¡¾Îó²îͨ¸æ¡¿TLSstorm£ºAPC UPS¶à¸öÇå¾²Îó²î
Ðû²¼Ê±¼ä 2022-03-100x00 Îó²î¸ÅÊö
¿ËÈÕ£¬£¬£¬ArmisµÄÑо¿Ö°Ô±ÔÚAPCµÄSmartConnectºÍSmart-UPSϵÁвúÆ·Öз¢Ã÷ÁËͳ³ÆÎªTLSstormµÄ3¸öÎó²î£¬£¬£¬¿É´Ý»ÙÒªº¦»ù´¡ÉèÊ©Ôì³ÉÍøÂçÖÐÖ¹ºÍÎïÀíË𺦡£¡£¡£¡£¡£
0x01 Îó²îÏêÇé
APC ÊÇÊ©ÄÍµÂµçÆøµÄ×Ó¹«Ë¾£¬£¬£¬Ê©ÄÍµÂµçÆøÊÇ UPS ×°±¸µÄÁìÏȹ©Ó¦ÉÌÖ®Ò»¡£¡£¡£¡£¡£UPS ×°±¸ÎªÐèÒª¸ß¿ÉÓÃÐÔµÄÒªº¦Ê¹Ãü×ʲúÌṩ½ôÆÈ±¸ÓõçÔ´£¬£¬£¬²¢ÓÃÓÚÊý¾ÝÖÐÐÄ¡¢¹¤ÒµÉèÊ©ºÍÒ½ÔºµÈÒªº¦»ù´¡ÉèÊ©ÇéÐÎÖС£¡£¡£¡£¡£
TLSstormÎó²îÓ°ÏìÁËÆÕ±éÓÃÓÚÖÖÖֻÁìÓòµÄ APC Smart-UPS ϵͳ£¬£¬£¬°üÀ¨Õþ¸®¡¢Ò½ÁƱ£½¡¡¢¹¤Òµ¡¢IT ºÍÁãÊÛÒµµÈ¡£¡£¡£¡£¡£µ½ÏÖÔÚΪֹ£¬£¬£¬Ã»Óм£ÏóÅú×¢ÕâЩÎó²îÒѱ»Ê¹Ó㬣¬£¬Îó²îÏêÇéÈçÏ£º
l CVE-2022-22806£¨TLS Éí·ÝÑéÖ¤ÈÆ¹ý£¬£¬£¬CVSSv3ÆÀ·Ö9.0£©£ºTLS ÎÕÊÖÖеÄ״̬ÔÓÂÒµ¼ÖÂÉí·ÝÑéÖ¤±»Èƹý£¬£¬£¬µ¼ÖÂÔ¶³Ì´úÂëÖ´ÐÐ (RCE)¡£¡£¡£¡£¡£
l CVE-2022-22805£¨TLS »º³åÇøÒç³ö£¬£¬£¬CVSSv3ÆÀ·Ö9.0£©£ºÊý¾Ý°üÖØ×éÖеÄÄÚ´æË𻵹ýʧ(RCE)¡£¡£¡£¡£¡£
l CVE-2022-0715£¨¹Ì¼þÉý¼¶£¬£¬£¬CVSSv3ÆÀ·Ö8.9£©£ºÃ»ÓÐÒÔÇå¾²·½·¨¾ÙÐмÓÃÜÊðÃû£¬£¬£¬¿Éͨ¹ýÍøÂç¸üеÄδÊðÃû¹Ì¼þÉý¼¶£¨RCE£©¡£¡£¡£¡£¡£
ÆäÖУ¬£¬£¬CVE-2022-22806ºÍCVE-2022-22805Éæ¼°Smart-UPSµ½Ê©ÄÍµÂµçÆøÐ§ÀÍÆ÷µÄTLSÅþÁ¬£¬£¬£¬¿ÉÒÔͨ¹ýδ¾ÈÏÖ¤µÄÍøÂçÊý¾Ý°ü´¥·¢£¬£¬£¬¶øÎÞÐèÓû§»¥¶¯£»£»£»£»£»£»£»Ê¹ÓÃCVE-2022-0715¿É×°ÖöñÒâ¹Ì¼þ½¨É賤ÆÚÐÔ¡£¡£¡£¡£¡£
¾ÝÑо¿Ö°Ô±ÌåÏÖ£¬£¬£¬×îÐ嵀 APC Smart-UPS ÐͺÅÊÇͨ¹ýÔÆ¿ØÖƵ쬣¬£¬TLStorm Îó²î¿Éµ¼ÖÂÔÚûÓÐÈκÎÓû§½»»¥£¨»òÓû§Î´Öª£©µÄÇéÐÎÏ´ӻ¥ÁªÍøÔ¶³Ì½ÓÊÜ×°±¸¡£¡£¡£¡£¡£
Ó°Ïì¹æÄ£
SmartConnect ϵÁУ¨CVE-2022-22805¡¢CVE-2022-22806¡¢CVE-2022-0715£©£º
SMTϵÁÐ ID=1015£ºUPS 04.5 ¼°Ö®Ç°
SMC ϵÁÐ ID=1018£ºUPS 04.2 ¼°Ö®Ç°
MTL ϵÁÐ ID=1026£ºUPS 02.9 ¼°Ö®Ç°
SCL ϵÁÐ ID=1029£ºUPS 02.5 ¼°Ö®Ç°
SCL ϵÁÐ ID=1030£ºUPS 02.5 ¼°Ö®Ç°
SCL ϵÁÐ ID=1036£ºUPS 02.5 ¼°Ö®Ç°
SCL ϵÁÐ ID=1037£ºUPS 03.1 ¼°Ö®Ç°
SMX ϵÁÐ ID=1031£ºUPS 03.1 ¼°Ö®Ç°
Smart-UPS ϵÁУ¨CVE-2022-0715£©£º
SMT ϵÁÐ ID=18£ºUPS 09.8 ¼°Ö®Ç°
SMT ϵÁÐ ID=1040£ºUPS 01.2 ¼°Ö®Ç°
SMT ϵÁÐ ID=1031£ºUPS 03.1 ¼°Ö®Ç°
SMC ϵÁÐ ID=1005£ºUPS 14.1 ¼°Ö®Ç°
SMC ϵÁÐ ID=1007£ºUPS 11.0 ¼°Ö®Ç°
SMC ϵÁÐ ID=1041£ºUPS 01.1 ¼°Ö®Ç°
SCL ϵÁÐ ID=1030£ºUPS 02.5 ¼°Ö®Ç°
SCL ϵÁÐ ID=1036£ºUPS 02.5 ¼°Ö®Ç°
SMX ϵÁÐ ID=20£ºUPS 10.2 ¼°Ö®Ç°
SMX ϵÁÐ ID=23£ºUPS 07.0 ¼°Ö®Ç°
SRT ϵÁÐ ID=1010/1019/1025£ºUPS 08.3 ¼°Ö®Ç°
SRT ϵÁÐ ID=1024£ºUPS 01.0 ¼°Ö®Ç°
SRT ϵÁÐ ID=1020£ºUPS 10.4 ¼°Ö®Ç°
SRT ϵÁÐ ID=1021£ºUPS 12.2 ¼°Ö®Ç°
SRT ϵÁÐ ID=1001/ 1013£ºUPS 05.1 ¼°Ö®Ç°
SRT ϵÁÐ ID=1002/1014£ºUPSa05.2 ¼°Ö®Ç°
×¢£ºÎó²îÏêÇé¼°¸ü¶àÐÅÏ¢Çë²Î¿¼£º
https://www.armis.com/research/tlstorm/
0x02 ´¦Öóͷ£½¨Òé
ÏÖÔÚSchneider ElectricÒÑÐû²¼Ïà¹ØÇå¾²¸üУ¬£¬£¬ÊÜÓ°ÏìµÄÓû§¿ÉÒÔʵÑéÈçÏÂÇå¾²½¨Ò飺
1.×°Öà Schneider Electric ÍøÕ¾ÉÏÌṩµÄ²¹¶¡³ÌÐò¡£¡£¡£¡£¡£
²Î¿¼Á´½Ó£º
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-067-02
2.ÈôÊÇÄúʹÓà NMC£¬£¬£¬Çë¸ü¸ÄĬÈÏ NMC ÃÜÂ루¡°apc¡±£©²¢×°ÖùûÕæÊðÃûµÄ SSL Ö¤Ê飬£¬£¬ÕâÑùÄúÍøÂçÉϵĹ¥»÷Õß½«ÎÞ·¨½Ø»ñÐÂÃÜÂë¡£¡£¡£¡£¡£Òª½øÒ»²½ÏÞÖÆ NMC µÄ¹¥»÷Ãæ£¬£¬£¬Çë²Î¿¼Ê©ÄÍµÂµçÆøNMC 2ºÍNMC 3µÄÇå¾²Êֲ᣺
https://www.se.com/il/en/download/document/SPD_LFLG-9VYK3D_EN/
https://www.se.com/il/en/download/document/SPD_CCON-BDYD7K_EN/
3.°²ÅÅ»á¼û¿ØÖÆÁбí (ACL)£¬£¬£¬ÆäÖнöÔÊÐí UPS ×°±¸Í¨¹ý¼ÓÃÜͨѶÓ벿·ÖÖÎÀí×°±¸ºÍÊ©ÄÍµÂµçÆøÔÆ¾ÙÐÐͨѶ¡£¡£¡£¡£¡£
0x03 ²Î¿¼Á´½Ó
https://www.armis.com/research/tlstorm/
https://www.se.com/ww/en/work/support/cybersecurity/security-notifications."text-indent:28px;line-height:150%">https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-067-02
https://www.bleepingcomputer.com/news/security/apc-ups-zero-day-bugs-can-remotely-burn-out-devices-disable-power/
0x04 ¸üа汾
°æ±¾ | ÈÕÆÚ | ÐÞ¸ÄÄÚÈÝ |
V1.0 | 2022-03-10 | Ê×´ÎÐû²¼ |
0x05 ¸½Â¼
¼øºÚµ£±£Íø¼ò½é
¼øºÚµ£±£Íø¹«Ë¾½¨ÉèÓÚ1996Ä꣬£¬£¬²¢ÓÚ2010Äê6ÔÂ23ÈÕÔÚÉî½»ËùÖÐС°åÕýʽ¹ÒÅÆÉÏÊУ¬£¬£¬ÊǺ£ÄÚ¼«¾ßʵÁ¦µÄ¡¢ÓµÓÐÍêÈ«×ÔÖ÷֪ʶ²úȨµÄÍøÂçÇå¾²²úÆ·¡¢¿ÉÐÅÇå¾²ÖÎÀíÆ½Ì¨¡¢Ç徲ЧÀÍÓë½â¾ö¼Æ»®µÄ×ÛºÏÌṩÉÌ¡£¡£¡£¡£¡£
¹«Ë¾×ܲ¿Î»ÓÚ±±¾©ÊÐÖйشåÈí¼þÔ°£¬£¬£¬ÔÚÌìϸ÷Ê¡¡¢ÊС¢×ÔÖÎÇøÉèÓзÖÖ§»ú¹¹£¬£¬£¬ÓµÓÐÁýÕÖÌìϵÄÇþµÀϵͳºÍÊÖÒÕÖ§³ÖÖÐÐÄ£¬£¬£¬²¢ÔÚ±±¾©¡¢ÉϺ£¡¢³É¶¼¡¢¹ãÖÝ¡¢³¤É³¡¢º¼ÖÝµÈ¶àµØÉèÓÐÑз¢ÖÐÐÄ¡£¡£¡£¡£¡£
¶àÄêÀ´£¬£¬£¬¼øºÚµ£±£ÍøÖÂÁ¦ÓÚÌṩ¾ßÓйú¼Ê¾ºÕùÁ¦µÄ×ÔÖ÷Á¢ÒìµÄÇå¾²²úÆ·ºÍ×î¼Ñʵ¼ùЧÀÍ£¬£¬£¬×ÊÖú¿Í»§ÖÜÈ«ÌáÉýÆäIT»ù´¡ÉèÊ©µÄÇå¾²ÐÔºÍÉú²úЧÄÜ£¬£¬£¬Îª´òÔìºÍÌáÉý¹ú¼Ê»¯µÄÃñ×åÐÅÏ¢Çå¾²¹¤ÒµÁì¾üÆ·ÅÆ¶ø²»Ð¸Æð¾¢¡£¡£¡£¡£¡£
¹ØÓÚ¼øºÚµ£±£Íø
¼øºÚµ£±£ÍøÇå¾²Ó¦¼±ÏìÓ¦ÖÐÐÄÖ÷ÒªÕë¶ÔÖ÷ÒªÇå¾²Îó²îµÄÔ¤¾¯¡¢¸ú×ٺͷÖÏíÈ«Çò×îеÄÍþвÇ鱨ºÍÇå¾²±¨¸æ¡£¡£¡£¡£¡£
¹Ø×¢ÒÔϹ«Öںţ¬£¬£¬»ñȡȫÇò×îÐÂÇå¾²×ÊѶ£º