Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
脆弱性発見者の目から見た、脆弱性対応の最前線
Search
MUNEAKI NISHIMURA
December 01, 2016
Technology
15
2.7k
脆弱性発見者の目から見た、脆弱性対応の最前線
Internet Week 2016の講演資料です。
MUNEAKI NISHIMURA
December 01, 2016
Tweet
Share
More Decks by MUNEAKI NISHIMURA
See All by MUNEAKI NISHIMURA
脆弱星に導かれて
nishimunea
3
2.6k
Brave Browserの脆弱性を見つけた話(iOS編)
nishimunea
3
2.7k
ブラウザの脆弱性とそのインパクト
nishimunea
26
9.9k
脆弱性発見者が注目する近年のWeb技術
nishimunea
29
13k
Slack Team for Security Testers and Bug Hunters
nishimunea
1
800
Finding Vulnerabilities in Firefox for iOS
nishimunea
3
8.7k
SWIFT Code for Mozilla Bank
nishimunea
1
950
次世代プラットフォームのセキュリティモデル考察
nishimunea
6
5.4k
Other Decks in Technology
See All in Technology
さくらのIaaS基盤のモニタリングとOpenTelemetry/OSC Hokkaido 2025
fujiwara3
3
440
Lufthansa ®️ USA Contact Numbers: Complete 2025 Support Guide
lufthanahelpsupport
0
200
Zephyr RTOSを使った開発コンペに参加した件
iotengineer22
1
220
ビギナーであり続ける/beginning
ikuodanaka
3
750
Backlog ユーザー棚卸しRTA、多分これが一番早いと思います
__allllllllez__
1
150
freeeのアクセシビリティの現在地 / freee's Current Position on Accessibility
ymrl
2
190
Flutter向けPDFビューア、pdfrxのpdfium WASM対応について
espresso3389
0
130
B2C&B2B&社内向けサービスを抱える開発組織におけるサービス価値を最大化するイニシアチブ管理
belongadmin
1
6.9k
AWS認定を取る中で感じたこと
siromi
1
190
KiCadでPad on Viaの基板作ってみた
iotengineer22
0
300
Delta airlines®️ USA Contact Numbers: Complete 2025 Support Guide
airtravelguide
0
340
改めてAWS WAFを振り返る~業務で使うためのポイント~
masakiokuda
2
250
Featured
See All Featured
Designing for Performance
lara
610
69k
Java REST API Framework Comparison - PWX 2021
mraible
31
8.7k
How to Create Impact in a Changing Tech Landscape [PerfNow 2023]
tammyeverts
53
2.9k
4 Signs Your Business is Dying
shpigford
184
22k
Faster Mobile Websites
deanohume
307
31k
Reflections from 52 weeks, 52 projects
jeffersonlam
351
20k
Fantastic passwords and where to find them - at NoRuKo
philnash
51
3.3k
Improving Core Web Vitals using Speculation Rules API
sergeychernyshev
18
970
Building Better People: How to give real-time feedback that sticks.
wjessup
367
19k
Rebuilding a faster, lazier Slack
samanthasiow
82
9.1k
Performance Is Good for Brains [We Love Speed 2024]
tammyeverts
10
950
Bash Introduction
62gerente
613
210k
Transcript
੬ऑੑൃݟऀͷ͔Βݟͨɺ੬ऑੑରԠͷ࠷લઢ גࣜձࣾϦΫϧʔτςΫϊϩδʔζ αΠόʔηΩϡϦςΟΤϯδχΞϦϯά෦ ଜ फߊ
ଜ फߊ גࣜձࣾϦΫϧʔτςΫϊϩδʔζ αΠόʔηΩϡϦςΟΤϯδχΞϦϯά෦ γχΞηΩϡϦςΟΤϯδχΞ ࠃܞଳిϝʔΧʔͰͷηΩϡϦςΟίϯαϧλϯτ ͳͲΛܦ݄ͯΑΓݱ৬ɻϦΫϧʔτͷ*%ཧج ൫ͷηΩϡϦςΟอकϦΫϧʔτάϧʔϓશࣾͷ੬ऑ ੑमਖ਼ࢧԉʹܞΘΔɻझຯϒϥβͷ੬ऑੑΛ୳͢͜ ͱɻʹใࠂͨ͠੬ऑੑ݅Λ͑Δɻஶॻʹ
ϒϥβϋοΫʢ༁ʣɻओͳߨԋྺʹ$0%& #-6& ɺ"750,:0 ɺ1BD4FD ɻΑΓ ηΩϡϦςΟɾΩϟϯϓશࠃେձߨࢣ
੬ऑੑ͕େ͖ ؆୯ʹݴ͏ͱ
ຊͷ͓ • ੬ऑੑΛ୳࢝͠Ίͨཧ༝ͱଓ͚Δཧ༝ • ੬ऑੑΛݟ͚ͭΔͨΊʹ࣮ફ͍ͯ͠Δ͜ͱ • ൃݟऀͷ͔Βݟͨ੬ऑੑରԠͷݱ • ϦΫϧʔτʹ͓͚Δ੬ऑੑରԠ •
·ͱΊ
੬ऑੑΛ୳࢝͠Ίͨཧ༝ͱଓ͚Δཧ༝
͖͔͚ͬͷηΩϡϦςΟɾΩϟϯϓ • Ϋϥεͷ୩ཅհࢯ͔ΒϑϥϯΫʹߨࢣͷґཔ͕དྷͨ
ηΩϡϦςΟɾΩϟϯϓͱ • ࣍Λ୲͏ηΩϡϦςΟਓࡐͷൃ۷ͱҭΛ తͱͨ͠ຽ࿈ܞࣄۀ - *1"ͱࣾͷڠࢍاۀ͔ΒͳΔ࣮ࢪڠٞձ͕ओ࠵ - ܦࡁ࢈ۀল͕ڞ࠵ - ࠓͰ
• ധɺே͔Β൩·ͰηΩϡϦςΟ௮͚ͷ߹॓ - શࠃ໊ͷԠืऀ͔Βબൈ͞Ε໊͕ͨࢀՃ - ֤ྖҬͷҰઢͰ׆༂͢Δٕज़ऀਞ͕ߨࢣΛ୲
҆қʹҾ͖ड͚ͨͷͷɾɾɾ • ࣗҎ֎༗໊ͳߨࢣਞ - ॻళωοτͷηΩϡϦςΟ࿈ࡌهࣄͳͲͰΑ໊͘લΛݟΔਓͨͪ - (PPHMFͷ੬ऑੑใࠂ݅ͰੈքҐͷਓ • $5'ະ౿ͳͲଟํ໘Ͱ׆༂͢Δνϡʔλʔ •
શࠃ͔Βબͼൈ͔ΕͨԠืऀୡ • ຊʹ͕ࣗߨࢣͰྑ͔ͬͨͷ͔ʁ - ࣗͷ࣮ྗΛ٬؍తʹଌΔखஈ͕ཉ͔ͬͨ͠ - ڭ͑Δࢿ͕֨͋Δ͔Λ͔֬Ί͔ͨͬͨ
ͦ͜Ͱɺ'JSFGPYϒϥβͷ੬ऑੑใ੍ۚઓ • ੈքதͷϓϨʔϠʔΑΓઌʹ੬ऑੑΛݟ͚ͭग़͢ڝ૪ • ֫ಘͨ͠ใۚͷֹͰ࣮ྗΛՄࢹԽͰ͖Δ • ੬ऑੑΛݟ͚ͭΒΕͳ͚ΕɺߨࢣΛࣙୀ͠Α͏ͱߟ͍͑ͯͨ • ϲ݄ͷۤΛܦͯ੬ऑੑΛൃݟʂ
੬ऑੑ୳͠Λͯ͠ಘͨͷ • ͪΖΜใۚ - ͜Ε·Ͱʹ ສԁҎ্ - Ͱɺ࠷ॳʹखʹͨ͠ใۚͰࣗసंΛങͬͨΒɺۚમཉ͕ࣦͤͯ͠·ͬͨ • ηΩϡϦςΟΤϯδχΞͱͯ͠ͷجૅྗ
- ղͳ༷ίʔυ͔ΒΛഎ͚ͣʹಡΈղ͘ྗ - ࢥ͍ࠐΈΛࣺͯɺࣄΛࣗͷखͰݕূ͢Δྗ
੬ऑੑΛ୳͠ଓ͚Δཧ༝ • ॅϩʔϯΛฦͨ͢Ί - ඪࡀ·Ͱʹࡁ - Ք͍࣮ͩײͷͳ͍ใۚɺआΓ࣮ͨײͷͳ͍ϩʔϯͱ૬ੑ͕͍͍ • ٕज़ྗͷҡ্࣋ͷͨΊ -
༷ίʔυΛѱ༻ํ๏Λߟ͑Δश׳Λ͚͓ͭͯ͘ͱɺ ۀͰݕࠪϨϏϡʔ͢Δͱ͖ʹ߈ܸํ๏͕ર͖͘͢ͳΔ - ଞͷൃݟऀ։ൃऀͱग़ձ͍ɺ৽ͨͳ߈ܸͷํΛֶͿ
੬ऑੑΛݟ͚ͭΔͨΊʹ࣮ફ͍ͯ͠Δ͜ͱ
طͷ੬ऑੑʹֶͿ • աڈͷ੬ऑੑใΛௐΔ • ߈ܸίʔυΛ࡞࣮ͬͯࡍʹݕূ͢Δ - վमͷޡΓͳͲ͕ݪҼͰɺաڈͷ੬ऑੑ͕࠶ൃ͢Δ - ࠶ར༻Ͱ͖ΔΑ͏ʹɺ࡞ͨ͠߈ܸίʔυΛอଘ͓ͯ͘͠ •
ྨࣅͷ੬ऑੑΛ୳͢ - աڈʹ੬ऑੑ͕ࢦఠ͞ΕͨػೳɺͦΕͱΑ͘ࣅͨػೳ - લఏ݅Λগ͠ม͑ͯɺಉ͡߈ܸίʔυΛࢼ͢
طͷ੬ऑੑʹֶͿ $41ҧϨϙʔτ࣮ෆඋͷࣄྫ • .P[JMMBͷηΩϡϦςΟΞυόΠβϦ͔Βաڈͷ੬ऑੑใΛೖख https://www.mozilla.org/en-US/security/advisories/
طͷ੬ऑੑʹֶͿ $41ҧϨϙʔτ࣮ෆඋͷࣄྫ • ݄ɺ$POUFOU4FDVSJUZ1PMJDZʢ$41ʣͷҧϨϙʔτػೳΛ௨ͯ͡ ଞͷαΠτͷใΛ౪ΊΔ͜ͱΛ*/3*"ͷݚڀऀ͕ࢦఠʢ$7&ʣ https://www.mozilla.org/en-US/security/advisories/mfsa2012-53/
طͷ੬ऑੑʹֶͿ $41ҧϨϙʔτ࣮ෆඋͷࣄྫ • ݄ɺߴԽͷͨΊʹ$41ͷ࣮ΛϦϑΝΫλϦϯάͨ͠ࡍɺ ಉ͡੬ऑੑ͕࠶ൃʢ$7&ʣ https://www.mozilla.org/en-US/security/advisories/mfsa2014-86/
طͷ੬ऑੑʹֶͿ $41ҧϨϙʔτ࣮ෆඋͷࣄྫ • ݄ɺJGSBNFͷϖʔδͰ$41ʹҧ͢ΔॲཧΛߦ͏͜ͱʹΑΓ ྨࣅͷ੬ऑੑ͕࠶ݱʢ$7&ʣ https://www.mozilla.org/en-US/security/advisories/mfsa2016-18/
༷ʹֶͿ • *&5'8$ͷ༷ॻΛͻͨ͢ΒಡΉ - ෳͷ༷Λ͋ΘͤಡΉͱɺ༷ͷൈ͚࿙Ε͕ݟ͑ͯ͘Δ • ༷ॻͷ4FDVSJUZ$POTJEFSBUJPOT͔Β߈ܸͷ؍ΛಘΔ - ϒϥβͷதͰى͖͍͚ͯͳ͍͜ͱ͕͔Δ •
ػೳ͕༷Ͳ͓Γʹ࣮͞Ε͍ͯΔ͔ݕূ͢Δ - ༷ʹॻ͔Ε͍ͯΔࢪࡦ͕࣮͞Ε͍ͯͳ͍͜ͱ͕͋Δ
༷ʹֶͿ r )5.-*NQPSUTͷ࣮ෆඋͷࣄྫ • 3'$ Ͱ$POUFOU%JTQPTJUJPOͱ͍͏)551ϔομ͕ఆٛ͞Ε͍ͯΔ - $POUFOU%JTQPTJUJPOBUUBDINFOU͕)551Ϩεϙϯεʹࢦఆ͞Ε͍ͯΔ߹ɺ ϒϥβͦͷίϯςϯπΛ։͔ͣɺμϯϩʔυͤ͞ͳ͚ΕͳΒͳ͍ •
$POUFOU%JTQPTJUJPOͷແࢹ੬ऑੑͱͯ͠ѻΘΕΔ - 'JSFGPYɿ$7&ɺ$7& - 4BGBSJɿ$7&ɺ$7&
༷ʹֶͿ r )5.-*NQPSUTͷ࣮ෆඋͷࣄྫ • $ISPNFͷ)5.-*NQPSUT͕$POUFOU%JTQPTJUJPOΛແࢹ͢Δ͜ͱΛ ։ൃݩͷ(PPHMFʹใࠂʢ*TTVFʣ • ͜ΕΛड͚ɺ8$ͷ༷ʹ$POUFOU%JTQPTJUJPOͷهड़͕Ճ͞Εͨ https://www.w3.org/TR/2016/WD-html-imports-20160225/
աڈʹݟ͚༷ͭͨͷ࣮ෆඋʢൈਮʣ • $ISPNFͷ$41ҧϨϙʔτͷૹ৴ઌ͕CBTFͰ੍ޚͰ͖Δ IUUQTDSCVHDPN • $ISPNFͷ4FSWJDF8PSLFST͕JGSBNFTBOECPYͰಈ࡞͢Δ IUUQTDSCVHDPN • 'JSFGPYͷ3FGFSSFS1PMJDZ͕৽͍͠λϒͰ։͍ͨࡍʹޮ͔ͳ͍ IUUQTMJTUTXPSH"SDIJWFT1VCMJDQVCMJDXFCBQQTFD"QSIUNM
• 'JSFGPYͷ#SPBEDBTU$IBOOFM"1*͕ϓϥΠόγʔϞʔυ͔Β ௨ৗϞʔυͷΟϯυʹ௨͞ΕΔ IUUQTCVH[JMMBNP[JMMBPSHTIPX@CVHDHJ JE • 'JSFGPYͷ'FUDI"1*Ͱ)PTU$PPLJFϦΫΤετϔομ͕ࢦఆͰ͖Δ IUUQTCVH[JMMBNP[JMMBPSHTIPX@CVHDHJ JE
ൃݟऀͷ͔Βݟͨ੬ऑੑରԠͷݱ
ϒϥβϕϯμʔͷ੬ऑੑରԠ • ੬ऑੑͷରԠํϕϯμʔʹΑͬͯେ͖͘ҟͳΔ • ϦϞʔτίʔυ࣮ߦʢ3$&ʣͷ੬ऑੑॏࢹͯ͠मਖ਼͞ΕΔҰํɺ αϯυϘοΫεόΠύεʢಉҰੜݩϙϦγʔͷᷖճͳͲʣͷରԠ Թײ͕ϕϯμʔʹΑͬͯҟͳΔ - $ISPNFͱ'JSFGPYɿ੬ऑੑใ੍ۚͷରɻ௨ৗʙϲ݄Ҏʹमਖ਼ -
4BGBSJɿใ੍ۚͷର֎ɻҎ্मਖ਼͞Εͳ͍͜ͱ
'JSFGPYͷ੬ऑੑରԠ • ಁ໌ੑ͕ߴ͍ - मਖ਼͕ϦϦʔε͞ΕΔ·ͰͷաఔΛඇެ։ઃఆͷ#VH[JMMBͰͰ͖Δ - ਂࠁͷஅཧ༝Λઆ໌ͯ͘͠ΕΔ - ଞͷ୭͔ͱಉ͡੬ऑੑʢ%VQMJDBUFEʣΛใࠂ͢Δͱɺͦ͏அͨ͠ূڌͱͯ͠ɺ ඇެ։ઃఆʹͳ͍ͬͯΔಉ͡੬ऑੑͷ#VH[JMMBͷΞΫηεݖΛΒ͑Δ
• ରԠ͕ૣ͍ - ਂࠁͷߴ͍ͷʙ͔݄Ͱमਖ਼ - ਂࠁͳ੬ऑੑۓٸΞοϓσʔτͰमਖ਼
'JSFGPYͷ੬ऑੑରԠ ূ໌ॻݕূόΠύεͷ੬ऑੑࣄྫ • 'JSFGPYͰࡌ͞Εͨݟ҉߸Λ༻͍ͯɺ)5514ͷαʔόূ໌ॻݕূ ͱެ։伴ϐϯχϯάΛᷖճͰ͖Δ੬ऑੑʢ$7&ʣΛใࠂ • ޙɺ'JSFGPY͕ۓٸϦϦʔε https://www.us-cert.gov/ncas/current-activity/2015/04/06/Mozilla-Releases-Security-Update-Firefox
ຊͷ੬ऑੑ૭ޱ • *1"ͷ੬ऑੑؔ࿈ใͷಧग़ड੍ - ಧग़͔Β࠷ॳͷԠ·Ͱʹϲ݄ - ୲ऀʹࢦఠ༰Λཧղͯ͠͏·Ͱʹ Կ͔ΓऔΓ͕ଓ͘ - ݁Ռͱͯ͠ɺӈਤʮʯ·Ͱͷ͕ؒظԽ
https://www.ipa.go.jp/files/000052737.pdf
*1"ͷ੬ऑੑ૭ޱ r "QBDIF$PSEPWBͷ੬ऑੑࣄྫ • "QBDIF$PSEPWBͷҙϓϥάΠϯ࣮ߦͷ੬ऑੑʢ $7&ʣ - ѱҙͷ͋ΔαΠτΛ։͚ͩ͘ͰɺΞϓϦͷػೳΛѱ༻͞ΕΔ੬ऑੑɻ ใࠂͷࡍɺσϞͱͯ͠εϚϗͷిாΛվ͟Μ͢ΔίʔυΛૹ -
ϲ݄ޙɺ*1"͔Βిா͕վ͟Μ͞ΕΔ͜ͱͷͲ͕͜੬ऑੑͳͷ͔ʁͱ͍͏࣭ - ͜ͷ࣌Ͱɺ+1$&35$$ʹ࿈བྷ͕ߦΘΕ͍ͯͳ͍ https://jvn.jp/jp/JVN41772178/
ൃݟऀ͔Βͷ͓ئ͍ • ରԠͷঢ়گΛఆظతʹڞ༗ͯ͠ཉ͍͠ - ରԠྃ·ͰҰ࿈བྷͷདྷͳ͍૭ޱ͕ଟ͍ - Ҏ্Ի৴ෆ௨ͷࣄྫ͋Δ • ঢ়گ͕͔Βͳ͍ͱൃݟऀෆ҆ʹͳΔ -
ใࠂͷํ͕ޡ͍ͬͯͨͷͰͳ͍͔ʢӈਤʣ - ૣ͘͠ͳ͍ͱ੬ऑੑ͕ѱ༻͞ΕΔͷͰͳ͍͔ • मਖ਼લͷ੬ऑੑ͕ެද͞ΕΔڪΕ - ใࠂΛແࢹ͞Εͨͱײͨ͡ൃݟऀౖ͕ͬͯ࿐ - ެදʹΑΓमਖ਼Λଅͦ͏ͱ͢Δൃݟऀ ˞גࣜձࣾϨϐμϜ ྛࢯͷߨԋࢿྉΑΓҾ༻
ϦΫϧʔτʹ͓͚Δ੬ऑੑରԠ
ϦΫϧʔτʹ͓͚Δ੬ऑੑରԠͷجຊํ • ੬ऑੑରԠ֤ࣄۀͰ࣮ࢪ - ۓٸੑͷߴ͍੬ऑੑͷΈɺ$4*35͔Β֤ࣄۀରԠΛґཔ • ੬ऑੑใͷऩूͱਂࠁͷධՁΛ$4*35Ͱ࣮ࢪ - ࢲΛؚΊਓͷٕज़ऀ͕࣋ͪճΓͰ୲
Ұൠతͳ੬ऑੑใఏڙαʔϏεͷ՝ • ใ৴ͷλΠϜϥά - ։ൃݩʹΑΔใެ։͔ΒఔͷԆ • ใͷཏੑ - $7&ͷׂΓͯΒΕ͍ͯͳ͍੬ऑੑͳͲʹൈ͚ •
ࣗࣾڥͱҰக͠ͳ͍ਂࠁධՁ - $744੬ऑੑ͕࠷େݶʹѱ༻͞ΕͨલఏͰݟੵΒΕΔ͕͋Γɺ ࣗࣾʹ͓͚ΔਂࠁͱҰக͠ͳ͍͜ͱ͕͋Δ
ͦ͜ͰɺࣗࣾͰ੬ऑੑใͷऩूͱධՁ͕ඞཁ • ใల։ͷૣظԽ - ੬ऑੑͷҰ࣍ใΛపఈऩू - +1$&35$$ͷૣظܯռύʔτφʔγοϓΛ௨ͯ͡ɺެදલͷ੬ऑੑใΛೖख • ཏੑͷ্ -
ࠃ֎ͷηΩϡϦςΟใൃ৴ऀΛ5XJUUFSͰϑΥϩʔ - +1$&35$$ͷૣظܯռใΛ༻͍ͯɺใͷऩू࿙ΕΛݮ • ࣗࣾڥʹج͍ͮͨ੬ऑੑධՁ - ੬ऑੑΛ$4*35Ͱղੳ͠ɺ߈ܸͷқࣗࣾͰੜ͡͏ΔඃΛධՁ
ใల։ͷૣظԽ • ߈ܸ͕དྷΔલʹɺใͷऩूɺධՁɺରԠࢧԉΛऴΘΒͤΔඞཁ͕͋Δ - ͷ4IFMMTIPDLͷΑ͏ʹใ͕ެ։͞Εͨཌ͔Β߈ܸ͕؍ଌ͞Εͨࣄྫ ੬ऑੑใެ։ ߈ܸίʔυ࡞ ߈ܸ׆ಈ ใऩू ղੳͱධՁ
ରԠࢧԉ ੬ऑੑͷղੳ ߈ܸऀ $4*35
ใల։ͷૣظԽ • ͭͷใܦ࿏ΛΈ߹ΘͤͯɺใऩूͷૣظԽͱཏੑΛٻ - ೋ࣍ใͰใΛಘͨͷɺҰ࣍ใͰऩूͰ͖ΔΑ͏ʹϑΟʔυόοΫ ੬ऑੑใެ։ +1$&35$$ ૣظܯռύʔτφʔγοϓ Ұ࣍ใ ೋ࣍ใ
+1$&35$$ ૣظܯռใ • ެ։લͷ੬ऑੑใ • ֤छ344.- • ։ൃݩͷ8FCαΠτ • 5XJUUFS • ֤छχϡʔεαΠτ • ຖ༦ํʹདྷΔ ΞφϦετϊʔτ
ใల։ͷૣظԽ r (IPTUTDSJQUͷ੬ऑੑࣄྫ ࣌ ঢ়گ ݄ (IPTUTDSJQUͷ։ൃݩʹ੬ऑੑͷߘʢ࣮ূίʔυ͋Γʣ ݄ 0444FDVSJUZ.-Ͱ$7&࠾൪ ݄
ࠃͷ੬ऑੑใαʔϏεʹใܝࡌ ݄ .FUBTQMPJUͷ(JU)VCʹͯຊ੬ऑੑͷ߈ܸίʔυΛ֬ೝ ݄ +1$&35$$ΑΓૣظܯռύʔτφʔγοϓใ৴ ݄ +1$&35$$ΑΓૣظܯռใ৴ • (IPTUTDSJQUʹ͓͚ΔϦϞʔτίʔυ࣮ߦͷ੬ऑੑʢ$7&ʣ ͜ͷ࣌Ͱ֤ࣄۀʹ ۓٸରԠΛґཔ
ࣗࣾڥʹج͍ͮͨ੬ऑੑධՁ • ެ։͞Ε͍ͯΔ$744ΛӏವΈʹ͠ͳ͍ - Өڹ͠ͳ͍੬ऑੑͷରԠʹ֤ࣄۀͷΛׂ͘͜ͱʹͳΔ - ࣗࣾڥʹ͓͚ΔӨڹΛٕज़తʹஅ • ՄೳͳݶΓमਖ਼ύονͷιʔείʔυΛ֬ೝ -
߈ܸͷ༰қੑΛਪଌͰ͖Δ - Ճ͞Εͨςετέʔείϛοτϝοηʔδʹ߈ܸίʔυؚ͕·ΕΔ͜ͱ • ߈ܸπʔϧͷ։ൃϦϙδτϦΛࢹͯ͠߈ܸͷՄೳੑΛஅ - .FUBTQMPJUͷ(JU)VCʹ߈ܸίʔυ͕ଓʑͱू·Δ IUUQTHJUIVCDPNSBQJENFUBTQMPJUGSBNFXPSLQVMMT
ࣗࣾڥʹج͍ͮͨ੬ऑੑධՁ • ηΩϡϦςΟٕज़ऀ͕ू·Δ4MBDLίϛϡχςΟͷ׆༻ - ॴଐ৫ͷนΛ͑ͯ੬ऑੑͷղੳঢ়گΛڞ༗ - ηΧϯυΦϐχΦϯతʹ׆༻͠ɺղੳͷޡΓΛ͙
ϝτϦΫε ߈ܸϕΫλ ωοτϫʔΫ ߈ܸͷෳࡶ͞ ʹ؆୯ ೝূͷཁ൱ ೝূͳ͠ ػີੑͷӨڹ શ໘త
શੑͷӨڹ શ໘త Մ༻ੑͷӨڹ શ໘త ࣗࣾڥʹج͍ͮͨ੬ऑੑධՁ r $7& • 0QFO44-ʹ͓͚ΔϝϞϦૢ࡞ͷෆඋͷ੬ऑੑ • /*45ධՁͷ$744ϕʔε - ϝϞϦഁյܥͷ੬ऑੑͷඃ௨ৗαʔϏεɻ ϝϞϦͷյ͠ํ࣍ୈͰϦϞʔτίʔυ࣮ߦͱͳΔ - ߈ܸͷෳࡶ͞ʢʣαʔϏεΛલఏʹ ݟੵΒΕ͍ͯΔҰํɺӨڹʢશ໘తʣ ϦϞʔτίʔυ࣮ߦΛલఏͱ͍ͯ͠Δ • 0QFO44-ͷΞυόΠβϦʢҰ࣍ใʣͰ - 8FCαʔόϩʔυόϥϯα͕)5514௨৴࣌ʹ ༻͢ΔMJCTTMʹӨڹ͠ͳ͍ /*45ͷ$744WϕʔεείΞ Ұ࣍ใΑΓۓٸରԠෆཁͱஅ
ࣗࣾڥʹج͍ͮͨ੬ऑੑධՁ r $7& • Bind9におけるサービス妨害の脆弱性 ࣌ ঢ়گ ݄ ։ൃݩ͔Β੬ऑੑใެ։ɻ։ൃϦϙδτϦʹमਖ਼ύον͋Γɻ ղੳͷ݁Ռɺ%/4ϦΫΤετൃͰ%/4αʔόΛ
མͱͤΔ͜ͱ͕໌ɻۓٸରԠΛ࣮ࢪ ݄ .FUBTQMPJUͷ(JU)VCʹ߈ܸίʔυͷଘࡏΛ֬ೝ ݄ ओཁαʔϏεʹ͓͍ͯύονద༻ྃ ݄ ܯிΑΓɺຊ੬ऑੑΛѱ༻ͨ͠ແࠩผͳ߈ܸ׆ಈ͕ ࢹ͞Εͨͱͷҙשى
༧ఆ͍ͯ͠ΔऔΓΈ • ใऩूͷޮԽ - 5XJUUFSʹΑΔใऩूʢຖʙ࣌ؒʣͷஔ͖͑Λݕ౼த • ߈ܸ׆ಈͷใऩूΛڧԽ - ֤ࠃͷ߈ܸൃੜঢ়گΛऩू -
߈ܸͷൃੜঢ়گʹԠͯ͡ɺ͔ʹରԠͷԹײΛม͑Δ • ֤αʔϏεͷߏʹԠͨ͡ରԠґཔ - αʔόߏίϯϑΟάϨʔγϣϯͳͲΛৄࡉʹѲ͠ɺ ֎෦͔Β߈ܸΛड͚ΔՄೳੑʹԠͯ͡ରԠͷԹײΛ͚Δ
·ͱΊ
·ͱΊ • ۀͱݸਓͷ׆ಈͷγφδʔΛڧԽ͍͖͍ͤͯͨ͞ - ۀͰ੬ऑੑΛղੳ͢Δ͜ͱͰɺ੬ऑੑΛݟ͚ͭΔྗ͕ͭ͘ - ݸਓͷ׆ಈͰ੬ऑੑΛݟ͚ͭΔྗΛʹ͚ͭͯɺࣗࣾͷηΩϡϦςΟ্࣭ʹߩݙ