{"id":934,"date":"2020-09-18T17:18:45","date_gmt":"2020-09-18T17:18:45","guid":{"rendered":"https:\/\/blog.sh.com.tr\/?p=934"},"modified":"2020-09-18T17:28:44","modified_gmt":"2020-09-18T17:28:44","slug":"dell-idrac-erisiminde-acik-bulundu","status":"publish","type":"post","link":"https:\/\/sh.com.tr\/blog\/dell-idrac-erisiminde-acik-bulundu\/","title":{"rendered":"Dell IDRAC Eri\u015fiminde A\u00e7\u0131k Bulundu"},"content":{"rendered":"<p style=\"text-align: justify;\">Ba\u011f\u0131ms\u0131z g\u00fcvenlik ara\u015ft\u0131rmac\u0131lar\u0131n\u0131n yapm\u0131\u015f oldu\u011fu son ara\u015ft\u0131rma sonucunda, IDRAC9\u2019da s\u00fcr\u00fcm\u00fcnde ciddi bir a\u00e7\u0131k oldu\u011fu tespit edilmi\u015ftir. Bu <strong>a\u00e7\u0131k<\/strong>, k\u00f6t\u00fc niyetli ki\u015filerin IDRAC ara y\u00fcz\u00fcne izinsiz eri\u015ferek sunucunun ele ge\u00e7irilmesine imk\u00e2n sa\u011flamaktad\u0131r. <strong>DELL<\/strong> firmas\u0131 <strong>IDRAC9<\/strong> i\u00e7in yeni yay\u0131nlad\u0131\u011f\u0131 update sonras\u0131nda bu durumu \u00e7\u00f6zd\u00fc\u011f\u00fcn\u00fc belirtmektedir fakat eski s\u00fcr\u00fcmler i\u00e7in bir bilgilendirme bulunmamaktad\u0131r.<br \/>\n<a href=\"https:\/\/www.dell.com\/support\/article\/en-us\/sln322125\/dsa-2020-128-idrac-local-file-inclusion-vulnerability?lang=en\" target=\"_blank\" rel=\"noopener\">https:\/\/www.dell.com\/support\/article\/en-us\/sln322125\/dsa-2020-128-idrac-local-file-inclusion-vulnerability?lang=en<\/a><br \/>\nYay\u0131nlanan g\u00fcncellemeye ek olarak a\u015fa\u011f\u0131daki \u00f6nlemleri al\u0131nmas\u0131 \u00fcretici firma taraf\u0131ndan \u00f6nerilmektedir;<\/p>\n<p style=\"text-align: justify;\">1. IDRAC network\u00fc i\u00e7in farkl\u0131 bir a\u011f kullan\u0131lmas\u0131 ve bu a\u011f\u0131 d\u0131\u015far\u0131ya kapat\u0131lmas\u0131;<br \/>\n2. Network yap\u0131s\u0131nda Firewall kullan\u0131larak eri\u015fimler i\u00e7in yetkilendirmeler tan\u0131mlanmal\u0131,<br \/>\n3. 256-bit \u015fifreleme yan\u0131 s\u0131re TLS 1.2 veya daha y\u00fcksek s\u00fcr\u00fcm\u00fc kullan\u0131lmal\u0131,<br \/>\n4. IP Range Filtering kullan\u0131lmal\u0131;<br \/>\n5. Sunucu \u00fczerinde yap\u0131labilecek izinsiz konfig\u00fcrasyon de\u011fi\u015fiklerini \u00f6nleyebilmek i\u00e7in \u201cSystem LockDown\u201d se\u00e7ene\u011fi aktif edilmelidir. (Bu se\u00e7enek IDRAC9 s\u00fcr\u00fcm\u00fcnde mevcuttur.)<br \/>\n6. IDRAC eri\u015fimine ek olarak Active Directory veya LDAP kullan\u0131lmal\u0131,<br \/>\n7. IDRAC s\u00fcr\u00fcm\u00fc daima g\u00fcncel tutulmal\u0131,<\/p>\n<p style=\"text-align: justify;\">Belirtilen \u00f6nerilerin baz\u0131lar\u0131 eski s\u00fcr\u00fcmlerde yap\u0131lamamaktad\u0131r.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Ba\u011f\u0131ms\u0131z g\u00fcvenlik ara\u015ft\u0131rmac\u0131lar\u0131n\u0131n yapm\u0131\u015f oldu\u011fu son ara\u015ft\u0131rma sonucunda, IDRAC9\u2019da s\u00fcr\u00fcm\u00fcnde ciddi bir a\u00e7\u0131k oldu\u011fu tespit edilmi\u015ftir. Bu a\u00e7\u0131k, k\u00f6t\u00fc niyetli ki\u015filerin IDRAC ara y\u00fcz\u00fcne izinsiz eri\u015ferek sunucunun ele ge\u00e7irilmesine imk\u00e2n sa\u011flamaktad\u0131r. DELL firmas\u0131 IDRAC9 i\u00e7in yeni yay\u0131nlad\u0131\u011f\u0131 update sonras\u0131nda bu durumu \u00e7\u00f6zd\u00fc\u011f\u00fcn\u00fc belirtmektedir fakat eski s\u00fcr\u00fcmler i\u00e7in bir bilgilendirme bulunmamaktad\u0131r. https:\/\/www.dell.com\/support\/article\/en-us\/sln322125\/dsa-2020-128-idrac-local-file-inclusion-vulnerability?lang=en Yay\u0131nlanan g\u00fcncellemeye ek olarak [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":935,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[30],"tags":[134,137,136,135],"class_list":["post-934","post","type-post","status-publish","format-standard","has-post-thumbnail","category-bilgi-bankasi","tag-dell","tag-dell-idrac-acik","tag-dell-idrac-erisimi","tag-idrac"],"_links":{"self":[{"href":"https:\/\/sh.com.tr\/blog\/wp-json\/wp\/v2\/posts\/934","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sh.com.tr\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sh.com.tr\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sh.com.tr\/blog\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/sh.com.tr\/blog\/wp-json\/wp\/v2\/comments?post=934"}],"version-history":[{"count":0,"href":"https:\/\/sh.com.tr\/blog\/wp-json\/wp\/v2\/posts\/934\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/sh.com.tr\/blog\/wp-json\/wp\/v2\/media\/935"}],"wp:attachment":[{"href":"https:\/\/sh.com.tr\/blog\/wp-json\/wp\/v2\/media?parent=934"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sh.com.tr\/blog\/wp-json\/wp\/v2\/categories?post=934"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sh.com.tr\/blog\/wp-json\/wp\/v2\/tags?post=934"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}