{"id":38040,"date":"2019-10-31T22:21:20","date_gmt":"2019-10-31T19:21:20","guid":{"rendered":"https:\/\/prohoster.info\/blog\/propatchil-exim-propatch-eshhe-raz-svezhee-remote-command-execution-v-exim-4-92-v-odin-zapros\/"},"modified":"2021-02-01T11:37:46","modified_gmt":"2021-02-01T09:37:46","slug":"propatchil-exim-propatch-eshhe-raz-svezhee-remote-command-execution-v-exim-4-92-v-odin-zapros","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/propatchil-exim-propatch-eshhe-raz-svezhee-remote-command-execution-v-exim-4-92-v-odin-zapros","title":{"rendered":"Opraven Exim \u2014 oprav je\u0161t\u011b jednou. Nov\u00e1 zranitelnost Remote Command Execution v Exim 4.92 v jednom po\u017eadavku","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Opraven<\/p>\n

Ned\u00e1vno, na za\u010d\u00e1tku l\u00e9ta, se objevily masivn\u00ed v\u00fdzvy k aktualizaci Exim na verzi 4.92 kv\u016fli zranitelnosti CVE-2019-10149 (Urgentn\u011b aktualizujte exim na 4.92 \u2014 aktivn\u00ed infekce \/ Habr<\/a><\/noindex>). A ned\u00e1vno se uk\u00e1zalo, \u017ee malware Sustes se rozhodl vyu\u017e\u00edt t\u00e9to zranitelnosti.<\/p>\n

Nyn\u00ed se v\u0161ichni, kdo urgentn\u011b aktualizovali, mohou op\u011bt \"pot\u011b\u0161it\": 21. \u010dervence 2019 v\u00fdzkumn\u00edk Zerons objevil kritickou zranitelnost v Exim Mail Transfer agent (MTA) p\u0159i pou\u017e\u00edv\u00e1n\u00ed TLS<\/strong> pro verze od 4.80 do 4.92.1<\/strong> v\u010detn\u011b, co\u017e umo\u017e\u0148uje vzd\u00e1len\u00e9 prov\u00e1d\u011bn\u00ed k\u00f3du s privilegovan\u00fdmi opr\u00e1vn\u011bn\u00edmi<\/strong> (CVE-2019-15846<\/a><\/noindex>).<\/p>\n

<\/a><\/noindex><\/p>\n

Zranitelnost<\/h3>\n

Zranitelnost se vyskytuje p\u0159i pou\u017eit\u00ed knihoven GnuTLS i OpenSSL p\u0159i nastaven\u00ed zabezpe\u010den\u00e9ho TLS spojen\u00ed.<\/p>\n

Podle slov v\u00fdvoj\u00e1\u0159e Heika Schlittermanna soubor konfigurace v Exim dle v\u00fdchoz\u00edho nastaven\u00ed nepou\u017e\u00edv\u00e1 TLS, av\u0161ak mnoho distribuc\u00ed p\u0159i instalaci vytv\u00e1\u0159\u00ed pot\u0159ebn\u00e9 certifik\u00e1ty a zap\u00edn\u00e1 zabezpe\u010den\u00e9 spojen\u00ed. Tak\u00e9 nov\u011bj\u0161\u00ed verze Exim nastavuj\u00ed volbu tls_advertise_hosts=*<\/em> a generuj\u00ed pot\u0159ebn\u00e9 certifik\u00e1ty.<\/p>\n

z\u00e1vis\u00ed na konfiguraci. V\u011bt\u0161ina distribuc\u00ed to zap\u00edn\u00e1 standardn\u011b, ale Exim pot\u0159ebuje certifik\u00e1t a kl\u00ed\u010d, aby fungoval jako TLS server. Pravd\u011bpodobn\u011b distribuce vytv\u00e1\u0159ej\u00ed certifik\u00e1t b\u011bhem instalace. Nov\u011bj\u0161\u00ed verze Eximu maj\u00ed mo\u017enost tls_advertise_hosts, kter\u00e1 m\u00e1 v\u00fdchoz\u00ed hodnotu \u201e*\u201c a vytv\u00e1\u0159\u00ed samo podepsan\u00fd certifik\u00e1t, pokud nen\u00ed poskytnut.<\/p><\/blockquote>\n

Sama zranitelnost spo\u010d\u00edv\u00e1 v nespr\u00e1vn\u00e9m zpracov\u00e1n\u00ed SNI (Server Name Indication, technologie, zaveden\u00e1 v roce 2003 v RFC 3546 pro po\u017eadavek klienta na spr\u00e1vn\u00fd certifik\u00e1t pro dom\u00e9nov\u00e9 jm\u00e9no, Roz\u0161\u00ed\u0159en\u00ed standardu TLS SNI \/ Blog spole\u010dnosti WEBO Group \/ Habr<\/a><\/noindex>) b\u011bhem TLS handshake. \u00dato\u010dn\u00edkovi sta\u010d\u00ed poslat SNI, kon\u010d\u00edc\u00ed zp\u011btn\u00fdm lom\u00edtkem (\u201e\u201c\u201c) a nulov\u00fdm znakem (\u201e \u201e).<\/p>\n

V\u00fdzkumn\u00edci z firmy Qualys objevili chybu ve funkci string_printing(tls_in.sni), kter\u00e1 spo\u010d\u00edv\u00e1 v nespr\u00e1vn\u00e9m escapov\u00e1n\u00ed \u201e\u201c\u201c. V d\u016fsledku toho se zp\u011btn\u00e9 lom\u00edtko zapisuje v neescapovan\u00e9 podob\u011b do souboru hlavi\u010dek print spool. Tento soubor s privilegovan\u00fdmi pr\u00e1vy je pot\u00e9 na\u010d\u00edt\u00e1n funkc\u00ed spool_read_header(), co\u017e vede k p\u0159ete\u010den\u00ed haldy (heap overflow).<\/p>\n

Je t\u0159eba poznamenat, \u017ee v sou\u010dasn\u00e9 dob\u011b v\u00fdvoj\u00e1\u0159i Exim vytvo\u0159ili PoC zranitelnosti s prov\u00e1d\u011bn\u00edm p\u0159\u00edkaz\u016f na vzd\u00e1len\u00e9m zraniteln\u00e9m serveru, ale v ve\u0159ejn\u00e9m p\u0159\u00edstupu zat\u00edm chyb\u00ed. Vzhledem k jednoduchosti exploitace chyby je to pouze ot\u00e1zka \u010dasu, a to pom\u011brn\u011b kr\u00e1tk\u00e9ho.<\/strong><\/p>\n

S podrobn\u011bj\u0161\u00edm v\u00fdzkumem spole\u010dnosti Qualys se m\u016f\u017eete sezn\u00e1mit zde<\/a><\/noindex>.<\/p>\n

\"Opraven<\/p>\n

Pou\u017eit\u00ed SNI v TLS<\/em><\/p>\n

Po\u010det potenci\u00e1ln\u011b zraniteln\u00fdch ve\u0159ejn\u00fdch server\u016f<\/h3>\n

Podle statistik v\u00fdznamn\u00e9ho poskytovatele hostingu E-Soft Inc<\/strong> k 1. z\u00e1\u0159\u00ed je na pronaj\u00edman\u00fdch serverech verze 4.92 pou\u017e\u00edv\u00e1na na v\u00edce ne\u017e 70 % hostech.<\/p>\n

Verze
\nPo\u010det server\u016f
\nProcento<\/p>\n

4.92.1
\n6471
\n1.28%<\/p>\n

4.92<\/strong>
\n376436<\/strong>
\n74.22%<\/strong><\/p>\n

4.91
\n58179
\n11.47%<\/p>\n

4.9
\n5732
\n1.13%<\/p>\n

4.89
\n10700
\n2.11%<\/p>\n

4.87
\n14177
\n2.80%<\/p>\n

4.84
\n9937
\n1.96%<\/p>\n

Ostatn\u00ed verze
\n25568
\n5.04%<\/p>\n

Statistiky spole\u010dnosti E-Soft Inc<\/em><\/p>\n

Pokud se obr\u00e1t\u00edte na vyhled\u00e1va\u010d Shodan<\/strong><\/a><\/noindex>, tak z 5,250,000 v datab\u00e1zi server\u016f:<\/p>\n