϽʴϱî. È£½ºÆ®¸ÕÆ®ÀÔ´Ï´Ù.
¸ÕÀú È£½ºÆ®¸ÕÆ®¸¦ ¾Æ²¸ÁÖ½Ã°í »ç¶ûÇØ Áֽô °í°´ ¿©·¯ºÐ²² Áø½ÉÀ¸·Î °¨»çµå¸®¸ç
Samba Ãë¾àÁ¡ º¸¾È ¾÷µ¥ÀÌÆ® ±Ç°í°¡ ÀÖ¾î À̸¦ ¾Ë·Áµå¸®°íÀÚ ÇÕ´Ï´Ù.
---------------------------------------------------------------------------
¡à °³¿ä
o Samba ¼ÒÇÁÆ®¿þ¾î¿¡¼ ¹ß»ýÇÏ´Â Ãë¾àÁ¡À» ÇØ°áÇÑ º¸¾È ¾÷µ¥ÀÌÆ®¸¦ ¹ßÇ¥[1]
o ³·Àº ¹öÀü »ç¿ëÀÚ´Â ¼ºñ½º °ÅºÎ °ø°Ý ¹× Áß°£ÀÚ °ø°Ý¿¡ Ãë¾àÇÒ ¼ö ÀÖ¾î ÇØ°á¹æ¾È¿¡ µû¶ó ÃֽŠ¹öÀüÀ¸·Î ¾÷µ¥ÀÌÆ® ±Ç°í
¡à ¼³¸í
o SMBv1,v2,v3 »ç¿ë ½Ã, ÀϺΠ±â´É¿¡¼ Ŭ¶óÀ̾ðÆ® ÀÎÁõÀ» ÇÏÁö ¾Ê¾Æ Áß°£ÀÚ °ø°ÝÀÌ °¡´ÉÇÑ Ãë¾àÁ¡(CVE-2017-12150)[2]
o SMBv3 »ç¿ë ½Ã, DFS(Distribute File System, ºÐ»ê ÆÄÀÏ ½Ã½ºÅÛ)ÀÇ Åë½Å¿¡¼ ¹ÌÈíÇÑ µ¥ÀÌÅÍ ¾ÏȣȷΠÀÎÇØ
Áß°£ÀÚ °ø°ÝÀÌ °¡´ÉÇÑ Ãë¾àÁ¡(CVE-2017-12151)[3]
o SMBv1 »ç¿ë ½Ã, À߸øµÈ µ¥ÀÌÅÍ ¿äûÀ¸·Î ÀÎÇØ Å¬¶óÀ̾ðÆ®¿¡¼ ¼¹ö ¸Þ¸ð¸® Á¤º¸¸¦ ³ëÃâ½Ãų ¼ö ÀÖ´Â Ãë¾àÁ¡(CVE-2017-12163)[4]
¡à ¿µÇâ¹Þ´Â ¼ÒÇÁÆ®¿þ¾î
¹ß»ýÇÑ Ãë¾àÁ¡ Ãë¾àÇÑ ¹öÀü
CVE-2017-12150 Samba 3.0.25 ~ 4.6.7
CVE-2017-12151 Samba 4.1.0 ~ 4.6.7
CVE-2017-12163 Samba 4.7.0À» Á¦¿ÜÇÑ ¸ðµç ¹öÀü
¡Ø Samba 4.7.0Àº ÇØ´ç Ãë¾àÁ¡ ÆÐÄ¡ ÀÌÈÄ ¹èÆ÷µÈ ¹öÀüÀ̹ǷΠ¿µÇâ ¹ÞÁö ¾ÊÀ½
¡à ÇØ°á ¹æ¾È
o Samba 4.4.15 ¹× ÀÌÀü ¹öÀü »ç¿ëÀÚ
- Samba 4.4.15 ¹× ÀÌÀü ¹öÀü »ç¿ëÀÚ´Â 4.4.16 ¹öÀüÀ¸·Î ¾÷µ¥ÀÌÆ® Àû¿ë[5]
o Samba 4.5.13 »ç¿ëÀÚ
- Samba 4.5.13 »ç¿ëÀÚ´Â 4.5.14 ¹öÀüÀ¸·Î ¾÷µ¥ÀÌÆ® Àû¿ë[6]
o Samba 4.6.7 »ç¿ëÀÚ
- Samba 4.6.7 »ç¿ëÀÚ´Â 4.6.8 ¹öÀüÀ¸·Î ¾÷µ¥ÀÌÆ® Àû¿ë[7]
¡à ¿ë¾î ¼³¸í
o Áß°£ÀÚ °ø°Ý (Man-In-The-Middle) : Åë½ÅÇÏ°í ÀÖ´Â Àåºñµé »çÀÌ¿¡¼ µ¥ÀÌÅ͸¦ º¯°æÇϰųª µµÃ»ÇÏ¿© Åë½Å ³»¿ëÀ» Á¶ÀÛÇÏ´Â ÇØÅ· ±â¹ý
¡à ±âŸ ¹®ÀÇ»çÇ×
o Çѱ¹ÀÎÅͳÝÁøÈï¿ø ÀÎÅͳÝħÇØ´ëÀÀ¼¾ÅÍ: ±¹¹ø ¾øÀÌ 118
[Âü°í»çÀÌÆ®]
[1] https://www.samba.org/samba/history/
[2] https://www.samba.org/samba/security/CVE-2017-12150.html
[3] https://www.samba.org/samba/security/CVE-2017-12151.html
[4] https://www.samba.org/samba/security/CVE-2017-12163.html
[5] https://download.samba.org/pub/samba/patches/samba-4.4.15-4.4.16.diffs.gz
[6] https://download.samba.org/pub/samba/patches/samba-4.5.13-4.5.14.diffs.gz
[7] https://download.samba.org/pub/samba/patches/samba-4.6.7-4.6.8.diffs.gz
---------------------------------------------------------------------------
Áñ°Å¿òÀÌ Àִ ȣ½ºÆà ¼ºñ½º [ È£½ºÆ®¸ÕÆ® ]
|
|
|