Viet Nam Nhieu he thong mang bi anh huong boi loi cua Webmin

- Trung tam An ninh mang (BKIS) cho biet mot lo hong nghiem trong moi phat hien trong phan mem Webmin co the giup tin tac dot nhap de dang vao he thong mang su dung phan mem nay.

Day la phan mem cung cap giao dien web de quan tri he thong tren he dieu hanh Unix, Linux.

Webmin thuong duoc cac nha cung cap dich vu hosting su dung de quan ly tai khoan va thu muc cua nguoi dung. Voi lo hong nay, tin tac co the truy cap bat ky thu muc nao va doc duoc cac tep tin tren may chu co su dung phan mem Webmin.

Tai Viet Nam, BKIS da kiem tra va nhan thay, mot so nha cung cap dich vu hosting lon, trong do co mot ISP, dang su dung Webmin cho viec quan tri nguoi dung thue host. Vi vay, kha nang thong tin cua khach hang cua nhung nha cung cap dich vu nay nhu username/password, cac tep tin trong thu muc chua web, deu da co the bi tin tac thu thap duoc.

Co it nhat gan 400 khach hang cua cac nha cung cap dich vu nay co the bi lo thong tin, trong do co cac ngan hang, cac doanh nghiep, cac to chuc... Day la dieu het suc nguy hiem, vi voi nhung thong tin thu duoc tin tac hoan toan co the kiem soat duoc website cua tat ca nhung khach hang nay.

Hien nay, ngoai Webmin, phan mem Usermin cung bi loi tuong tu. Hai phan mem nay deu cua cung mot nhom tac gia, vi vay chung co chung nguyen ly, va cach thuc khai thac lo hong la nhu nhau. Day la hai phan mem pho bien va duoc cac quan tri mang tren Unix, va Linux tin dung.

Trung tam An ninh mang BKIS da ra khuyen cao tat ca cac quan tri mang tren toan quoc hay kiem tra xem he thong cua ban co su dung phan mem Webmin hay Usermin khong, neu co ban phai lap tuc va loi cho nhung phan mem nay.

De khac phuc su co tren, viec dau tien la cac quan tri phai nang cap phan mem bi loi len phien ban moi nhat la Webmin 1.290 va Usermin 1.220 tu trang web www.webmin.com. Tiep theo, cac nha cung cap dich vu hosting can phai thong bao va huong dan cho khach hang thue host cua minh de phai thay doi ngay mat khau quan ly host va mat khau ket noi toi co so du lieu (neu co). Cuoi cung la ra soat lai he thong (doi voi ca nha cung cap dich vu va cac khach hang thue host cua ho) boi vi rat co the trong vai ngay qua tin tac da kip xam nhap de sua doi thong tin hay cai dat Backdoor (mot dang phan mem gian diep) de kiem soat he thong.

Nguyen nhan cua lo hong tren la do phan mem khong kiem soat chat che viec su dung ki tu “/”. Bang viec su dung chuoi lien tiep cac ki tu “..%01/”, tin tac co the doc duoc noi dung bat ki file nao trong he thong, thong qua do lay duoc cac thong tin nhay cam nhu username, password cua cac tai khoan truy cap (thong qua file /etc/passwd, /etc/shadow) hoac lay duoc cac thong tin tai khoan truy xuat co so du lieu tren may (thong qua cac file config chua thong tin cua co so du lieu).

L.Quang