·¢²¼Ê±¼ä£º2021-04-16
2021Äê4ÔÂ14ÈÕ£¬¹«º£²Ê´¬¡¤6600ÍøÂçCERT°²È«Ó¦¼±ÏìÓ¦ÍŶӼà²âµ½¹úÍâÑо¿Ô±ÔÚ»¥ÁªÍøÉϹ«¿ªÁËÒ»·ÝChromeÔ¶³Ì´úÂëÖ´ÐÐ0day©¶´POC£¬¾²âÊÔ£¬¹¥»÷Õß¿Éͨ¹ý¹¹ÔìÌØ¶¨WebÒ³ÃæÓÕµ¼Êܺ¦Õß·ÃÎÊ£¬µ¼Ö´Ë©¶´»ñµÃÔ¶³Ì´úÂëÖ´ÐС£
Google ChromeÊÇÓÉGoogle¿ª·¢µÄÃâ·ÑÍøÒ³ä¯ÀÀÆ÷£¬Ðí¶àµÚÈý·½ä¯ÀÀÆ÷ʹÓÃChromiumÄںˡ£¸Ã©¶´ÒѾӰÏìÁËChrome×îÐÂÕýʽ°æ£¨90.0.4430.72£©ÒÔ¼°»ùÓÚChromiumÄں˵ÄMicrosoft EdgeÕýʽ°æ£¨89.0.774.77£©¡£ÐèҪ˵Ã÷µÄÊÇ£¬´Ëö©¶´Óë4ÔÂ13ÈÕµÄChrome 0Day©¶´²¢²»ÊÇͬһ¸ö©¶´¡£¼øÓڸ鶴Ŀǰ´¦ÓÚ0Day©¶´×´Ì¬£¬Ç¿ÁÒ½¨Òé¿Í»§¾¡¿ì²ÉÈ¡ÁÙʱ½â¾ö¹«º£²Ê´¬¡¤6600¹ÙÍøÒÔ±ÜÃâÊÜ´Ë©¶´Ó°Ïì¡£
2021Äê4ÔÂ14ÈÕ£¬Chrome×îÐÂÕýʽ°æ£¨89.0.4389.128£©¸üаüÀ¨2¸ö°²È«ÐÞ¸´³ÌÐò:
[1196781] High CVE-2021-21206: Use after free in Blink
[1196683] High CVE-2021-21220: Insufficient validation of untrusted input in V8 for x86_64.
ÆäÖÐCVE-2021-21220Ϊ4ÔÂ13ÈÕ±¬³öµÄChromeÔ¶³Ì´úÂëÖ´ÐЩ¶´¡£
¶øÓÚ4ÔÂ14ÈÕ°øÍí8µã×óÓÒ»¥ÁªÍøÓÖ±¬³öÁ˱¾ÎÄÌá¼°µÄChromeÔ¶³Ì´úÂëÖ´ÐЩ¶´¡£
¸ßΣ
µ±Ç°Â©¶´POCÒѹ«¿ª
©¶´¸´ÏÖ
1.ÔÚChrome 89.0.4389.128Õýʽ°æ±¾ÖЩ¶´¸´ÏÖ£º

2.ÔÚChrome 90.0.4430.72Õýʽ°æ±¾ÖЩ¶´¸´ÏÖ£º

¼øÓڸ鶴Ŀǰ´¦ÓÚ0Day©¶´×´Ì¬£¬ÎÞÏàÓ¦µÄ©¶´²¹¶¡£¬Óû§²ÉÈ¡ÈçÏÂÁÙʱ½â¾ö¹«º£²Ê´¬¡¤6600¹ÙÍøÒÔ±ÜÃâÊÜ©¶´Ëùµ¼Ö·çÏÕÓ°Ï죺
1. É÷ÖØ´ò¿ªÀ´Ô´²»Ã÷µÄÎļþ»òÍøÒ³Á´½Ó¡£
2. ÔÝʱֹͣʹÓÃV8Ïà¹ØÒýÇæµÄä¯ÀÀÆ÷£¬ÈçChrome¡¢»ùÓÚChromiumÄں˵ÄMicrosoft Edge£¬»»FirefoxµÈä¯ÀÀÆ÷¡£
RG-IDPϵÁÐÈëÇÖ¼ì²â·ÀÓùϵͳ
RG-IDPϵÁÐÈëÇÖ¼ì²â·ÀÓùϵͳÊǹ«º£²Ê´¬¡¤6600ÍøÂçÍÆ³öµÄ½«Éî¶ÈÄÚÈݼì²â¡¢°²È«·À»¤¡¢ÉÏÍøÐÐΪ¹ÜÀíµÈ¼¼Êõ½áºÏµÄÈëÇÖ¼ì²â·ÀÓùϵͳÉ豸¡£Í¨¹ý¶ÔÍøÂçÖÐÉî²ã¹¥»÷ÐÐΪ½øÐÐ׼ȷµÄ·ÖÎöÅжϣ¬Ö÷¶¯ÓÐЧµÄ±£»¤ÍøÂ簲ȫ¡£RG—IDPϵͳÈëÇÖ¼ì²â·ÀÓùϵͳÒÑÖ§³Ö¶Ô¸Ã©¶´µÄ¼ì²â¡£
RG-ScanϵÁЩ¶´ÆÀ¹Àϵͳ
¹«º£²Ê´¬¡¤6600RG-Scanͨ¹ý¶Ôϵͳ©¶´¡¢·þÎñºóÃÅ¡¢ÍøÒ³¹ÒÂí¡¢SQL×¢Èë©¶´ÒÔ¼°¿çÕ¾½Å±¾µÈ¹¥»÷ÊֶζàÄêµÄÑо¿»ýÀÛ£¬×ܽá³öÁËÖÇÄÜÖ÷»ú·þÎñ·¢ÏÖ¡¢ÖÇÄÜ»¯ÅÀ³æºÍSQL×¢Èë״̬¼ì²âµÈ¼¼Êõ£¬¿ÉÒÔͨ¹ýÖÇÄܱéÀú¹æÔò¿âºÍ¶àÖÖɨÃèÑ¡Ïî×éºÏµÄÊֶΣ¬ÉîÈë׼ȷµÄ¼ì²â³öϵͳºÍÍøÕ¾ÖдæÔڵĩ¶´ºÍÈõµã¡£
RG-WALL ϵÁÐÈ«ÐÂÏÂÒ»´ú·À»ðǽ
RG-WALLϵÁÐÈ«ÐÂÏÂÒ»´ú·À»ðǽÔÚ°²È«ÄÜÁ¦ÉÏ£¬²»½öÖ§³ÖNAT¡¢ACL¡¢DDoS·ÀÓùµÈ´«Í³°²È«¹¦ÄÜ£¬Í¬Ê±£¬Ò²Ö§³Ö·á¸»µÄÓ¦Óü¶°²È«¹¦ÄÜ£¬°üÀ¨²¡¶¾²éɱ¡¢ÈëÇÖ¼ì²â¡¢APP¼ì²â¡¢Îļþ¹ýÂË¡¢¶ñÒâURL¹ýÂ˵ȡ£Ìṩ¶àά¶ÈµÄÓ¦Óòã¼à¿ØÓë·ÖÎö£¬°ïÖúÓû§ÕÆÎÕ·çÏÕ£¬¾«×¼Ô¤¾¯¡£Í¬Ê±Ö§³ÖÓëÔÆ°²È«ÖÐÐĵÄÁª¶¯£¬ÌṩÁËÁ¢ÌåÓÐЧµÄδ֪Íþв·À»¤¹«º£²Ê´¬¡¤6600¹ÙÍø¡£
Õë¶Ôchromeä¯ÀÀÆ÷Ô¶³Ì´úÂëÖ´ÐУ¬Ç뼰ʱ¹Ø×¢Ïà¹Ø²úÆ·Éý¼¶°ü¸üÐÂÇé¿ö¡£¼°Ê±Éý¼¶°ü¼ì²âÓë·À»¤Éý¼¶°ü¡£
https://twitter.com/frust93717815/status/1382301769577861123
¹«º£²Ê´¬¡¤6600ÍøÂçCERT°²È«Ó¦¼±ÏìÓ¦ÍŶӣ¬¸ú×Ù×îл¥ÁªÍøÍþвʼþ£¬Õë¶Ô×îа²È«Â©¶´£¬APT¹¥»÷ÒÔ¼°½©Ê¬ÍøÂç¼Ò×å×öʵʱ¸ú×ٺͷÖÎö£»Îª²úÆ·¡¢¿Í»§Ìṩʵʱ¡¢ÓÐЧµÄ°²È«·À»¤²ßÂÔÓë½â¾ö¹«º£²Ê´¬¡¤6600¹ÙÍø¡£

¹«º£²Ê´¬¡¤6600“ÍøÂç+°²È«”Ö÷ÕŽ«ÍøÂçÉ豸µÄ°²È«ÄÜÁ¦³ä·Ö·¢»Ó£¬ÍøÂçÉ豸¡¢°²È«É豸Ó밲ȫƽ̨ÖÇÄÜÁª¶¯£¬¸æ±ð°²È«¹Âµº£¬¹¹³ÉÕûÍøÁª¶¯µÄ°²È«±£ÕÏÌåϵ£¬ÊµÏÖ·À»¤¡¢°²È«Ô¤²â¡¢·ÖÎöºÍÏìÓ¦µÈ°²È«ÎÊÌâ×Ô¶¯»¯È«Á÷³Ì±Õ»·¡£

ÈçÄúÐèÒª¹«º£²Ê´¬¡¤6600°²È«£¬ÇëÁôÏÂÄúµÄÁªÏµ·½Ê½
