Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
脆弱性発見者の目から見た、脆弱性対応の最前線
Search
MUNEAKI NISHIMURA
December 01, 2016
Technology
15
2.7k
脆弱性発見者の目から見た、脆弱性対応の最前線
Internet Week 2016の講演資料です。
MUNEAKI NISHIMURA
December 01, 2016
Tweet
Share
More Decks by MUNEAKI NISHIMURA
See All by MUNEAKI NISHIMURA
脆弱星に導かれて
nishimunea
3
2.4k
Brave Browserの脆弱性を見つけた話(iOS編)
nishimunea
3
2.6k
ブラウザの脆弱性とそのインパクト
nishimunea
26
9.8k
脆弱性発見者が注目する近年のWeb技術
nishimunea
29
13k
Slack Team for Security Testers and Bug Hunters
nishimunea
1
780
Finding Vulnerabilities in Firefox for iOS
nishimunea
3
8.6k
SWIFT Code for Mozilla Bank
nishimunea
1
930
次世代プラットフォームのセキュリティモデル考察
nishimunea
6
5.4k
Other Decks in Technology
See All in Technology
ビジネスとデザインとエンジニアリングを繋ぐために 一人のエンジニアは何ができるか / What can a single engineer do to connect business, design, and engineering?
kaminashi
2
360
Databricksで完全履修!オールインワンレイクハウスは実在した!
akuwano
0
110
Conquering PDFs: document understanding beyond plain text
inesmontani
PRO
0
280
Running JavaScript within Ruby
hmsk
3
370
ワールドカフェI /チューターを改良する / World Café I and Improving the Tutors
ks91
PRO
0
130
Automatically generating types by running tests
sinsoku
2
3.7k
バクラクの認証基盤の成長と現在地 / bakuraku-authn-platform
convto
4
690
より良い開発者体験を実現するために~開発初心者が感じた生成AIの可能性~
masakiokuda
0
210
アジャイル脅威モデリング#1(脅威モデリングナイト#8)
masakane55
3
230
PicoRabbit: a Tiny Presentation Device Powered by Ruby
harukasan
PRO
2
250
4/17/25 - CIJUG - Java Meets AI: Build LLM-Powered Apps with LangChain4j (part 2)
edeandrea
PRO
0
130
クラウド開発環境Cloud Workstationsの紹介
yunosukey
0
190
Featured
See All Featured
CoffeeScript is Beautiful & I Never Want to Write Plain JavaScript Again
sstephenson
160
15k
Adopting Sorbet at Scale
ufuk
76
9.3k
Stop Working from a Prison Cell
hatefulcrawdad
268
20k
10 Git Anti Patterns You Should be Aware of
lemiorhan
PRO
656
60k
How to Ace a Technical Interview
jacobian
276
23k
Mobile First: as difficult as doing things right
swwweet
223
9.6k
A Modern Web Designer's Workflow
chriscoyier
693
190k
Save Time (by Creating Custom Rails Generators)
garrettdimon
PRO
31
1.1k
The Power of CSS Pseudo Elements
geoffreycrofte
75
5.8k
VelocityConf: Rendering Performance Case Studies
addyosmani
328
24k
Why Our Code Smells
bkeepers
PRO
336
57k
Exploring the Power of Turbo Streams & Action Cable | RailsConf2023
kevinliebholz
32
5.4k
Transcript
੬ऑੑൃݟऀͷ͔Βݟͨɺ੬ऑੑରԠͷ࠷લઢ גࣜձࣾϦΫϧʔτςΫϊϩδʔζ αΠόʔηΩϡϦςΟΤϯδχΞϦϯά෦ ଜ फߊ
ଜ फߊ גࣜձࣾϦΫϧʔτςΫϊϩδʔζ αΠόʔηΩϡϦςΟΤϯδχΞϦϯά෦ γχΞηΩϡϦςΟΤϯδχΞ ࠃܞଳిϝʔΧʔͰͷηΩϡϦςΟίϯαϧλϯτ ͳͲΛܦ݄ͯΑΓݱ৬ɻϦΫϧʔτͷ*%ཧج ൫ͷηΩϡϦςΟอकϦΫϧʔτάϧʔϓશࣾͷ੬ऑ ੑमਖ਼ࢧԉʹܞΘΔɻझຯϒϥβͷ੬ऑੑΛ୳͢͜ ͱɻʹใࠂͨ͠੬ऑੑ݅Λ͑Δɻஶॻʹ
ϒϥβϋοΫʢ༁ʣɻओͳߨԋྺʹ$0%& #-6& ɺ"750,:0 ɺ1BD4FD ɻΑΓ ηΩϡϦςΟɾΩϟϯϓશࠃେձߨࢣ
੬ऑੑ͕େ͖ ؆୯ʹݴ͏ͱ
ຊͷ͓ • ੬ऑੑΛ୳࢝͠Ίͨཧ༝ͱଓ͚Δཧ༝ • ੬ऑੑΛݟ͚ͭΔͨΊʹ࣮ફ͍ͯ͠Δ͜ͱ • ൃݟऀͷ͔Βݟͨ੬ऑੑରԠͷݱ • ϦΫϧʔτʹ͓͚Δ੬ऑੑରԠ •
·ͱΊ
੬ऑੑΛ୳࢝͠Ίͨཧ༝ͱଓ͚Δཧ༝
͖͔͚ͬͷηΩϡϦςΟɾΩϟϯϓ • Ϋϥεͷ୩ཅհࢯ͔ΒϑϥϯΫʹߨࢣͷґཔ͕དྷͨ
ηΩϡϦςΟɾΩϟϯϓͱ • ࣍Λ୲͏ηΩϡϦςΟਓࡐͷൃ۷ͱҭΛ తͱͨ͠ຽ࿈ܞࣄۀ - *1"ͱࣾͷڠࢍاۀ͔ΒͳΔ࣮ࢪڠٞձ͕ओ࠵ - ܦࡁ࢈ۀল͕ڞ࠵ - ࠓͰ
• ധɺே͔Β൩·ͰηΩϡϦςΟ௮͚ͷ߹॓ - શࠃ໊ͷԠืऀ͔Βબൈ͞Ε໊͕ͨࢀՃ - ֤ྖҬͷҰઢͰ׆༂͢Δٕज़ऀਞ͕ߨࢣΛ୲
҆қʹҾ͖ड͚ͨͷͷɾɾɾ • ࣗҎ֎༗໊ͳߨࢣਞ - ॻళωοτͷηΩϡϦςΟ࿈ࡌهࣄͳͲͰΑ໊͘લΛݟΔਓͨͪ - (PPHMFͷ੬ऑੑใࠂ݅ͰੈքҐͷਓ • $5'ະ౿ͳͲଟํ໘Ͱ׆༂͢Δνϡʔλʔ •
શࠃ͔Βબͼൈ͔ΕͨԠืऀୡ • ຊʹ͕ࣗߨࢣͰྑ͔ͬͨͷ͔ʁ - ࣗͷ࣮ྗΛ٬؍తʹଌΔखஈ͕ཉ͔ͬͨ͠ - ڭ͑Δࢿ͕֨͋Δ͔Λ͔֬Ί͔ͨͬͨ
ͦ͜Ͱɺ'JSFGPYϒϥβͷ੬ऑੑใ੍ۚઓ • ੈքதͷϓϨʔϠʔΑΓઌʹ੬ऑੑΛݟ͚ͭग़͢ڝ૪ • ֫ಘͨ͠ใۚͷֹͰ࣮ྗΛՄࢹԽͰ͖Δ • ੬ऑੑΛݟ͚ͭΒΕͳ͚ΕɺߨࢣΛࣙୀ͠Α͏ͱߟ͍͑ͯͨ • ϲ݄ͷۤΛܦͯ੬ऑੑΛൃݟʂ
੬ऑੑ୳͠Λͯ͠ಘͨͷ • ͪΖΜใۚ - ͜Ε·Ͱʹ ສԁҎ্ - Ͱɺ࠷ॳʹखʹͨ͠ใۚͰࣗసंΛങͬͨΒɺۚમཉ͕ࣦͤͯ͠·ͬͨ • ηΩϡϦςΟΤϯδχΞͱͯ͠ͷجૅྗ
- ղͳ༷ίʔυ͔ΒΛഎ͚ͣʹಡΈղ͘ྗ - ࢥ͍ࠐΈΛࣺͯɺࣄΛࣗͷखͰݕূ͢Δྗ
੬ऑੑΛ୳͠ଓ͚Δཧ༝ • ॅϩʔϯΛฦͨ͢Ί - ඪࡀ·Ͱʹࡁ - Ք͍࣮ͩײͷͳ͍ใۚɺआΓ࣮ͨײͷͳ͍ϩʔϯͱ૬ੑ͕͍͍ • ٕज़ྗͷҡ্࣋ͷͨΊ -
༷ίʔυΛѱ༻ํ๏Λߟ͑Δश׳Λ͚͓ͭͯ͘ͱɺ ۀͰݕࠪϨϏϡʔ͢Δͱ͖ʹ߈ܸํ๏͕ર͖͘͢ͳΔ - ଞͷൃݟऀ։ൃऀͱग़ձ͍ɺ৽ͨͳ߈ܸͷํΛֶͿ
੬ऑੑΛݟ͚ͭΔͨΊʹ࣮ફ͍ͯ͠Δ͜ͱ
طͷ੬ऑੑʹֶͿ • աڈͷ੬ऑੑใΛௐΔ • ߈ܸίʔυΛ࡞࣮ͬͯࡍʹݕূ͢Δ - վमͷޡΓͳͲ͕ݪҼͰɺաڈͷ੬ऑੑ͕࠶ൃ͢Δ - ࠶ར༻Ͱ͖ΔΑ͏ʹɺ࡞ͨ͠߈ܸίʔυΛอଘ͓ͯ͘͠ •
ྨࣅͷ੬ऑੑΛ୳͢ - աڈʹ੬ऑੑ͕ࢦఠ͞ΕͨػೳɺͦΕͱΑ͘ࣅͨػೳ - લఏ݅Λগ͠ม͑ͯɺಉ͡߈ܸίʔυΛࢼ͢
طͷ੬ऑੑʹֶͿ $41ҧϨϙʔτ࣮ෆඋͷࣄྫ • .P[JMMBͷηΩϡϦςΟΞυόΠβϦ͔Βաڈͷ੬ऑੑใΛೖख https://www.mozilla.org/en-US/security/advisories/
طͷ੬ऑੑʹֶͿ $41ҧϨϙʔτ࣮ෆඋͷࣄྫ • ݄ɺ$POUFOU4FDVSJUZ1PMJDZʢ$41ʣͷҧϨϙʔτػೳΛ௨ͯ͡ ଞͷαΠτͷใΛ౪ΊΔ͜ͱΛ*/3*"ͷݚڀऀ͕ࢦఠʢ$7&ʣ https://www.mozilla.org/en-US/security/advisories/mfsa2012-53/
طͷ੬ऑੑʹֶͿ $41ҧϨϙʔτ࣮ෆඋͷࣄྫ • ݄ɺߴԽͷͨΊʹ$41ͷ࣮ΛϦϑΝΫλϦϯάͨ͠ࡍɺ ಉ͡੬ऑੑ͕࠶ൃʢ$7&ʣ https://www.mozilla.org/en-US/security/advisories/mfsa2014-86/
طͷ੬ऑੑʹֶͿ $41ҧϨϙʔτ࣮ෆඋͷࣄྫ • ݄ɺJGSBNFͷϖʔδͰ$41ʹҧ͢ΔॲཧΛߦ͏͜ͱʹΑΓ ྨࣅͷ੬ऑੑ͕࠶ݱʢ$7&ʣ https://www.mozilla.org/en-US/security/advisories/mfsa2016-18/
༷ʹֶͿ • *&5'8$ͷ༷ॻΛͻͨ͢ΒಡΉ - ෳͷ༷Λ͋ΘͤಡΉͱɺ༷ͷൈ͚࿙Ε͕ݟ͑ͯ͘Δ • ༷ॻͷ4FDVSJUZ$POTJEFSBUJPOT͔Β߈ܸͷ؍ΛಘΔ - ϒϥβͷதͰى͖͍͚ͯͳ͍͜ͱ͕͔Δ •
ػೳ͕༷Ͳ͓Γʹ࣮͞Ε͍ͯΔ͔ݕূ͢Δ - ༷ʹॻ͔Ε͍ͯΔࢪࡦ͕࣮͞Ε͍ͯͳ͍͜ͱ͕͋Δ
༷ʹֶͿ r )5.-*NQPSUTͷ࣮ෆඋͷࣄྫ • 3'$ Ͱ$POUFOU%JTQPTJUJPOͱ͍͏)551ϔομ͕ఆٛ͞Ε͍ͯΔ - $POUFOU%JTQPTJUJPOBUUBDINFOU͕)551Ϩεϙϯεʹࢦఆ͞Ε͍ͯΔ߹ɺ ϒϥβͦͷίϯςϯπΛ։͔ͣɺμϯϩʔυͤ͞ͳ͚ΕͳΒͳ͍ •
$POUFOU%JTQPTJUJPOͷແࢹ੬ऑੑͱͯ͠ѻΘΕΔ - 'JSFGPYɿ$7&ɺ$7& - 4BGBSJɿ$7&ɺ$7&
༷ʹֶͿ r )5.-*NQPSUTͷ࣮ෆඋͷࣄྫ • $ISPNFͷ)5.-*NQPSUT͕$POUFOU%JTQPTJUJPOΛແࢹ͢Δ͜ͱΛ ։ൃݩͷ(PPHMFʹใࠂʢ*TTVFʣ • ͜ΕΛड͚ɺ8$ͷ༷ʹ$POUFOU%JTQPTJUJPOͷهड़͕Ճ͞Εͨ https://www.w3.org/TR/2016/WD-html-imports-20160225/
աڈʹݟ͚༷ͭͨͷ࣮ෆඋʢൈਮʣ • $ISPNFͷ$41ҧϨϙʔτͷૹ৴ઌ͕CBTFͰ੍ޚͰ͖Δ IUUQTDSCVHDPN • $ISPNFͷ4FSWJDF8PSLFST͕JGSBNFTBOECPYͰಈ࡞͢Δ IUUQTDSCVHDPN • 'JSFGPYͷ3FGFSSFS1PMJDZ͕৽͍͠λϒͰ։͍ͨࡍʹޮ͔ͳ͍ IUUQTMJTUTXPSH"SDIJWFT1VCMJDQVCMJDXFCBQQTFD"QSIUNM
• 'JSFGPYͷ#SPBEDBTU$IBOOFM"1*͕ϓϥΠόγʔϞʔυ͔Β ௨ৗϞʔυͷΟϯυʹ௨͞ΕΔ IUUQTCVH[JMMBNP[JMMBPSHTIPX@CVHDHJ JE • 'JSFGPYͷ'FUDI"1*Ͱ)PTU$PPLJFϦΫΤετϔομ͕ࢦఆͰ͖Δ IUUQTCVH[JMMBNP[JMMBPSHTIPX@CVHDHJ JE
ൃݟऀͷ͔Βݟͨ੬ऑੑରԠͷݱ
ϒϥβϕϯμʔͷ੬ऑੑରԠ • ੬ऑੑͷରԠํϕϯμʔʹΑͬͯେ͖͘ҟͳΔ • ϦϞʔτίʔυ࣮ߦʢ3$&ʣͷ੬ऑੑॏࢹͯ͠मਖ਼͞ΕΔҰํɺ αϯυϘοΫεόΠύεʢಉҰੜݩϙϦγʔͷᷖճͳͲʣͷରԠ Թײ͕ϕϯμʔʹΑͬͯҟͳΔ - $ISPNFͱ'JSFGPYɿ੬ऑੑใ੍ۚͷରɻ௨ৗʙϲ݄Ҏʹमਖ਼ -
4BGBSJɿใ੍ۚͷର֎ɻҎ্मਖ਼͞Εͳ͍͜ͱ
'JSFGPYͷ੬ऑੑରԠ • ಁ໌ੑ͕ߴ͍ - मਖ਼͕ϦϦʔε͞ΕΔ·ͰͷաఔΛඇެ։ઃఆͷ#VH[JMMBͰͰ͖Δ - ਂࠁͷஅཧ༝Λઆ໌ͯ͘͠ΕΔ - ଞͷ୭͔ͱಉ͡੬ऑੑʢ%VQMJDBUFEʣΛใࠂ͢Δͱɺͦ͏அͨ͠ূڌͱͯ͠ɺ ඇެ։ઃఆʹͳ͍ͬͯΔಉ͡੬ऑੑͷ#VH[JMMBͷΞΫηεݖΛΒ͑Δ
• ରԠ͕ૣ͍ - ਂࠁͷߴ͍ͷʙ͔݄Ͱमਖ਼ - ਂࠁͳ੬ऑੑۓٸΞοϓσʔτͰमਖ਼
'JSFGPYͷ੬ऑੑରԠ ূ໌ॻݕূόΠύεͷ੬ऑੑࣄྫ • 'JSFGPYͰࡌ͞Εͨݟ҉߸Λ༻͍ͯɺ)5514ͷαʔόূ໌ॻݕূ ͱެ։伴ϐϯχϯάΛᷖճͰ͖Δ੬ऑੑʢ$7&ʣΛใࠂ • ޙɺ'JSFGPY͕ۓٸϦϦʔε https://www.us-cert.gov/ncas/current-activity/2015/04/06/Mozilla-Releases-Security-Update-Firefox
ຊͷ੬ऑੑ૭ޱ • *1"ͷ੬ऑੑؔ࿈ใͷಧग़ड੍ - ಧग़͔Β࠷ॳͷԠ·Ͱʹϲ݄ - ୲ऀʹࢦఠ༰Λཧղͯ͠͏·Ͱʹ Կ͔ΓऔΓ͕ଓ͘ - ݁Ռͱͯ͠ɺӈਤʮʯ·Ͱͷ͕ؒظԽ
https://www.ipa.go.jp/files/000052737.pdf
*1"ͷ੬ऑੑ૭ޱ r "QBDIF$PSEPWBͷ੬ऑੑࣄྫ • "QBDIF$PSEPWBͷҙϓϥάΠϯ࣮ߦͷ੬ऑੑʢ $7&ʣ - ѱҙͷ͋ΔαΠτΛ։͚ͩ͘ͰɺΞϓϦͷػೳΛѱ༻͞ΕΔ੬ऑੑɻ ใࠂͷࡍɺσϞͱͯ͠εϚϗͷిாΛվ͟Μ͢ΔίʔυΛૹ -
ϲ݄ޙɺ*1"͔Βిா͕վ͟Μ͞ΕΔ͜ͱͷͲ͕͜੬ऑੑͳͷ͔ʁͱ͍͏࣭ - ͜ͷ࣌Ͱɺ+1$&35$$ʹ࿈བྷ͕ߦΘΕ͍ͯͳ͍ https://jvn.jp/jp/JVN41772178/
ൃݟऀ͔Βͷ͓ئ͍ • ରԠͷঢ়گΛఆظతʹڞ༗ͯ͠ཉ͍͠ - ରԠྃ·ͰҰ࿈བྷͷདྷͳ͍૭ޱ͕ଟ͍ - Ҏ্Ի৴ෆ௨ͷࣄྫ͋Δ • ঢ়گ͕͔Βͳ͍ͱൃݟऀෆ҆ʹͳΔ -
ใࠂͷํ͕ޡ͍ͬͯͨͷͰͳ͍͔ʢӈਤʣ - ૣ͘͠ͳ͍ͱ੬ऑੑ͕ѱ༻͞ΕΔͷͰͳ͍͔ • मਖ਼લͷ੬ऑੑ͕ެද͞ΕΔڪΕ - ใࠂΛແࢹ͞Εͨͱײͨ͡ൃݟऀౖ͕ͬͯ࿐ - ެදʹΑΓमਖ਼Λଅͦ͏ͱ͢Δൃݟऀ ˞גࣜձࣾϨϐμϜ ྛࢯͷߨԋࢿྉΑΓҾ༻
ϦΫϧʔτʹ͓͚Δ੬ऑੑରԠ
ϦΫϧʔτʹ͓͚Δ੬ऑੑରԠͷجຊํ • ੬ऑੑରԠ֤ࣄۀͰ࣮ࢪ - ۓٸੑͷߴ͍੬ऑੑͷΈɺ$4*35͔Β֤ࣄۀରԠΛґཔ • ੬ऑੑใͷऩूͱਂࠁͷධՁΛ$4*35Ͱ࣮ࢪ - ࢲΛؚΊਓͷٕज़ऀ͕࣋ͪճΓͰ୲
Ұൠతͳ੬ऑੑใఏڙαʔϏεͷ՝ • ใ৴ͷλΠϜϥά - ։ൃݩʹΑΔใެ։͔ΒఔͷԆ • ใͷཏੑ - $7&ͷׂΓͯΒΕ͍ͯͳ͍੬ऑੑͳͲʹൈ͚ •
ࣗࣾڥͱҰக͠ͳ͍ਂࠁධՁ - $744੬ऑੑ͕࠷େݶʹѱ༻͞ΕͨલఏͰݟੵΒΕΔ͕͋Γɺ ࣗࣾʹ͓͚ΔਂࠁͱҰக͠ͳ͍͜ͱ͕͋Δ
ͦ͜ͰɺࣗࣾͰ੬ऑੑใͷऩूͱධՁ͕ඞཁ • ใల։ͷૣظԽ - ੬ऑੑͷҰ࣍ใΛపఈऩू - +1$&35$$ͷૣظܯռύʔτφʔγοϓΛ௨ͯ͡ɺެදલͷ੬ऑੑใΛೖख • ཏੑͷ্ -
ࠃ֎ͷηΩϡϦςΟใൃ৴ऀΛ5XJUUFSͰϑΥϩʔ - +1$&35$$ͷૣظܯռใΛ༻͍ͯɺใͷऩू࿙ΕΛݮ • ࣗࣾڥʹج͍ͮͨ੬ऑੑධՁ - ੬ऑੑΛ$4*35Ͱղੳ͠ɺ߈ܸͷқࣗࣾͰੜ͡͏ΔඃΛධՁ
ใల։ͷૣظԽ • ߈ܸ͕དྷΔલʹɺใͷऩूɺධՁɺରԠࢧԉΛऴΘΒͤΔඞཁ͕͋Δ - ͷ4IFMMTIPDLͷΑ͏ʹใ͕ެ։͞Εͨཌ͔Β߈ܸ͕؍ଌ͞Εͨࣄྫ ੬ऑੑใެ։ ߈ܸίʔυ࡞ ߈ܸ׆ಈ ใऩू ղੳͱධՁ
ରԠࢧԉ ੬ऑੑͷղੳ ߈ܸऀ $4*35
ใల։ͷૣظԽ • ͭͷใܦ࿏ΛΈ߹ΘͤͯɺใऩूͷૣظԽͱཏੑΛٻ - ೋ࣍ใͰใΛಘͨͷɺҰ࣍ใͰऩूͰ͖ΔΑ͏ʹϑΟʔυόοΫ ੬ऑੑใެ։ +1$&35$$ ૣظܯռύʔτφʔγοϓ Ұ࣍ใ ೋ࣍ใ
+1$&35$$ ૣظܯռใ • ެ։લͷ੬ऑੑใ • ֤छ344.- • ։ൃݩͷ8FCαΠτ • 5XJUUFS • ֤छχϡʔεαΠτ • ຖ༦ํʹདྷΔ ΞφϦετϊʔτ
ใల։ͷૣظԽ r (IPTUTDSJQUͷ੬ऑੑࣄྫ ࣌ ঢ়گ ݄ (IPTUTDSJQUͷ։ൃݩʹ੬ऑੑͷߘʢ࣮ূίʔυ͋Γʣ ݄ 0444FDVSJUZ.-Ͱ$7&࠾൪ ݄
ࠃͷ੬ऑੑใαʔϏεʹใܝࡌ ݄ .FUBTQMPJUͷ(JU)VCʹͯຊ੬ऑੑͷ߈ܸίʔυΛ֬ೝ ݄ +1$&35$$ΑΓૣظܯռύʔτφʔγοϓใ৴ ݄ +1$&35$$ΑΓૣظܯռใ৴ • (IPTUTDSJQUʹ͓͚ΔϦϞʔτίʔυ࣮ߦͷ੬ऑੑʢ$7&ʣ ͜ͷ࣌Ͱ֤ࣄۀʹ ۓٸରԠΛґཔ
ࣗࣾڥʹج͍ͮͨ੬ऑੑධՁ • ެ։͞Ε͍ͯΔ$744ΛӏವΈʹ͠ͳ͍ - Өڹ͠ͳ͍੬ऑੑͷରԠʹ֤ࣄۀͷΛׂ͘͜ͱʹͳΔ - ࣗࣾڥʹ͓͚ΔӨڹΛٕज़తʹஅ • ՄೳͳݶΓमਖ਼ύονͷιʔείʔυΛ֬ೝ -
߈ܸͷ༰қੑΛਪଌͰ͖Δ - Ճ͞Εͨςετέʔείϛοτϝοηʔδʹ߈ܸίʔυؚ͕·ΕΔ͜ͱ • ߈ܸπʔϧͷ։ൃϦϙδτϦΛࢹͯ͠߈ܸͷՄೳੑΛஅ - .FUBTQMPJUͷ(JU)VCʹ߈ܸίʔυ͕ଓʑͱू·Δ IUUQTHJUIVCDPNSBQJENFUBTQMPJUGSBNFXPSLQVMMT
ࣗࣾڥʹج͍ͮͨ੬ऑੑධՁ • ηΩϡϦςΟٕज़ऀ͕ू·Δ4MBDLίϛϡχςΟͷ׆༻ - ॴଐ৫ͷนΛ͑ͯ੬ऑੑͷղੳঢ়گΛڞ༗ - ηΧϯυΦϐχΦϯతʹ׆༻͠ɺղੳͷޡΓΛ͙
ϝτϦΫε ߈ܸϕΫλ ωοτϫʔΫ ߈ܸͷෳࡶ͞ ʹ؆୯ ೝূͷཁ൱ ೝূͳ͠ ػີੑͷӨڹ શ໘త
શੑͷӨڹ શ໘త Մ༻ੑͷӨڹ શ໘త ࣗࣾڥʹج͍ͮͨ੬ऑੑධՁ r $7& • 0QFO44-ʹ͓͚ΔϝϞϦૢ࡞ͷෆඋͷ੬ऑੑ • /*45ධՁͷ$744ϕʔε - ϝϞϦഁյܥͷ੬ऑੑͷඃ௨ৗαʔϏεɻ ϝϞϦͷյ͠ํ࣍ୈͰϦϞʔτίʔυ࣮ߦͱͳΔ - ߈ܸͷෳࡶ͞ʢʣαʔϏεΛલఏʹ ݟੵΒΕ͍ͯΔҰํɺӨڹʢશ໘తʣ ϦϞʔτίʔυ࣮ߦΛલఏͱ͍ͯ͠Δ • 0QFO44-ͷΞυόΠβϦʢҰ࣍ใʣͰ - 8FCαʔόϩʔυόϥϯα͕)5514௨৴࣌ʹ ༻͢ΔMJCTTMʹӨڹ͠ͳ͍ /*45ͷ$744WϕʔεείΞ Ұ࣍ใΑΓۓٸରԠෆཁͱஅ
ࣗࣾڥʹج͍ͮͨ੬ऑੑධՁ r $7& • Bind9におけるサービス妨害の脆弱性 ࣌ ঢ়گ ݄ ։ൃݩ͔Β੬ऑੑใެ։ɻ։ൃϦϙδτϦʹमਖ਼ύον͋Γɻ ղੳͷ݁Ռɺ%/4ϦΫΤετൃͰ%/4αʔόΛ
མͱͤΔ͜ͱ͕໌ɻۓٸରԠΛ࣮ࢪ ݄ .FUBTQMPJUͷ(JU)VCʹ߈ܸίʔυͷଘࡏΛ֬ೝ ݄ ओཁαʔϏεʹ͓͍ͯύονద༻ྃ ݄ ܯிΑΓɺຊ੬ऑੑΛѱ༻ͨ͠ແࠩผͳ߈ܸ׆ಈ͕ ࢹ͞Εͨͱͷҙשى
༧ఆ͍ͯ͠ΔऔΓΈ • ใऩूͷޮԽ - 5XJUUFSʹΑΔใऩूʢຖʙ࣌ؒʣͷஔ͖͑Λݕ౼த • ߈ܸ׆ಈͷใऩूΛڧԽ - ֤ࠃͷ߈ܸൃੜঢ়گΛऩू -
߈ܸͷൃੜঢ়گʹԠͯ͡ɺ͔ʹରԠͷԹײΛม͑Δ • ֤αʔϏεͷߏʹԠͨ͡ରԠґཔ - αʔόߏίϯϑΟάϨʔγϣϯͳͲΛৄࡉʹѲ͠ɺ ֎෦͔Β߈ܸΛड͚ΔՄೳੑʹԠͯ͡ରԠͷԹײΛ͚Δ
·ͱΊ
·ͱΊ • ۀͱݸਓͷ׆ಈͷγφδʔΛڧԽ͍͖͍ͤͯͨ͞ - ۀͰ੬ऑੑΛղੳ͢Δ͜ͱͰɺ੬ऑੑΛݟ͚ͭΔྗ͕ͭ͘ - ݸਓͷ׆ಈͰ੬ऑੑΛݟ͚ͭΔྗΛʹ͚ͭͯɺࣗࣾͷηΩϡϦςΟ্࣭ʹߩݙ