Cómo eliminar las diez principales vulnerabilidades en Internet

,QIRUPHRULJLQDOGHO
KWWSZZZVHOVHJFRP
3RVWHGZLWKSHUPLVVLRQRIWKH6DQV,QVWLWXWH
3XEOLFDGRFRQSHUPLVRGHO6DQV,QVWLWXWH
&yPRHOLPLQDUODVGLH]YXOQHUDELOLGDGHVGH
VHJXULGDGHQ,QWHUQHWPiVFUtWLFDV
(OFRQVHQVRGHORVH[SHUWRV
9HUVLyQGHVHSWLHPEUHGH
&RS\ULJKW7KH6$16,QVWLWXWH
$FWXDOL]DFLRQHV
Y
$FWXDOL]DFLRQGHODSpQGLFH%
Y
£'HWHQHUORVDFFHVRVQRDXWRUL]DGRV
/DPD\RUtDGHORVDWDTXHVFRQp[LWRD
RUGHQDGRUHVPHGLDQWH,QWHUQHWVHSXHGHQ
DJUXSDUFRPRODXWLOL]DFLyQGHXQUHGXFLGR
Q~PHURGHYXOQHUDELOLGDGHV/DPD\RUSDUWH
GHORVRUGHQDGRUHVFRPSURPHWLGRVGXUDQWHHO
LQFLGHQWHFRQRFLGRFRPRµ6RODU6XQULVH
3HQWDJRQµIXHURQDWDFDGRVPHGLDQWHXQD
YXOQHUDELOLGDGFRQFUHWD8QDYXOQHUDELOLGDG
VLPLODUDHVDIXHODTXHVHXWLOL]ySDUD
FRQWURODUODPD\RUSDUWHGHORVRUGHQDGRUHV
TXHSRVWHULRUPHQWHVHXWLOL]DURQPDVLYDPHQWH
HQORVDWDTXHVGLVWULEXLGRVGHQHJDFLyQGH
VHUYLFLR'HODPLVPDIRUPDORVUHFLHQWHV
DFFHVRVLOHJDOHVDVHUYLGRUHVZHEEDVDGRVHQ
:LQGRZV17HVWiQDVRFLDGRVDODXWLOL]DFLyQGH
XQDYXOQHUDELOLGDGVREUDGDPHQWHFRQRFLGD
2WUDYXOQHUDELOLGDGWRGDYtDVXILFLHQWHPHQWH
HVWXGLDGDSDUDVHUODFDXVDGHSHUPLWLUHO
FRQWUROLOHJDOGHPiVGHVLVWHPDV/LQX[
$FWXDOL]DFLyQGHOD85/GH
VRSRUWHGH5HG+DW/LQX[
Y
1XHYRDSpQGLFH,QIRUPDFLyQ
GHDFWXDOL]DFLRQHVGH
GLVWULEXLGRUHVGH8QL[
Y
1XHYDVHFFLyQFRQODVSHUVRQDV
TXHKDQFRODERUDGRHQ
PHMRUDUHVWHGRFXPHQWR
Y
$FWXDOL]DFLyQGHODUHODFLyQGH
FyGLJRV&9(GHODVHFFLyQ
Y
$FWXDOL]DFLyQGHODVILUPDV
'RZQORDGV
'RFXPHQWRHQIRUPDWR3')$GREH
$FUREDW
&RQVyORDOJXQDVYXOQHUDELOLGDGHVHQGHILQLWLYDVHUHDOL]DQODPD\RUSDUWHGHORVDWDTXHV
FRQp[LWRGHELGRHQJUDQSDUWHDTXHORVDWDFDQWHVVRQRSRUWXQLVWDV²XWLOL]DQODYtDPiV
IiFLO\FRQYHQLHQWH8WLOL]DQODVEUHFKDVPHMRUFRQRFLGDVPHGLDQWHHOXVRGHGLYHUVDV
KHUUDPLHQWDVGHDWDTXHVPX\HIHFWLYDV\DPSOLDPHQWHGLIXQGLGDV6HDSURYHFKDQGH
DTXHOODVRUJDQL]DFLRQHVTXHQRDSOLFDQORVSDUFKHVSDUDUHVROYHUORVSUREOHPDV
UHDOL]DQGRKDELWXDOPHQWHDWDTXHVGHIRUPDLQGLVFULPLQDGDUDVWUHDQGRHQ,QWHUQHWSRUOD
H[LVWHQFLDGHVLVWHPDVYXOQHUDEOHV
/DPD\RUSDUWHGHORVDGPLQLVWUDGRUHVGHVLVWHPDVDILUPDQTXHQRKDQVROXFLRQDGRHVWDV
EUHFKDVGHVHJXULGDGSRUODVLPSOHUD]yQTXHGHVFRQRFHQFXDOHVGHORVSUREOHPDV
SRWHQFLDOHVVRQORVPiVSHOLJURVRV\FDUHFHQGHOWLHPSRQHFHVDULRSDUDSRGHUFRUUHJLUORV
WRGRV
/DFRPXQLGDGGHSURIHVLRQDOHVGHODVHJXULGDGLQIRUPiWLFDGHVHDUHVROYHUHVWHSUREOHPD
LGHQWLILFDQGRODViUHDVGHVHJXULGDGHQ,QWHUQHWPiVFUtWLFDV²HOJUXSRGH
YXOQHUDELOLGDGHVTXHORVDGPLQLVWUDGRUHVGHVLVWHPDVGHEHQHOLPLQDUGHIRUPDLQPHGLDWD
(VWDOLVWDFRQVHQVXDGDDODTXHGHQRPLQDUHPRV7RS7HQHVXQHMHPSORVLQSUHFHGHQWHV
GHFRRSHUDFLyQDFWLYDHQWUHODLQGXVWULDORVRUJDQLVPRVS~EOLFRV\ODVLQVWLWXFLRQHV
HGXFDWLYDV/RVSDUWLFLSDQWHVSURYLHQHQGHODVDJHQFLDVIHGHUDOHVFRQPD\RUFRQFLHQFLD
HQWHPDVGHVHJXULGDGGHORVSULQFLSDOHVGLVWULEXLGRUHVGHSURGXFWRVGHVHJXULGDGGH
FRQVXOWRUDVHVSHFLDOL]DGDVGHGLYHUVDVXQLYHUVLGDGHVFRQSURJUDPDVHVSHFLDOL]DGRVHQ
VHJXULGDG\GHO&(57&&\HO6$16,QVWLWXWH$OILQDOGHODUWLFXORLQFOXLPRVODUHODFLyQ
FRPSOHWDGHSDUWLFLSDQWHV
(VWDHVODOLVWDGHORVSUREOHPDVGHVHJXULGDGHQ,QWHUQHWPiVIUHFXHQWHPHQWH
XWLOL]DGRVFRQODUHODFLyQGHDFFLRQHVTXHGHEHQWRPDUVHSDUDSURWHJHUORVVLVWHPDVGH
ODVPLVPDV
7UHVQRWDVSDUDHOOHFWRU
1RWD(VWHHVXQGRFXPHQWRHQFRQVWDQWHHYROXFLyQ,QFOX\HODVLQVWUXFFLRQHV
LQLFLDOHVSDVRDSDVR\GLUHFFLRQHVSDUDVROXFLRQDUORVGHIHFWRV,UHPRV
DFWXDOL]DQGRODVLQVWUXFFLRQHVDPHGLGDTXHYD\DPRVLGHQWLILFDQGRFXDOHVVRQORV
SDVRVPiVFRQYHQLHQWHVVHDJUDGHFHUiQORVFRPHQWDULRVGHOOHFWRUDOUHVSHFWR
(VWHGRFXPHQWRHVXQFRQVHQVRGHODFRPXQLGDG²VXH[SHULHQFLDHQODHOLPLQDFLyQ
GHODVYXOQHUDELOLGDGHVSXHGHD\XGDUDORVTXHYHQJDQGHWUiV3DUDHQYLDUVXV
VXJHUHQFLDVHQYtHXQPHQVDMHDEDUFHORQD#VHOVHJFRP!XWLOL]DQGR´
&RPHQWDULRVDO7RS7HQµFRPRWHPDGHOPLVPR3DUDREWHQHUODYHUVLyQPiV
DFWXDOL]DGDGHHVWDVLQVWUXFFLRQHVHQYtHXQPHQVDMHDEDUFHORQD#VHOVHJFRP!
FRQHOWHPD´'RFXPHQWR7RS7HQµ
1RWD(QFRQWUDUiUHIHUHQFLDDUHJLVWURV&9(²ORVQ~PHURVGHUHIHUHQFLDGHODV
9XOQHUDELOLGDGHV\([SRVLFLRQHVPiV+DELWXDOHVTXHVHFRUUHVSRQGHQFRQXQD
YXOQHUDELOLGDG/RVQ~PHURV&$1FRUUHVSRQGHQDSURSXHVWDVGH&9(TXHQRKDQ
VLGRWRWDOPHQWHYHULILFDGDV3DUDLQIRUPDFLyQDGLFLRQDOVREUHHOSUR\HFWR&9(
YLVLWHKWWSFYHPLWUHRUJ
1RWD$OILQDOGHODOLVWDHQFRQWUDUiXQDVHFFLyQH[WUDFRQXQDUHODFLyQGHORV
SXHUWRVXWLOL]DGRVSRUORVVHUYLFLRVKDELWXDOPHQWHVRQGHDGRV\
DWDFDGRV%ORTXHDQGRHOWUiILFRDGLFKRVSXHUWRVHQVXFRUWDIXHJRVXRWUR
GLVSRVLWLYRGHSURWHFFLyQSHULPHWUDOREWHQGUiXQQLYHOH[WUDGHGHIHQVDTXHOH
D\XGDDSURWHJHUVHGHORVHUURUHVGHFRQILJXUDFLyQ
&RQWHQLGR
'HELOLGDGHVGH%,1'nxtqinvHin.namedSHUPLWHQFRPSURPHWHUOD
FXHQWDGHURRWLQPHGLDWDPHQWH
3URJUDPDV&*,\H[WHQVLRQHVGHDSOLFDFLyQSRUHMHPSOR&ROG)XVLRQ
LQVWDODGRVHQVHUYLGRUHVZHE
'HELOLGDGHVHQOODPDGDVGHSURFHGLPLHQWRUHPRWR53&HQUSFWWGEVHUYHUG
7RRO7DONUSFFPVG&DOHQGDU0DQDJHU\USFVWDWGTXHSHUPLWHQOD
REWHQFLyQLQPHGLDWDGHSULYLOHJLRGHURRW
$JXMHURGHVHJXULGDG5'6HQ0LFURVRIW,QWHUQHW,QIRUPDWLRQ6HUYHU,,6
'HELOLGDGSRUGHVERUGDPLHQWRGHEXIIHUHQVHQGPDLODWDTXHVPHGLDQWH
iUHDVGHLQWHUFRQH[LyQGHPHPRULD\0,0(ERWRGDVHOODVSHUPLWHQ
FRPSURPHWHUODFXHQWDGHURRWLQPHGLDWDPHQWH
VDGPLQG\PRXQWG
&RPSDUWLFLyQGHDUFKLYRVJOREDO\FRPSDUWLFLyQGHLQIRUPDFLyQLQDSURSLDGD
PHGLDQWH1HW%,26\ORVSXHUWRV!HQ:LQGRZV17HQ:LQGRZV
H[SRUWVGH1)6HQ8QL[SXHUWRFRPSDUWLFLyQYtDZHEHQ
0DFLQWRVK\$SSOHVKDUH,3HQSXHUWRV\
&XHQWDVGHXVXDULRHVSHFLDOPHQWHODGHURRWRDGPLQLVWUDGRUVLQ
FRQWUDVHxDRFRQFRQWUDVHxDSRFRVHJXUD
9XOQHUDELOLGDGHVGHGHVERUGDPLHQWRGHEXIIHURFRQILJXUDFLyQLQFRUUHFWDHQ
,0$3\323
1RPEUHVGHFRPXQLGDG6103SRURPLVLyQ¶SXEOLF·\¶SULYDWH·
,QIRUPDFLyQDGLFLRQDO
•
•
•
•
8QSXQWRSULRULWDULRSDUDORVXVXDULRV\RDGPLQLVWUDGRUHVGH:LQGRZV
YDULRVDJXMHURVGHVFULSWHQ,QWHUQHW([SORUHU\2IILFH
3URWHFFLyQSHULPHWUDOSDUDXQDOtQHDDGLFLRQDOGHGHIHQVD
,QIRUPDFLyQGHVRSRUWHGHORVGLYHUVRVIDEULFDQWHVGH8QL[
)LUPDQWHV
Debilidades
de BIND: nxt, qinv e in.named permiten
comprometer la cuenta de root inmediatamente
(OSDTXHWH%HUNHOH\,QWHUQHW1DPH'RPDLQ%,1'HVODLPSOHPHQWDFLyQPiV
XWLOL]DGDGHVHUYLFLRGHQRPEUHVGHGRPLQLR'16HOLPSRUWDQWHVLVWHPDTXHQRV
SHUPLWHORFDOL]DUORVVLVWHPDVHQ,QWHUQHWSRUVXQRPEUHSRUHMHPSOR
ZZZVDQVRUJVLQQHFHVLGDGGHXWLOL]DUGLUHFFLRQHV,3ORTXHORFRQYLHUWHHQXQR
GHORVEODQFRVIDYRULWRVSDUDXQDWDTXH(VWULVWHYHUTXHGHDFXHUGRFRQXQD
HQFXHVWDUHDOL]DGDDPHGLDGRVGHFHUFDGHOGHWRGRVORVVHUYLGRUHVGH
'16FRQHFWDGRVD,QWHUQHWXWLOL]DEDQXQDYHUVLyQGH%,1'YXOQHUDEOH(QXQDWDTXH
WtSLFRD%,1'ORVLQWUXVRVERUUDQORVDUFKLYRVORJGHOVLVWHPDHLQVWDODQKHUUDPLHQWDV
TXHOHVSHUPLWHQREWHQHUSULYLOHJLRVGHDGPLQLVWUDGRU$FRQWLQXDFLyQFRPSLODQH
LQVWDODQGLYHUVDVXWLOLGDGHVGH,5&\HVFDQHRGHUHGHVTXHODVXWLOL]DUiQSDUD
HQFRQWUDUGHQWURGHOUDQJRGHYDULDVFODVHV%GHGLUHFFLRQHV,3RWURVVLVWHPDVTXH
WDPELpQXWLOLFHQYHUVLRQHVYXOQHUDEOHVGH%,1'(QFXHVWLyQGHPLQXWRVKDEUiQ
XWLOL]DGRHOVLVWHPDFRPSURPHWLGRSDUDDWDFDUFLHQWRVGHVLVWHPDVUHPRWRV
REWHQLHQGRHOFRQWUROGHORVPLVPRV(VWRLOXVWUDHOFDRVTXHSXHGHUHVXOWDUGHXQD
VLPSOHYXOQHUDELOLGDGHQXQVRIWZDUHSDUDODJHVWLyQGHVHUYLFLRVXQLYHUVDOHVHQ
,QWHUQHWFRPRSXHGHVHUHO'16
6LVWHPDVDIHFWDGRV
'LYHUVRVVLVWHPDV81,;\/LQX[
$IHFKDGHPD\RGHWRGDVODVYHUVLRQHVGH%,1'DQWHULRUHVDODY
DFWXDOL]DFLyQVRQYXOQHUDEOHV
5HJLVWUR&9(
Q[W&9(
TLQY&9(
2WURVUHJLVWURV&9(UHODFLRQDGRV&9(&9(&9(
&9(
&RQVHMRVSDUDODUHVROXFLyQGHOSUREOHPD
•
•
'HVDFWLYDUHOGDHPRQ%,1'QDPHGHQWRGRVDTXHOORVVLVWHPDVTXHQRDFW~DQ
FRPRVHUYLGRUHVGH'16$OJXQRVH[SHUWRVLQFOXVRUHFRPLHQGDQOD
GHVLQVWDODFLyQGHOVRIWZDUHGH'16
(QPiTXLQDVTXHDFW~DQFRPRVHUYLGRUHVGH'16DFWXDOL]DUDOD~OWLPD
YHUVLyQDGHPD\RGHODYHUVLyQPiVUHFLHQWHHVODY
DFWXDOL]DFLyQ
3XHGHVHJXLUORVFRQVHMRVLQGLFDGRVHQORVVLJXLHQWHVDYLVRV
3DUDODYXOQHUDELOLGDG1;7KWWSZZZFHUWRUJDGYLVRULHV&$
ELQGKWPO
3DUDODVYXOQHUDELOLGDGHV4,19SUHJXQWDLQYHUVD\1$0('
KWWSZZZFHUWRUJDGYLVRULHV&$ELQGBSUREOHPVKWPO
KWWSZZZFHUWRUJVXPPDULHV&6KWPO
•
•
(MHFXWH%,1'FRPRXQXVXDULRVLQSULYLOHJLRVFRPRPHGLGDGHSURWHFFLyQDQWH
IXWXURVDWDTXHV1RREVWDQWHVyORORVSURFHVRVTXHVHHMHFXWDQFRPRURRW
SXHGHQVHUFRQILJXUDGRVSDUDXWLOL]DUORVSXHUWRVLQIHULRUHVDO²XQ
UHTXLVLWRGHO'163RUWDQWRGHEHUiFRQILJXUDU%,1'SDUDTXHFDPELHGH
XVXDULRXQDYH]VHKD\DDVRFLDGRDOSXHUWR
(MHFXWH%,1'HQXQDHVWUXFWXUDGHGLUHFWRULRVFKURRWFRPRPHGLGDGH
SURWHFFLyQDQWHIXWXURVDWDTXHV
Programas CGI y extensiones de aplicación (por ejemplo,
ColdFusion) instalados en servidores web.
&DVLWRGRVORVVHUYLGRUHVZHEGDQVRSRUWHDSURJUDPDV&*,&RPPRQ*DWHZD\
,QWHUIDFHSDUDRIUHFHUSiJLQDVLQWHUDFWLYDVWDOHVFRPRODREWHQFLyQ\YHULILFDFLyQ
GHGDWRV0XFKRVVHUYLGRUHVLQFOX\HQGLYHUVRVSURJUDPDV&*,GHHMHPSORTXHVH
LQVWDODQSRURPLVLyQ'HVDIRUWXQDGDPHQWHDOJXQRVSURJUDPDGRUHVGH&*,VQRKDQ
FRQVLGHUDGRODSRVLELOLGDGTXHVXVSURJUDPDVSXHGHQVHUXWLOL]DGRVGHIRUPD
LQFRUUHFWDRVHUHQJDxDGRVSDUDHMHFXWDUPDQGDWRVFRQILQHVPDOLFLRVRV/RV&*,V
YXOQHUDEOHVVRQXQEODQFRSDUWLFXODUPHQWHDWUDFWLYRSDUDORVLQWUXVRV\DTXHVRQ
UHODWLYDPHQWHIiFLOHVGHORFDOL]DU\IXQFLRQDQFRQORVPLVPRVSULYLOHJLRV\SRGHUTXH
HOVRIWZDUHGHOVHUYLGRUZHE
6HVDEHTXHORVLQWUXVRVVHKDQDSURYHFKDGRGH&*,VYXOQHUDEOHVSDUDPRGLILFDU
SiJLQDVZHEUREDULQIRUPDFLyQGHWDUMHWDVGHFUpGLWRHLQVWDODUSXHUWDVWUDVHUDV
SDUDSRVWHULRUHVLQWUXVLRQHVLQFOXVRHQHOPRPHQWRHQTXHORV&*,V\DKDQVLGR
SURWHJLGRV&XDQGRODIRWRGH-DQHW5HQRIXHVXVWLWXLGDSRUODGH$GROSK+LWOHUXQ
LQIRUPHLQWHUQRFRQFOX\yTXHODFDXVDPiVSUREDEOHSDUDHODWDTXHIXHODXWLOL]DFLyQ
GHXQDJXMHURGHVHJXULGDGHQXQSURJUDPD&*,
&ROG)XVLRQGH$OODLUHHVXQSDTXHWHGHDSOLFDFLRQHVSDUDVHUYLGRUHVZHETXHLQVWDOD
DOJXQRVSURJUDPDVGHHMHPSORFRQYXOQHUDELOLGDGHV&RPRQRUPDJHQHUDOORV
SURJUDPDVGHHMHPSORGHEHQVHUVLHPSUHHOLPLQDGRVGHORVVLVWHPDVGHSURGXFFLyQ
6LVWHPDVDIHFWDGRV
7RGRVORVVHUYLGRUHVZHE
5HJLVWURV&9(
•
•
•
•
3URJUDPDV&*,GHHMHPSORWRGRVORV&*,V
5HPHGLR
(OLPLQDUORVSURJUDPDV&*,GHHMHPSORHQORVVHUYLGRUHVGHSURGXFFLyQ
&$1
,QWHUQHW,QIRUPDWLRQ6HUYHU0LFURVRIW6LWH6HUYHUTXHVHLQFOX\HHQ
HO0LFURVRIW6LWH6HUYHU&RPPHUFH(GLWLRQ0LFURVRIW&RPPHUFLDO
,QWHUQHW6HUYHU\0LFURVRIW%DFN2IILFH6HUYHU\
FRQVXOWDUKWWSZZZPLFURVRIWFRPWHFKQHWVHFXULW\EXOOHWLQPV
DVS
5HPHGLR
$SOLFDUHOSDUFKHGLVSRQLEOHHQIWSIWSPLFURVRIWFRPEXVV\VLLVLLV
SXEOLFIL[HVXVD9LHZFRGHIL[
&9(
3URJUDPDGHDJHQGDHVFULWRHQSKILQFOXLGRHQYHUVLRQHVDQWLJXDVGHORV
VHUYLGRUHV1&6$\$SDFKH
&9(
6FULSWGHHMHPSOR¶P\ORJKWPO·LQFOXLGRHQ3+3),
•
•
•
&9(
,5,;\
&9(
3URJUDPDVGHHMHPSORLQFOXLGRVHQHOSDTXHWH3+3),
&9(
,5,;
9XOQHUDELOLGDGHVGH&*,VPiVLPSRUWDQWHVVLQLQFOXLUORVSURJUDPDVGHHMHPSOR
•
•
•
•
•
•
•
•
•
•
•
&$1
&*,GH/LEURGHYLVLWDVGH:HE&RP
&$1DSOLFDEOHDWRGRVORVVHUYLGRUHV
&RQVXOWDUKWWSZZZFHUWRUJDGYLVRLUHV&$
LQWHUSUHWHUVBLQBFJLBELQBGLUKWPO
5HPHGLR
/DVROXFLyQDHVWHSUREOHPDHVDVHJXUDUVHTXHQRVHHQFXHQWUHQLQJXQDFRSLD
GHORVSURJUDPDVLQWpUSUHWHVGHOHQJXDMHVSURSyVLWRJHQHUDOFRPRSRU
HMHPSOR3(5/7&/VKHOOVGH8QL[VKFVKNVKHWF
&9(
ZZZFRXQWYHUVLyQ
&9(
6XEVLVWHPD2XWER[GH,5,;
&9(
3DTXHWH3+3),
&9(
*OLPSVH+773\:HE*OLPSVH
&9(
6XEVLVWHPD2XWER[GH,5,;
&9(
6XEVLVWHPD2XWER[GH,5,;
&9(DSOLFDEOHDWRGRVORVVHUYLGRUHV
&RQVXOWDUKWWS[IRUFHLVVQHWVWDWLFSKS\
KWWSZZZQHWVFDSHRUJFJLELQZD"$ LQG%/ EXJWUDT3 5
5HPHGLR
(OLPLQDUHOVFULSW¶YLHZVRXUFH·GHOGLUHFWRULRFJLELQGHOVHUYLGRUZHE
&9(
:HEVLWHGH2·5HLOO\
&9(
:HEVLWHGH2·5HLOO\
•
•
•
•
•
•
•
•
&9(
/LEURGHYLVLWDVGH:HEFRPSDUDVHUYLGRUHVZHEHQHQWRUQR:LQ
&9(
)D[6XUYH\SDUDVLVWHPDV/LQX[
&9(
([FLWHIRU:HE6HUYHUV
&9(
$JHQWHGHJHVWLyQ\XWLOLGDGGHDQiOLVLVGH&RPSDT
&9(
&*,2PQL+773G
&9(
&*,GHO0LFURVRIW64/6HUYHU
&9(
6LVWHPDGHE~VTXHGD$OWDYLVWD
&9(
KWVHDUFKSDUDKWGLJ
9XOQHUDELOLGDGHVHQORVSURJUDPDVGHHMHPSORGH&ROG)XVLRQ
•
•
•
&$1
&$1
&$1
2WUDVYXOQHUDELOLGDGHVGH&ROG)XVLRQ
•
•
&$1
&9(
&RQVHMRVSDUDODUHVROXFLyQGHOSUREOHPD
•
•
•
•
1RHMHFXWDUHOVHUYLGRUZHEFRPRURRW
(OLPLQDUORVLQWpUSUHWHVGHVFULSWVSDUD&*,VGHORVGLUHFWRULRVELQ
KWWSZZZFHUWRUJDGYLVRULHV&$LQWHUSUHWHUVBLQBFJLBELQBGLUKWPO
(OLPLQDUORVVFULSWV&*,QRVHJXURV
KWWSZZZFHUWRUJDGYLVRULHV&$QSKWHVWFJLBVFULSWKWPO
KWWSZZZFHUWRUJDGYLVRULHV&$FJLBH[DPSOHBFRGHKWPO
KWWSZZZFHUWRUJDGYLVRULHV&$ZHEGLVWKWPO
(VFULELUSURJUDPDV&*,VHJXURV
KWWSZZZLEPFRPVRIWZDUHGHYHORSHUOLEUDU\VHFXUHFJL
KWWSZZZFHUWRUJWHFKBWLSVFJLBPHWDFKDUDFWHUVKWPO
KWWSZZZFHUWRUJDGYLVRULHV&$&RXQWBFJLKWPO
•
•
1RFRQILJXUDUHOVRSRUWHGH&*,VHQDTXHOORVVHUYLGRUHVZHETXHQROR
QHFHVLWHQ
(MHFXWDUHOVHUYLGRUZHEHQXQHQWRUQRGHGLUHFWRULRVFKURRWSDUDSURWHJHUOD
PiTXLQDGHSRVLEOHVDWDTXHVWRGDYtDQRGHVFXELHUWRV
Debilidades en llamadas de procedimiento remoto (RPC) en
rpc.ttdbserverd (ToolTalk), rpc.cmsd (Calendar Manager) y
rpc.statd que permiten la obtención inmediata de privilegio de
root
/DVOODPDGDVGHSURFHGLPLHQWRUHPRWR53&SHUPLWHQDORVSURJUDPDVGHXQ
RUGHQDGRUODHMHFXFLyQGHSURJUDPDVHQXQVHJXQGRRUGHQDGRU6HXWLOL]DQ
KDELWXDOPHQWHSDUDDFFHGHUDVHUYLFLRVGHUHGWDOHVFRPRODFRPSDUWLFLyQGH
DUFKLYRVHQ1)6'LYHUVDVYXOQHUDELOLGDGHVRULJLQDGDVSRUEUHFKDVGH53&VRQ
H[SORWDGDVGHIRUPDDFWLYD([LVWHXQDHYLGHQFLDFRQYLQFHQWHTXHODPD\RUSDUWHGH
ORVDWDTXHVGLVWULEXLGRVGHGHQHJDFLyQGHVHUYLFLRHIHFWXDGRVGXUDQWH\
SULQFLSLRVGHOIXHURQHMHFXWDGRVSRUVLVWHPDVDORVTXHVHKDEtDFRPSURPHWLGR
GHELGRDVXVYXOQHUDELOLGDGHVHQSURJUDPDV53&(ODWDTXHH[LWRVRJHQHUDOFRQWUD
ORVVLVWHPDVGHOHMpUFLWRGHORV((88RFXUULGRHQHOLQFLGHQWH
6RODU6XQULVH
XWLOL]y
LJXDOPHQWHXQHUURUHQXQSURJUDPD53&SUHVHQWHHQFLHQWRVGHVLVWHPDVGHO
GHSDUWDPHQWRGHGHIHQVDDPHULFDQR
6LVWHPDVDIHFWDGRV
'LYHUVRVVLVWHPDV81,;\/LQX[
5HJLVWUR&9(
USFWWGEVHUYHUG&9(&9(&9(
HVPiVUHFLHQWHTXHHOSHURDPERVSHUPLWHQDORVDWDFDQWHVUHPRWRV
REWHQHUSULYLOHJLRVGHURRW\HVEDVWDQWHSUREDEOHTXHHOWRGDYtDHVEDVWDQWH
IUHFXHQWHVyORSXHGHXWLOL]DUVHDQLYHOORFDOSHURSHUPLWHREWHQHUSULYLOHJLR
GHURRW
USFFPVG²&9(
USFVWDWG&9(&9(
&RQVHMRVSDUDODUHVROXFLyQGHOSUREOHPD
•
•
6LHPSUHTXHVHDSRVLEOHGHVDFWLYDU\RHOLPLQDUHVWRVVHUYLFLRVHQODV
PiTXLQDVTXHVRQGLUHFWDPHQWHDFFHVLEOHVGHVGH,QWHUQHW
&XDQGRVHDQHFHVDULRXWLOL]DUORVLQVWDODUORVSDUFKHVPiVUHFLHQWHV
3DUFKHVSDUDVLVWHPDV6RODULV
KWWSVXQVROYHVXQFRP
3DUD$,;GH,%0
KWWSWHFKVXSSRUWVHUYLFHVLEPFRPVXSSRUWUVVXSSRUWGRZQORDGV
KWWSWHFKVXSSRUWVHUYLFHVLEPFRPUVNIL[HVKWPO
3DUDVLVWHPDV6*,
KWWSVXSSRUWVJLFRP
3DUD&RPSDT'LJLWDO8QL[
KWWSZZZFRPSDTFRPVXSSRUW
%XVFDUHQODVEDVHVGHGDWRVGHSDUFKHVGHFDGDIDEULFDQWHORVSDUFKHVSDUD
WRROWDONHLQVWDODUORVGHIRUPDLQPHGLDWD
8QGRFXPHQWRTXHUHVXPHORVFRQVHMRVHVSHFtILFRVSDUDFDGDXQDGHODVWUHV
YXOQHUDELOLGDGHVSULQFLSDOHVGH53&VHHQFXHQWUDHQ
KWWSZZZFHUWRUJLQFLGHQWBQRWHV,1KWPO
3DUDVWDWGG
KWWSZZZFHUWRUJDGYLVRULHV&$VWDWGDXWRPRXQWGKWPO
3DUD7RRO7DON
KWWSZZZFHUWRUJDGYLVRULHV&$WRROWDONKWPO
3DUD&DOHQGDU0DQDJHU
KWWSZZZFHUWRUJDGYLVRULHV&$FPVGKWPO
Agujero de seguridad RDS en Microsoft
Internet Information Server (IIS)
0LFURVRIW,QWHUQHW,QIRUPDWLRQ6HUYHU,,6HVHOVHUYLGRUZHEXWLOL]DGRSRUOD
PD\RUtDGHVHUYLGRUHVZHELQVWDODGRVHQODSODWDIRUPD:LQGRZV17\:LQGRZV
$OJXQRVHUURUHVHQODSURJUDPDFLyQGHORVVHUYLFLRVGHGDWRVUHPRWRV5HPRWH
'DWD6HUYLFHV5'6VRQXWLOL]DGRVSRUXVXDULRVFRQPDODVLQWHQFLRQHVSDUDHMHFXWDU
PDQGDWRVUHPRWRVFRQSULYLOHJLRGHDGPLQLVWUDGRU$OJXQRVGHORVSDUWLFLSDQWHVHQ
ODUHGDFFLyQGHODOLVWD´7RS7HQµFRQVLGHUDQTXHRWUDVEUHFKDVGHO,,6WDOHVFRPR
ORVDUFKLYRV+75VRQSRUORPHQRVWDQXWLOL]DGDVFRPRHVWDEUHFKDGHO5'6/D
SUXGHQFLDUHFRPLHQGDDODVRUJDQL]DFLRQHVXVXDULDVGHO,,6DSURYHFKDUOD
LQVWDODFLyQDFWXDOL]DFLyQQHFHVDULDSDUDVROXFLRQDUHOSUREOHPDFRQ5'6SDUDOD
LQVWDODFLyQGHWRGRVORVSDUFKHV\DFWXDOL]DFLRQHVQHFHVDULRVSDUDVROXFLRQDUWRGDV
ODVEUHFKDVGHVHJXULGDGFRQRFLGDVGHO,,6
6LVWHPDVDIHFWDGRV
6LVWHPDVFRQ0LFURVRIW:LQGRZV17TXHXWLOLFHQHO,QWHUQHW,QIRUPDWLRQ6HUYHU
5HJLVWUR&9(
&9(
&RQVHMRVSDUDODUHVROXFLyQGHOSUREOHPD
•
•
8QDFRPSOHWDJXLDVREUHHVWDGHELOLGDG\VREUHFRPRVROXFLRQDUODVH
HQFXHQWUDGLVSRQLEOHHQ
8WLOL]DUODLQIRUPDFLyQSXEOLFDGDSRU0LFURVRIWSDUDGHVKDELOLWDUHOVHUYLFLRR
VROXFLRQDUODYXOQHUDELOLGDG5'6\RWURVSUREOHPDVGHVHJXULGDGGHO,,6
KWWSVXSSRUWPLFURVRIWFRPVXSSRUWNEDUWLFOHVTDVS
KWWSZZZPLFURVRIWFRPWHFKQHWVHFXULW\EXOOHWLQPVDVS
KWWSZZZPLFURVRIWFRPWHFKQHWVHFXULW\EXOOHWLQPVDVS
Debilidad por el desbordamiento de buffer en sendmail
ataques mediante áreas de interconexión de memoria y
MIMEbo; todas ellas permiten comprometer la cuenta root
inmediatamente.
6HQGPDLOHVHOSURJUDPDPiVXWLOL]DGRHQVLVWHPDV81,;\/LQX[SDUDHQYLDUUHFLELU
\UHGLUHFFLRQDUHOFRUUHRHOHFWUyQLFR/DDPSOLDXWLOL]DFLyQGH6HQGPDLOHQ,QWHUQHW
ORFRQYLHUWHHQXQRGHORVSULQFLSDOHVREMHWLYRVGHORVDWDFDQWHV$ORODUJRGHORV
DxRVVHKDQGHWHFWDGRGLYHUVRVGHIHFWRV/DSULPHUDUHFRPHQGDFLyQHPLWLGDSRU
HO&(57&&HQKDFtDUHIHUHQFLDDXQDGHELOLGDGH[SORWDEOHGHVHQGPDLO(Q
XQRGHORVDWDTXHVPiVKDELWXDOHVHODWDFDQWHHQYtDXQPHQVDMH
FRQYHQLHQWHPHQWHIRUPDWHDGRDOVLVWHPDTXHHMHFXWD6HQGPDLOpVWHORLQWHUSUHWD
FRPRXQFRQMXQWRGHLQVWUXFFLRQHVPHGLDQWHODVFXDOHVODPiTXLQDYtFWLPDGHO
DWDTXHHQYtDHODUFKLYRGHFRQWUDVHxDVDODPiTXLQDGHODWDFDQWHRFXDOTXLHURWUD
YtFWLPDGRQGHVHSRGUiQGHVFLIUDUODVFRQWUDVHxDV
6LVWHPDVDIHFWDGRV
'LYHUVRVVLVWHPDV81,;\/LQX[
5HJLVWUR&9(
&9(&9(&9(&9(&9(
&9(
&9(VyORSXHGHXWLOL]DUVHORFDOPHQWH
&RQVHMRVSDUDODUHVROXFLyQGHOSUREOHPD
•
•
$FWXDOL]DUDOD~OWLPDYHUVLyQGHVHQGPDLO\RLPSOHPHQWDUORVSDUFKHVSDUD
VHQGPDLO&RQVXOWDU
KWWSZZZFHUWRUJDGYLVRULHV&$VHQGPDLOKWPO
1RHMHFXWDUVHQGPDLOHQPRGDOLGDGGDHPRQGHVDFWLYDUODRSFLyQEGHQ
ORVVLVWHPDVTXHQRVRQVHUYLGRUHVRHQFDPLQDGRUHVGHFRUUHR
sadmind y mountd
6DGPLQGSHUPLWHODDGPLQLVWUDFLyQUHPRWDGHORVVLVWHPDV6RODULVSURSRUFLRQDQGR
XQDFFHVRJUiILFRDODVWDUHDVGHDGPLQLVWUDFLyQGHOVLVWHPD0RXQWGFRQWUROD\
DUEULWUDHODFFHVRDORVYRO~PHQHV1)6HQORVVLVWHPDV81,;([LVWHQ
GHVERUGDPLHQWRVGHEXIIHUVHQHVWDVDSOLFDFLRQHVTXHSXHGHQVHUXWLOL]DGRVSRU
DWDFDQWHVSDUDREWHQHUHODFFHVRDODFXHQWDURRW
6LVWHPDVDIHFWDGRV
'LYHUVRVVLVWHPDV81,;\/LQX[
6DGPLQGVyORVLVWHPDV6RODULV
5HJLVWUR&9(
VDGPLQG&9(
PRXQWG&9(
&RQVHMRVSDUDODUHVROXFLyQGHOSUREOHPD
•
•
•
6LHPSUHTXHVHDSRVLEOHGHVDFWLYDU\RHOLPLQDUHVWRVVHUYLFLRVHQODV
PiTXLQDVTXHVRQGLUHFWDPHQWHDFFHVLEOHVGHVGH,QWHUQHW
,QVWDODUORV~OWLPRVSDUFKHV
3DUFKHVSDUDVLVWHPDV6RODULV
KWWSVXQVROYHVXQFRP
3DUD$,;GH,%0
KWWSWHFKVXSSRUWVHUYLFHVLEPFRPVXSSRUWUVVXSSRUWGRZQORDGV
KWWSWHFKVXSSRUWVHUYLFHVLEPFRPUVNIL[HVKWPO
3DUDVLVWHPDV6*,
KWWSVXSSRUWVJLFRP
3DUD&RPSDT'LJLWDO8QL[
KWWSZZZFRPSDTFRPVXSSRUW
0iVLQIRUPDFLyQHQ
KWWSZZZFHUWRUJDGYLVRULHV&$VDGPLQGKWPO
KWWSZZZFHUWRUJDGYLVRULHV&$PRXQWGKWPO
Compartición de archivos global y compartición de información
inapropiada mediante NetBIOS y los puertos 135 -> 139 en
Windows NT (445 en Windows 2000); exports de NFS en Unix
(puerto 2049), compartición vía web en Macintosh y Appleshare/IP
en los puertos 80, 427 y 548.
7RGRVHVWRVVHUYLFLRVSHUPLWHQODFRPSDUWLFLyQGHDUFKLYRVHQUHGHV&XDQGRVRQ
FRQILJXUDGRVGHIRUPDLQDSURSLDGDSXHGHQH[SRQHUDUFKLYRVGHVLVWHPDFUtWLFRVR
LQFOXVRSHUPLWLUXQDFFHVRFRPSOHWRDOVLVWHPDGHDUFKLYRVDFXDOTXLHUDTXHHVWp
FRQHFWDGRHQODUHG0XFKRVSURSLHWDULRVGHRUGHQDGRUHV\DGPLQLVWUDGRUHVXWLOL]DQ
HVWRVVHUYLFLRVSDUDSHUPLWLUTXHVXVVLVWHPDVGHDUFKLYRVVHDQYLVLEOHVHQ
PRGDOLGDGGHOHFWXUD\RHVFULWXUDHQXQLQWHQWRGHKDFHUPiVFRQYHQLHQWHHO
DFFHVRDORVGDWRV/RVDGPLQLVWUDGRUHVGHXQVLVWHPDGHOJRELHUQRGHORV((88
GHGLFDGRDOGHVDUUROORGHVRIWZDUHSDUDODSODQLILFDFLyQGHPLVLRQHVORFRQILJXUDURQ
GHWDOIRUPDTXHFXDOTXLHUDSXGLHUDOHHUORVDUFKLYRVGHIRUPDTXHORVFRPSDxHURV
GHRWURVHGLILFLRVWXYLHUDQXQIiFLODFFHVRDODLQIRUPDFLyQ6yORGRVGtDVGHVSXpV
RWUDVSHUVRQDVKDEtDQGHVFXELHUWRHVWDFRPSDUWLFLyQDELHUWD\UREDURQHOVRIWZDUH
GHSODQLILFDFLyQGHPLVLRQHV
&XDQGRODFRPSDUWLFLyQGHDUFKLYRVVHHQFXHQWUDDFWLYDGDHQODVPiTXLQDV
:LQGRZVpVWDVVRQYXOQHUDEOHVDOURERGHLQIRUPDFLyQ\DORVHIHFWRVGH
GHWHUPLQDGRVWLSRVGHYLUXVGHUiSLGDGLIXVLyQ8QYLUXVUHFLHQWHPHQWHSXEOLFDGR
GHQRPLQDGRµ:RUPµXWLOL]DODFRPSDUWLFLyQGHDUFKLYRVGHORVVLVWHPDV
:LQGRZV\SDUDSURSDJDUVH\KDFHTXHHORUGHQDGRULQIHFWDGRXWLOLFHVX
PyGHPSDUDOODPDUDOQ~PHURGHHPHUJHQFLDVHQ((88/RVRUGHQDGRUHV
0DFLQWRVKVRQWDPELpQYXOQHUDEOHVDORVDWDTXHVGHODFRPSDUWLFLyQGHDUFKLYRV
(OPLVPRPHFDQLVPR1HW%,26TXHSHUPLWHODFRPSDUWLFLyQGHDUFKLYRVHQ:LQGRZV
SXHGHVHUXWLOL]DGRSDUDREWHQHULQIRUPDFLyQVHQVLEOHGHORVVLVWHPDV170HGLDQWH
ODXWLOL]DFLyQGHXQDµVHVLyQQXODµDOVHUYLFLRGHVHVLyQ1HW%,26VHSXHGHREWHQHU
LQIRUPDFLyQVREUHORVXVXDULRV\JUXSRVQRPEUHGHXVXDULRIHFKDGHOD~OWLPD
FRQH[LyQSROtWLFDGHFRQWUDVHxDVLQIRUPDFLyQGHDFFHVRUHPRWRLQIRUPDFLyQ
VREUHHOVLVWHPD\GHWHUPLQDGDVHQWUDGDVGHOUHJLVWUR(VWDLQIRUPDFLyQHV
KDELWXDOPHQWHXWLOL]DGDSDUDRUJDQL]DUXQDWDTXHGHIXHU]DEUXWDSDUDGHWHUPLQDU
FRQWUDVHxDVRELHQXQDVLPSOHSUXHEDGHGLYHUVDVFRQWUDVHxDV
6LVWHPDVDIHFWDGRV
6LVWHPDV81,;:LQGRZV\0DFLQWRVK
5HJLVWUR&9(
&RPSDUWLFLRQHV60%FRQXQHVFDVRFRQWUROGHDFFHVR&$1
([SRUWVGH1)6SDUDWRGRV&$1
(VWRVUHJLVWURVFDQGLGDWRVVHUiQFRQWRGDSUREDELOLGDGDPSOLDPHQWHPRGLILFDGRV
DQWHVGHVHUDFHSWDGRVFRPRUHJLVWURV&9(
&RQVHMRVSDUDODUHVROXFLyQGHOSUREOHPD
•
&XDQGRVHFRPSDUWHQGLVFRVPRQWDGRVYHULILFDUTXH~QLFDPHQWHORV
GLUHFWRULRVQHFHVDULRVVRQFRPSDUWLGRV
•
•
•
•
•
3DUDPD\RUVHJXULGDGSHUPLWLUVyORODFRPSDUWLFLyQDGLUHFFLRQHV,3
HVSHFtILFDVGDGRTXHORVQRPEUHVGH'16SXHGHQVHUVXSODQWDGRV
(QORVVLVWHPDV:LQGRZVYHULILFDUTXHWRGDVODVFRPSDUWLFLRQHVHVWiQ
SURWHJLGDVPHGLDQWHFRQWUDVHxDVIXHUWHV
(QORVVLVWHPDV:LQGRZV17SUHYHQLUODHQXPHUDFLyQDQyQLPDGHXVXDULRV
JUXSRVFRQILJXUDFLyQGHOVLVWHPD\YDORUHVGHOUHJLVWURPHGLDQWHXQD
FRQH[LyQDQyQLPD
%ORTXHDUODVFRQH[LRQHVHQWUDQWHVDOVHUYLFLRGHVHVLyQ1HW%,26SXHUWRWFS
HQHOGLUHFFLRQDGRURHQODPiTXLQD17
&RQVLGHUDUODLPSODQWDFLyQGHODFODYHGHOUHJLVWURRestrictAnonymous
HQDTXHOORVVLVWHPDVLQGHSHQGLHQWHVRHQGRPLQLRVQRFRQILDEOHV\TXH
HVWpQFRQHFWDGRVD,QWHUQHW
17KWWSVXSSRUWPLFURVRIWFRPVXSSRUWNEDUWLFOHV4DVS
:LQGRZV
KWWSVXSSRUWPLFURVRIWFRPVXSSRUWNEDUWLFOHV4$63
(QORVVLVWHPDV0DFLQWRVKGHVKDELOLWDUODVH[WHQVLRQHVGHFRPSDUWLFLyQGH
DUFKLYRV\FRPSDUWLFLyQZHEVLQRVRQUHDOPHQWHQHFHVDULRV6LOD
FRPSDUWLFLyQGHDUFKLYRVGHEHHVWDUDFWLYDUYHULILFDUODXWLOL]DFLyQGH
FRQWUDVHxDVIXHUWHVSDUDHODFFHVR\GHWHQHUODFRPSDUWLFLyQGHDUFKLYRV
FXDQGRQRVHXWLOLFH
3DUDGHVDFWLYDUGHIRUPDSHUPDQHQWHODFRPSDUWLFLyQZHEHQ0DF26\
0DF26ERUUDUORVDUFKLYRV\UHLQLFLDU
Carpeta del sistema:Paneles de control:Compartir web
Carpeta del sistema:Extensiones:Extensión compartir web
3DUDGHVKDELOLWDUSHUPDQHQWHPHQWH$SSOH6KDUH,3HQ0DF26ERUUDUHO
VLJXLHQWHDUFKLYR\UHLQLFLDUODPiTXLQD
Carpeta del sistema:Extensiones:Shareway IP Personal
Subord.
([LVWHXQWHVWUiSLGRVHJXUR\JUDWXLWRSDUDGHWHUPLQDUVLODFRPSDUWLFLyQ
GHDUFKLYRV1HW%,26\ODVYXOQHUDELOLGDGHVDVRFLDGDVHVWiQSUHVHQWHV(VWH
WHVWSXHGHUHDOL]DUVHGHVGH&8$/48,(5VLVWHPDRSHUDWLYR\VHHQFXHQWUD
HQODSiJLQDZHEGH*LEVRQ5HVHDUFK&RUSRUDWLRQ6yORHVQHFHVDULR
DFFHGHUDODSiJLQDKWWSJUFFRP\KDFHUFOLFHQHOLFRQR´6KLHOGV83µ
SDUDUHFLELUXQLQIRUPHHQWLHPSRUHDOGHFXDOTXLHUYXOQHUDELOLGDG
1HW%,26DFFHVLEOHGHVGH,QWHUQHW6HLQFOX\HQLQVWUXFFLRQHVGHWDOODGDVSDUD
D\XGDUDORVXVXDULRVGH0LFURVRIW:LQGRZVHQODHOLPLQDFLyQGHHVWDV
YXOQHUDELOLGDGHV
Cuentas de usuario, especialmente la de root o del administrador
sin contraseñas o con contraseñas débiles.
([LVWHQVLVWHPDVTXHYLHQHQSUHFRQILJXUDGRVFRQFXHQWDVGHXVXDULRGH
GHPRVWUDFLyQRLQYLWDGRTXHFDUHFHQGHFRQWUDVHxDRXWLOL]DQXQDFRQWUDVHxDSRU
RPLVLyQDPSOLDPHQWHFRQRFLGD/RVRSHUDULRVGHVHUYLFLRDFRVWXPEUDQDGHMDUODV
FXHQWDVFUHDGDVSDUDHOPDQWHQLPLHQWRVLQFRQWUDVHxDV\GHWHUPLQDGRVVLVWHPDVGH
JHVWLyQGHEDVHGHGDWRVLQVWDODQFXHQWDVGHDGPLQLVWUDFLyQXWLOL]DQGRFRQWUDVHxDV
SRURPLVLyQ3RURWUDSDUWHORVDGPLQLVWUDGRUHVGHVLVWHPDVVXHOHQXWLOL]DU
FRQWUDVHxDVTXHVRQIiFLOPHQWHLGHQWLILFDEOHV
DPRU
GLQHUR
PDJLD
VRQPX\
KDELWXDOHVRVLPSOHPHQWHXQDFRQWUDVHxDHQEODQFR/DXWLOL]DFLyQGHODV
FRQWUDVHxDVSRURPLVLyQSHUPLWHDORVDWDFDQWHVHODFFHVRDORVVLVWHPDVVLQQLQJ~Q
HVIXHU]R0XFKRVDWDFDQWHVSUXHEDQHQSULPHUOXJDUDQWHVGHODQ]DUXQDWDTXH
PiVVRILVWLFDGRHOXVRGHODVFRQWUDVHxDVSRURPLVLyQ\VLHVQHFHVDULRD
FRQWLQXDFLyQFRQODVFRQWUDVHxDVPiVKDELWXDOHV/DVFXHQWDVFRPSURPHWLGDV
VXSRQHQTXHHODWDFDQWHVHHQFXHQWUDGHQWURGHOFRUWDIXHJRV\GHODPiTXLQD
REMHWLYR8QDYH]GHQWURODPD\RUtDGHORVDWDFDQWHVXWLOL]DQDOJXQRVGHORV
DPSOLDPHQWHGLYXOJDGRVPpWRGRVSDUDREWHQHUHOSULYLOHJLRGHURRWR
DGPLQLVWUDGRU
6LVWHPDVDIHFWDGRV
7RGRVORVVLVWHPDV
5HJLVWUR&9(
&RQWUDVHxDVGH8QL[IiFLOPHQWHLGHQWLILFDEOHVGpELOHV&$1
&RQWUDVHxDVSRURPLVLyQRHQEODQFRGH8QL[&$1
&RQWUDVHxDVGH17IiFLOPHQWHLGHQWLILFDEOHVGpELOHV&$1
&RQWUDVHxDVSRURPLVLyQRHQEODQFRGH17&$1
(VWRVUHJLVWURVFDQGLGDWRVVHUiQFRQWRGDSUREDELOLGDGDPSOLDPHQWHPRGLILFDGRV
DQWHVGHVHUDFHSWDGRVFRPRUHJLVWURV&9(
&RQVHMRVSDUDODUHVROXFLyQGHOSUREOHPD
•
•
•
&UHDUXQDSROtWLFDGHFRQWUDVHxDVDFHSWDEOHGRQGHVHLQGLTXHODDVLJQDFLyQ
GHUHVSRQVDELOLGDGHV\ODIUHFXHQFLDFRQTXHGHEHYHULILFDUVHODFDOLGDGGH
ODVFRQWUDVHxDV$VHJXUDUVHTXHORVDOWRVHMHFXWLYRVGHODHPSUHVDQRHVWpQ
H[HQWRV,JXDOPHQWHLQFOXLUHQODSROtWLFDHOUHTXLVLWRGHPRGLILFDUWRGDVODV
FRQWUDVHxDVSRURPLVLyQFRPRSDVRSUHYLRDODFRQH[LyQGHXQRUGHQDGRUD
,QWHUQHWHVSHFLILFDQGRODVSHQDOL]DFLRQHVSRULQFXPSOLPLHQWRGHODQRUPD
£08<,03257$17(2EWHQHUDXWRUL]DFLyQSRUHVFULWRSDUDYHULILFDUODV
FRQWUDVHxDV
9HULILFDUODIRUWDOH]DGHODVFRQWUDVHxDVPHGLDQWHSURJUDPDVGHFUDTXHRGH
FRQWUDVHxDV
3DUD:LQGRZV17OSKWFUDFNKWWSZZZOSKWFRP
•
•
•
3DUD81,;&UDFNKWWSZZZXVHUVGLUFRQFRXNaFU\SWR
,PSOHPHQWDUXWLOLGDGHVTXHYHULILTXHQODVFRQWUDVHxDVHQHOPRPHQWRHQ
TXHVHFUHDQ
3DUD81,;1SDVVZGKWWSZZZXWH[DVHGXFFXQL[VRIWZDUHQSDVVZG
3DUD:LQGRZV17
KWWSVXSSRUWPLFURVRIWFRPVXSSRUWNEDUWLFOHV4DVS
)RU]DUODH[SLUDFLyQSHULyGLFDGHODVFRQWUDVHxDVGHDFXHUGRFRQOD
IUHFXHQFLDLQGLFDGDHQODSROtWLFDGHVHJXULGDG
0DQWHQHUKLVWyULFRVGHFRQWUDVHxDVSDUDHYLWDUTXHORVXVXDULRVYXHOYDQD
XWLOL]DUODVFRQWUDVHxDVDQWLJXDV
3DUDLQIRUPDFLyQDGLFLRQDOFRQVXOWDU
KWWSZZZFHUWRUJWHFKBWLSVSDVVZGBILOHBSURWHFWLRQKWPO
KWWSZZZFHUWRUJLQFLGHQWBQRWHV,1KWPO
KWWSZZZFHUWRUJLQFLGHQWBQRWHV,1LUL[KWPO
Vulnerabilidades de desbordamiento de buffer o configuración
incorrecta de IMAP y POP.
,0$3\323VRQXQRVSURWRFRORVGHFRUUHRUHPRWRPX\SRSXODUHV\DTXHSHUPLWHQHO
DFFHVRDODVFXHQWDVGHFRUUHRHOHFWUyQLFRGHVGHODVUHGHVLQWHUQDV\RH[WHUQDV
/DVFDUDFWHUtVWLFDVGHµDFFHVRDELHUWRµGHHVWRVVHUYLFLRVORVKDFHHVSHFLDOPHQWH
YXOQHUDEOHVDDWDTXHVGDGRTXHORVFRUWDIXHJRVKDELWXDOPHQWHSHUPLWHQHODFFHVRD
ORVPLVPRVSDUDSHUPLWLUHODFFHVRUHPRWRDOFRUUHRHOHFWUyQLFR/RVDWDFDQWHV
TXHH[SORWDQODVYXOQHUDELOLGDGHVHQ,0$3R323KDELWXDOPHQWHREWLHQHDFFHVR
LQVWDQWiQHRFRPRURRW
6LVWHPDVDIHFWDGRV
'LYHUVRVVLVWHPDV81,;\/LQX[
5HJLVWUR&9(
&9(&9(&9(&9(&9(
&RQVHMRVSDUDODUHVROXFLyQGHOSUREOHPD
•
•
•
'HVKDELOLWDUHVWRVVHUYLFLRVHQDTXHOODVPiTXLQDVTXHQRVRQVHUYLGRUHVGH
FRUUHR
8WLOL]DUODVYHUVLRQHVPiVPRGHUQDVFRQORVSDUFKHVPiVUHFLHQWHV
3DUDLQIRUPDFLyQDGLFLRQDOFRQVXOWDU
KWWSZZZFHUWRUJDGYLVRULHV&$LPDSGKWPO
KWWSZZZFHUWRUJDGYLVRULHV&$TSRSSHUBYXOKWPO
KWWSZZZFHUWRUJDGYLVRULHV&$LPDSBSRSKWPO
$OJXQRVH[SHUWRVDFRQVHMDQLJXDOPHQWHFRQWURODUHODFFHVRDHVWRVVHUYLFLRV
XWLOL]DQGR7&3ZUDSSHUV\FDQDOHVHQFULSWDGRVWDOHVFRPR66+\66/FRQHO
REMHWLYRGHSURWHJHUODVFRQWUDVHxDV
Nombres de comunidad SNMP por omisión como
‘public’ y ‘private’.
(OSURWRFRORVLPSOHGHJHVWLyQGHUHG6103HVKDELWXDOPHQWHXWLOL]DGRSRUORV
DGPLQLVWUDGRUHVGHUHGSDUDODPRQLWRUL]DFLyQ\DGPLQLVWUDFLyQGHWRGRWLSRGH
GLVSRVLWLYRVFRQHFWDGRVDODUHGGHVGHHQFDPLQDGRUHVKDVWDLPSUHVRUDVSDVDQGRSRU
RUGHQDGRUHV6103XWLOL]DFRPR~QLFRPHFDQLVPRGHDXWHQWLFDFLyQXQµQRPEUHGH
FRPXQLGDGµTXHVHHQYtDVLQHQFULSWDU6LODIDOWDGHHQFULSWDFLyQ\DGHSRUVLHV
PDODSHRUD~QHVTXHODPD\RUSDUWHGHORVGLVSRVLWLYRV6103XWLOL]DQFRPR
FRPXQLGDGSRURPLVLyQODSDODEUDµSXEOLFµDOJXQRVIDEULFDQWHV
LQWHOLJHQWHV
GH
GLVSRVLWLYRVGHUHGKDQFDPELDGRHOQRPEUH\XWLOL]DQODSDODEUDµSULYDWHµ
/RVDWDFDQWHVSXHGHQXWLOL]DUHVWDYXOQHUDELOLGDGGHO6103SDUDUHFRQILJXUDUR
GHWHQHUGHIRUPDUHPRWDORVGLVSRVLWLYRV/DFDSWXUDGHOWUiILFR6103SRURWUD
SDUWHSXHGHUHYHODUXQDJUDQFDQWLGDGGHLQIRUPDFLyQVREUHODHVWUXFWXUDGHODUHG
DVtFRPRGHORVGLVSRVLWLYRV\VLVWHPDVFRQHFWDGRVDODPLVPD(VWDLQIRUPDFLyQHV
PX\~WLOSDUDORVDWDFDQWHVHQYLVWDVDODVHOHFFLyQGHEODQFRVSDUDVXVDWDTXHV
6LVWHPDVDIHFWDGRV
7RGRVORVVLVWHPDV\GLVSRVLWLYRVGHUHG
5HJLVWUR&9(
1RPEUHGHFRPXQLGDGSXEOLF6103HQEODQFRRSRURPLVLyQ&$1
1RPEUHGHFRPXQLGDG6103IiFLOPHQWHLGHQWLILFDEOH&$1
1RPEUHVGHFRPXQLGDG6103RFXOWRV&$1&$1
(VWRVUHJLVWURVFDQGLGDWRVVHUiQFRQWRGDSUREDELOLGDGDPSOLDPHQWHPRGLILFDGRV
DQWHVGHVHUDFHSWDGRVFRPRUHJLVWURV&9(
&RQVHMRVSDUDODUHVROXFLyQGHOSUREOHPD
•
•
•
•
6LQRVHXWLOL]D6103GHVKDELOLWDUOR
6LVHXWLOL]D6103XWLOL]DUODPLVPDSROtWLFDXWLOL]DGDSDUDODVFRQWUDVHxDV
GHVFULWDHQHOSXQWRSDUDORVQRPEUHVGHFRPXQLGDG
9DOLGDU\YHULILFDUORVQRPEUHVGHFRPXQLGDGPHGLDQWHVQPSZDON
6LHPSUHTXHVHDSRVLEOHFRQILJXUDUORV0,%VHQPRGDOLGDGGHVyOROHFWXUD
,QIRUPDFLyQDGLFLRQDO
KWWSZZZFLVFRFRPXQLYHUFGFFWGGRFFLVLQWZNLWRBGRFVQPSKWP[WRFLG
Un punto de alta prioridad para usuarios y administradores
de Windows: Varios agujeros de script en Internet Explorer y
Microsoft Office 2000
/RVUHFLHQWHVDWDTXHVGHYLUXVKDQSXHVWRGHUHOLHYHFRPRXQDVPDFURVRVFULSWV
SXHGHQSURSDJDUVHIiFLOPHQWHDWUDYpVGHDUFKLYRVDVRFLDGRVDOFRUUHRHOHFWUyQLFR
OOHJDQGRDWHQHUTXHDFRQVHMDUDORVXVXDULRVTXHQRDEUDQQLQJ~QDUFKLYRDVRFLDGR
DXQPHQVDMHTXHVHDSRWHQFLDOPHQWHSHOLJURVR1RREVWDQWHORVXVXDULRVGH
:LQGRZVSXHGHQD\XGDUDODSURSDJDFLyQGHSHOLJURVRVYLUXVVLQWHQHUTXHDEULU
QLQJ~QDUFKLYR0LFURVRIW2XWORRN\2XWORRN([SUHVVHMHFXWDQHQVXV
FRQILJXUDFLRQHVSRURPLVLyQHOFyGLJR+70/\ORVVFULSWVLQFOXLGRVHQORV
PHQVDMHV$GLFLRQDOPHQWHDOJXQRVFRPSRQHQWHV$FWLYH;SXHGHQVHUXWLOL]DGDV
GHVGHHOFyGLJRLQFOXLGRHQDOJXQRVPHQVDMHVFRQ+70/$OJXQRVGHORVFRQWUROHV
YXOQHUDEOHVVRQHO6FULSOHWW\SOLELQFOXLGRHQ,([<[\HOFRQWURO8$2IILFH
2WUDVSRVLEOHVYXOQHUDELOLGDGHVSRUODXWLOL]DFLyQGH$FWLYH6FULSWLQJVRQOD
SRVLELOLGDGGHTXHXQPHQVDMHLQVWDOHXQSURJUDPDHQHORUGHQDGRUGHOXVXDULR
$FWXDOPHQWHH[LVWHXQYLUXVUHODWLYDPHQWHEHQLJQRGHQRPLQDGR.$.TXHVH
SURSDJDXWLOL]DQGRHVWRVPHFDQLVPRV(QFXDOTXLHUPRPHQWRHVSRVLEOHTXH
DSDUH]FDXQDYHUVLyQPDOLJQDGHNDN$FRQVHMDPRVTXHWRGRVORVXVXDULRV\
DGPLQLVWUDGRUHVFRQILJXUHQ2XWORRN\2XWORRN([SUHVVSDUDXWLOL]DUHOFRUUHR
HOHFWUyQLFRFRPRµ=RQDGHVLWLRVUHVWULQJLGRVµ\DGLFLRQDOPHQWHGHVKDELOLWDU
WRGDVODVRSFLRQHVUHODFLRQDGDVFRQ$FWLYH6FULSWLQJ\$FWLYH;GHQWURGHHVD
]RQD(VWRVHKDFHDWUDYpVGHODSDUWDGR+HUUDPLHQWDV_2SFLRQHV_6HJXULGDG
SHURSXHGHDXWRPDWL]DUVHDWUDYpVGHODVSROtWLFDVGHOVLVWHPD0LFURVRIWKD
SXEOLFDGRSDUFKHVSDUDORVSUREOHPDVLQGLYLGXDOHV\HVWiXOWLPDQGRXQSDUFKHTXH
ILMDUiORVYDORUHVGHVHJXULGDGHQ2XWORRNDXQTXHDSDUHQWHPHQWHQRKD\SODQHV
GHDUUHJODU2XWORRN([SUHVV
6LVWHPDVDIHFWDGRV
7RGRVORVVLVWHPDV:LQGRZVFRQ,QWHUQHW([SORUHU[\[LQFOXVRVLQRVHXWLOL]D
R2IILFH:LQGRZVQRVHYHDIHFWDGRSRUDOJXQDVGHODVYXOQHUDELOLGDGHV
GH,QWHUQHW([SORUHU
5HJLVWUR&9(
&9(
&$1
&RQVHMRVSDUDODUHVROXFLyQGHOSUREOHPD
KWWSZZZPLFURVRIWFRPVHFXULW\EXOOHWLQVPVDVS
KWWSZZZPLFURVRIWFRPVHFXULW\EXOOHWLQV06DVS
KWWSZZZPLFURVRIWFRPWHFKQHWVHFXULW\EXOOHWLQ06DVS
/RVSDUFKHVSDUDODVYXOQHUDELOLGDGHVSDUWLFXODUHVGHVFULWDVVHHQFXHQWUDQHQ
KWWSZZZPLFURVRIWFRPPVGRZQORDGLHEXLOGVFULSWOHWHQVFULSWOHWKWP
KWWSZZZPLFURVRIWFRPPVGRZQORDGLHEXLOGDVFRQWUROHQDVFRQWUROKWP
KWWSRIILFHXSGDWHPLFURVRIWFRPLQIRRF[KWP
'HEHUiPRGLILFDUVHOD]RQDGHVHJXULGDGDµVLWLRVUHVWULQJLGRVµGHVKDELOLWDQGR
WRGRHOFRQWHQLGRDFWLYRHQGLFKD]RQD\DSOLFDUHOSDUFKHSDUD2XWORRNWDQSURQWR
FRPRHVWpGLVSRQLEOHHQ
KWWSZZZRIILFHXSGDWHFRPDUWLFOHVRXWNVHFDUWLFOHKWP
/DDFWXDOL]DFLyQGHOVLVWHPDGHGHWHFFLyQGHYLUXVVLELHQHVLPSRUWDQWHQRHV
XQDVROXFLyQFRPSOHWDDHVWHSUREOHPD(VQHFHVDULRWDPELpQODFRUUHFFLyQGH
ODVYXOQHUDELOLGDGHVGHOVRIWZDUHGH0LFURVRIW
Protección perimetral para una línea adicional de
defensa.
(QHVWDVHFFLyQOLVWDPRVORVSXHUWRVTXHVRQKDELWXDOPHQWHVRQGHDGRV\
DWDFDGRV(OEORTXHRGHHVWRVSXHUWRVVHFRQVLGHUDXQUHTXLVLWRPtQLPRSDUDOD
VHJXULGDGSHULPHWUDODXQTXHQRGHEHFRQVLGHUDUVHFRPRXQDOLVWDGH
HVSHFLILFDFLRQHVFRPSOHWDSDUDHOFRUWDIXHJRV8QDQRUPDPXFKRPHMRUHV
EORTXHDUWRGRVORVSXHUWRVTXHQRVHXWLOLFHQ(LQFOXVRVDELHQGRTXHHVWRVSXHUWRV
HVWiQEORTXHDGRVGHEHUHPRVPRQLWRUL]DUORVDFWLYDPHQWHSDUDGHWHFWDULQWHQWRV
GHLQWUXVLyQ'HWRGDVIRUPDVVHKDFHQHFHVDULRXQDYLVR(OEORTXHRGHDOJXQRV
GHORVSXHUWRVLQFOXLGRVHQODOLVWDSXHGHGHVKDELOLWDUDOJXQRVVHUYLFLRVQHFHVDULRV
3RUWDQWRGHEHQFRQVLGHUDUVHORVHIHFWRVSRWHQFLDOHVGHHVWDVUHFRPHQGDFLRQHVGH
IRUPDSUHYLDDVXLPSOHPHQWDFLyQ
%ORTXHDUODVGLUHFFLRQHVVXSODQWDGDVSDTXHWHVSURYHQLHQWHVGHOH[WHULRU
FRQXQDGLUHFFLyQGHRULJHQGHQWURGHOUDQJRGHGLUHFFLRQHVLQWHUQDVR
SULYDGDV5)&\UHGDVtFRPRORVUDQJRVGHGLUHFFLRQHVUHVHUYDGRV
SRUOD,$1$%ORTXHDULJXDOPHQWHORVSDTXHWHVGHGLUHFFLRQDPLHQWRHQ
RULJHQ
6HUYLFLRVGHFRQH[LyQWHOQHWWFS66+WFS)73WFS1HW%,26
WFSUORJLQHWFGHOWFSDOWFS
53&\1)63RUWPDSUSFELQGWFS\XGS1)6WFS\
XGSORFNGWFS\XGS
1HW%,26HQ:LQGRZV17WFS\XGSXGSXGSWFS
:LQGRZV²ORVSXHUWRVDQWHULRUHV\WDPELpQHOWFS\XGS
;:LQGRZVSXHUWRVWFSGHODO
6HUYLFLRVGHQRPEUHV'16XGSHQWRGDVODVPiTXLQDVTXHQRVHDQ
VHUYLGRUHVGH'16WUDQVIHUHQFLDVGH]RQDGH'16WFSH[FHSWRHQORV
VHUYLGRUHVVHFXQGDULRVH[WHUQRV/'$3WFS\XGS
&RUUHR6073WFSHQWRGDVODVPiTXLQDVH[FHSWRHQORVVHUYLGRUHVGH
FRUUHRYLVLEOHVGHVGHHOH[WHULRU323WFS\WFS,0$3WFS
:HE+773WFS\66/WFSH[FHSWRHQORVVHUYLGRUHVZHE
DFFHVLEOHVGHVGHHOH[WHULRUGHEHUtDQEORTXHDUVHLJXDOPHQWHORVSXHUWRVQR
SULYLOHJLDGRVKDELWXDOPHQWHXWLOL]DGRVSRUORVVHUYLGRUHVZHEWFS
WFSWFSHWF
µ6PDOO6HUYLFHVµSXHUWRVLQIHULRUHVDOWFS\XGSWLPHWFS\
XGS
0LVFHOiQHD7)73XGSILQJHUWFS1173WFS173
WFS/3'WFSV\VORJXGS6103WFS\XGS
WFS\XGS%*3WFS62&.6WFS
,&03EORTXHDUODVVROLFLWXGHVGHHFRHQWUDQWHVSLQJ\WUDFHURXWHDVt
FRPRODVVROLFLWXGHVVDOLHQWHVGHHFRWLHPSRH[FHGLGR\QRDFFHVLEOH
H[FHSWRORVPHQVDMHVGH´SDTXHWHPX\JUDQGHµWLSRFyGLJR(VWD
OLPLWDFLyQDVXPHTXHGHVHDPRVSULYDUQRVGHORVXVRVOHJtWLPRVGHO
SURWRFROR,&03HQYLVWDVDLPSHGLUVXXWLOL]DFLyQGHIRUPDPDOLFLRVD
Información de soporte de los distribuidores de Unix
&RPSDT'LJLWDO8QL[
KWWSZZZFRPSDTFRPVXSSRUW
)UHH%6'
KWWSZZZIUHHEVGRUJVHFXULW\
+38;GH+3
(Q(VWDGRV8QLGRV&DQDGi$VLD3DFtILFR\$PpULFDGHO6XU
KWWSXVVXSSRUWH[WHUQDOKSFRP
(Q(XURSD
KWWSHXURSHVXSSRUWH[WHUQDOKSFRP
6HOHFFLRQDUORVSDTXHWHVLQGLYLGXDOHV\DFRQWLQXDFLyQFRQHFWDURFUHDUXQ
QXHYR,'GHFRQH[LyQ
3DUDREWHQHUODPDWUL]GHSDUFKHGHVHJXULGDG
IWSXVIIVH[WHUQDOKSFRPH[SRUWSDWFKHVKSX[BSDWFKBPDWUL[
$,;GH,%0
KWWSWHFKVXSSRUWVHUYLFHVLEPFRPUVVXSSRUWGRZQORDGV
KWWSWHFKVXSSRUWVHUYLFHVLEPFRPUVNIL[HVKWPO
6&22SHQ6HUYHU\8QL[:DUH
KWWSZZZVFRFRPVHFXULW\
%ROHWLQHVGHVHJXULGDG\SDUFKHV
KWWSZZZVFRFRPVXSSRUWIWSOLVWVLQGH[KWPO
3DUFKHVJHQHUDOHVGHOVLVWHPDRSHUDWLYR
6XQ6RODULV
KWWSVXQVROYHVXQFRP
3DUFKHV\UHFRPHQGDFLRQHVGHVHJXULGDG
6*,
KWWSVXSSRUWVJLFRP
/LQX[
&DOGHUD
KWWSZZZFDOGHUDFRPVXSSRUWVHFXULW\
'HELDQ
KWWSZZZGHELDQRUJVHFXULW\LQGH[HQKWPO
0DQGUDNH
KWWSZZZOLQX[PDQGUDNHFRPHQIXSGDWHVSKS
5HG+DW
KWWSZZZUHGKDWFRPVXSSRUWXSGDWHVKWPO
6X6(
KWWSZZZVXVHFRPVXSSRUWGRZQORDGXSGDWHVLQGH[KWPO
KWWSZZZVXVHGHHQVXSSRUWVHFXULW\LQGH[KWPO
Firmantes.
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
5DQG\0DUFKDQ\9LUJLQLD7HFK
6FRWW&RQWLXQLYHUVLGDGGH0DVVDFKXVHWWV
0DWW%LVKRSXQLYHUVLGDGGH&DOLIRUQLD'DYLV
6WHQ'UHVFKHU7LYROL6\VWHPV
/DQFH6SLW]QHU6XQ0LFURV\VWHPV*(666HFXULW\7HDP
$ODQ3DOOHU6$16,QVWLWXWH
6WHSKHQ1RUWKFXWW6$16,QVWLWXWH
(ULF&ROH6$16,QVWLWXWH
*HQH6SDIIRUG&(5,$6GHODXQLYHUVLGDG3XUGXH
-LP5DQVRPH3LORW1HWZRUN6HUYLFHV
)UDQN6ZLIW3LORW1HWZRUN6HUYLFHV
-LP0DJG\FK1HWZRUN$VVRFLDWHV,QF
-LPP\.XR1HWZRUN$VVRFLDWHV,QF
,JRU*DVKLQVN\1HW6HF,QF
*UHJ6KLSOH\1HRKDSVLV
7RQ\6DJHU$JHQFLD1DFLRQDOGH6HJXULGDG
/DUU\0HUULWW$JHQFLD1DFLRQDOGH6HJXULGDG
%LOO+LOO0,75(
6WHYH&KULVWH\0,75(
9LUL\D8SDWLVLQJ/R[OH\,QIRUPDWLRQ6HUYLFHV&R
0DUFXV6DFKV-7)&1''HSDUWDPHQWRGHGHIHQVDGHORV((88
%LOO\$XVWLQ,QWUXVLRQFRP
&KULVWRSKHU:.ODXV,QWHUQHW6HFXULW\6\VWHPV
:D\QH6WHQVRQ+RQH\ZHOO
0DUWLQ5RHVFK+LYHUZRUOG,QF
-HII6WXW]PDQ+HDOWKFDUH,6$&
(G6NRXGLV*OREDO,QWHJULW\
*HQH6FKXOW]*OREDO,QWHJULW\
.HOO\&RRSHU*HQXLW\
(ULF6FKXOW]H)RXQGVWRQH
%LOO+DQFRFN([RGXV&RPPXQLFDWLRQV
5RQ1JX\HQ(UQVW<RXQJ
/HH%URW]PDQ1$6,5&$OOLHG7HFKQRORJ\*URXS,QF
6FRWW/DZOHU&HUWGHO'HSDUWDPHQWRGHGHIHQVDGHORV((88
+DO3RPHUDQ]'HHU5XQ$VVRFLDWHV
&KULV%UHQWRQ'DUWPRXWK,QVWLWXWHIRU6HFXULW\6WXGLHV
%UXFH6FKQHLHU&RXQWHUSDQH,QWHUQHW6HFXULW\,QF
1LFN)LW]*HUDOG&RPSXWHU9LUXV&RQVXOWLQJ/WG
6KDZQ+HUQDQ&(57&RRUGLQDWLRQ&HQWHU
.DWK\)LWKHQ&(57&RRUGLQDWLRQ&HQWHU
'HUHN6LPPHO&DUQHJLH0HOORQ8QLYHUVLW\
-HVSHU-RKDQVVRQ%RVWRQ8QLYHUVLW\
'DYH0DQQ%LQG9LHZ
5RE&O\GH$[HQW
'DYLG1RODQ$UFK3DJLQJ
0XGJH#VWDNH
Expertos en seguridad que colaboran en la detección y solución
de estas vulnerabilidades
•
•
5REHUW+DUULV
6FRWW&UDLJ.PDUW