{"id":100086,"date":"2021-05-04T22:22:55","date_gmt":"2021-05-04T20:22:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/obnovlenie-exim-4-94-2-s-ustraneniem-10-udalyonno-ekspluatiruemyh-uyazvimostej"},"modified":"2021-05-04T22:22:55","modified_gmt":"2021-05-04T20:22:55","slug":"obnovlenie-exim-4-94-2-s-ustraneniem-10-udalyonno-ekspluatiruemyh-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/obnovlenie-exim-4-94-2-s-ustraneniem-10-udalyonno-ekspluatiruemyh-uyazvimostej","title":{"rendered":"Opdatering af Exim 4.94.2 med rettelse af 10 s\u00e5rbarheder, der kan udnyttes eksternt","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Udgaven af mailserveren Exim 4.94.2 er blevet offentliggjort med rettelse af 21 s\u00e5rbarheder (CVE-2020-28007-CVE-2020-28026, CVE-2021-27216), som blev identificeret af virksomheden Qualys og pr\u00e6senteret under kodenavnet 21Nails. 10 af problemerne kan udnyttes eksternt (herunder til at udf\u00f8re kode med root-rettigheder) ved at manipulere SMTP-kommandoer under interaktion med serveren.     <\/p>\n<p>Alle versioner af Exim, hvis historik f\u00f8lges i Git siden 2004, er s\u00e5rbare. Der er forberedt fungerende prototyper af exploits til 4 lokale s\u00e5rbarheder og 3 eksterne problemer. Eksploiteringer for de lokale s\u00e5rbarheder (CVE-2020-28007, CVE-2020-28008, CVE-2020-28015, CVE-2020-28012) tillader, at brugeren kan h\u00e6ve sine privilegier til root-bruger. To eksterne problemer (CVE-2020-28020, CVE-2020-28018) g\u00f8r det muligt at udf\u00f8re kode uden godkendelse med brugerens exim-rettigheder (herefter kan man opn\u00e5 root-adgang ved at udnytte en af de lokale s\u00e5rbarheder).     <\/p>\n<p>S\u00e5rbarheden CVE-2020-28021 giver mulighed for straks at udf\u00f8re kode eksternt med root-rettigheder, men kr\u00e6ver autentificeret adgang (brugeren skal oprette en autentificeret session, hvorefter han kan udnytte s\u00e5rbarheden ved at manipulere AUTH-parameteren i MAIL FROM-kommandoen). Problemet skyldes, at angriberen kan opn\u00e5 injektion af strengen i headeren af spool-filen p\u00e5 grund af manglende korrekt escape af specialtegnene ved skrivning af v\u00e6rdien authenticated_sender (for eksempel ved at sende kommandoen \"MAIL FROM: AUTH=Raven+0AReyes\").        <\/p>\n<p>Derudover bem\u00e6rkes det, at en anden fjern-s\u00e5rbarhed, CVE-2020-28017, kan udnyttes til at udf\u00f8re kode med brugeren \"exim\" uden autentifikation, men kr\u00e6ver mere end 25 GB hukommelse. For de resterende 13 s\u00e5rbarheder kan der ogs\u00e5 potentielt forberedes exploits, men der er endnu ikke arbejdet i denne retning.        <\/p>\n<p>Udviklerne af Exim blev underrettet om problemerne allerede i oktober sidste \u00e5r og har brugt mere end 6 m\u00e5neder p\u00e5 at udvikle rettelser. Alle administratorer anbefales straks at opdatere Exim p\u00e5 deres mailservere. <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/da\/server\/dts-gdansk\/\"   title=\"servere\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"4516\">servere<\/a> Indtil version 4.94.2. Alle Exim-versioner f\u00f8r udgivelsen 4.94.2 er blevet erkl\u00e6ret for\u00e6ldede (obsolete). Udgivelsen af den nye version blev koordineret med de distributioner, som samtidig offentliggjorde opdateringer til pakkerne: Ubuntu, Arch Linux, FreeBSD, Debian, SUSE og Fedora. RHEL og CentOS er ikke p\u00e5virket, da Exim ikke er en del af deres officielle pakke-repositories (opdateringen mangler stadig i EPEL).   <\/p>\n<p>Fjernede s\u00e5rbarheder:  <\/p>\n<ul>\n<li class=\"l\"> CVE-2020-28017: Integer overflow i funktionen receive_add_recipient();\n<li class=\"l\"> CVE-2020-28020: Integer overflow i funktionen receive_msg();\n<li class=\"l\"> CVE-2020-28023: L\u00e6sning fra uden for den tildelte buffer i funktionen smtp_setup_msg();\n<li class=\"l\"> CVE-2020-28021: Inds\u00e6ttelse af ny linje i headeren af spool-filen;\n<li class=\"l\"> CVE-2020-28022: L\u00e6sning og skrivning uden for den tildelte buffer i funktionen extract_option();\n<li class=\"l\"> CVE-2020-28026: Afkortning og inds\u00e6ttelse af streng i funktionen spool_read_header();\n<li class=\"l\"> CVE-2020-28019: Nedbrud ved nulstilling af funktionspeger efter fejl i BDAT;\n<li class=\"l\"> CVE-2020-28024: Overflow ved den nederste gr\u00e6nse af bufferen i funktionen smtp_ungetc();\n<li class=\"l\"> CVE-2020-28018: Adgang til buffer efter frigivelse (use-after-free) i tls-openssl.c\n<li class=\"l\"> CVE-2020-28025: L\u00e6sning fra uden for den tildelte buffer i funktionen pdkim_finish_bodyhash().  <\/ul>\n<p>Lokale s\u00e5rbarheder:  <\/p>\n<ul>\n<li class=\"l\"> CVE-2020-28007: Angreb via symbolisk link i kataloget med Exim-logfiler;\n<li class=\"l\"> CVE-2020-28008: Angreb p\u00e5 spool-kataloget;\n<li class=\"l\"> CVE-2020-28014: Oprettelse af vilk\u00e5rlig fil;\n<li class=\"l\"> CVE-2021-27216: Sletning af vilk\u00e5rlig fil;\n<li class=\"l\"> CVE-2020-28011: Buffer overflow i funktionen queue_run();\n<li class=\"l\"> CVE-2020-28010: Skrivning uden for bufferen i funktionen main();\n<li class=\"l\"> CVE-2020-28013: Buffer overflow i funktionen parse_fix_phrase();\n<li class=\"l\"> CVE-2020-28016: Skrivning uden for bufferen i funktionen parse_fix_phrase();\n<li class=\"l\"> CVE-2020-28015: Inds\u00e6ttelse af ny linje i headeren af spool-filen;\n<li class=\"l\"> CVE-2020-28012: Manglende close-on-exec flag for privilegeret anonym kanal;\n<li class=\"l\"> CVE-2020-28009: Integer overflow i funktionen get_stdinput().  <\/ul>\n<p>          <center>  <iframe loading=\"lazy\" title=\"Exim Mail Server Multiple Vulnerabilities (21Nails)\" src=\"https:\/\/player.vimeo.com\/video\/544783362\" width=\"640\" height=\"360\"><\/iframe>  <\/center><br \/>\n<br \/>Kilde: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=55079\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430 Exim 4.94.2 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c 21 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2020-28007-CVE-2020-28026, CVE-2021-27216), \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Qualys \u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u044b \u043f\u043e\u0434 \u043a\u043e\u0434\u043e\u0432\u044b\u043c \u0438\u043c\u0435\u043d\u0435\u043c 21Nails. 10 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e (\u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root), \u0447\u0435\u0440\u0435\u0437 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u0438 \u0441 SMTP-\u043a\u043e\u043c\u0430\u043d\u0434\u0430\u043c\u0438 \u043f\u0440\u0438 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0438 \u0441 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u043c. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430\u043c \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b \u0432\u0441\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 Exim, \u0438\u0441\u0442\u043e\u0440\u0438\u044f \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0432 Git [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-100086","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430 Exim 4.94.2 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c 21 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2020-28007-CVE-2020-28026, CVE-2021-27216), \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Qualys \u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u044b \u043f\u043e\u0434 \u043a\u043e\u0434\u043e\u0432\u044b\u043c \u0438\u043c\u0435\u043d\u0435\u043c 21Nails.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/da\/blog\/news\/obnovlenie-exim-4-94-2-s-ustraneniem-10-udalyonno-ekspluatiruemyh-uyazvimostej\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"da_DK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 Exim 4.94.2 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c 10 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430 Exim 4.94.2 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c 21 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2020-28007-CVE-2020-28026, CVE-2021-27216), \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Qualys \u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u044b \u043f\u043e\u0434 \u043a\u043e\u0434\u043e\u0432\u044b\u043c \u0438\u043c\u0435\u043d\u0435\u043c 21Nails.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/da\/blog\/news\/obnovlenie-exim-4-94-2-s-ustraneniem-10-udalyonno-ekspluatiruemyh-uyazvimostej\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2021-05-04T20:22:55+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2021-05-04T20:22:55+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Opdatering af Exim 4.94.2 med rettelse af 10 fjernudnyttede s\u00e5rbarheder | ProHoster","description":"Udgivelsen af mailserveren Exim 4.94.2 med rettelse af 21 s\u00e5rbarheder (CVE-2020-28007-CVE-2020-28026, CVE-2021-27216), som blev opdaget af Qualys og pr\u00e6senteret under kodenavnet 21Nails.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/obnovlenie-exim-4-94-2-s-ustraneniem-10-udalyonno-ekspluatiruemyh-uyazvimostej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 Exim 4.94.2 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c 10 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430 Exim 4.94.2 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c 21 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2020-28007-CVE-2020-28026, CVE-2021-27216), \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Qualys \u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u044b \u043f\u043e\u0434 \u043a\u043e\u0434\u043e\u0432\u044b\u043c \u0438\u043c\u0435\u043d\u0435\u043c 21Nails.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/obnovlenie-exim-4-94-2-s-ustraneniem-10-udalyonno-ekspluatiruemyh-uyazvimostej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-05-04T20:22:55+00:00","article:modified_time":"2021-05-04T20:22:55+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"100086","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-05-04 20:41:07","updated":"2022-10-05 17:52:30","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/100086","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=100086"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/100086\/revisions"}],"predecessor-version":[{"id":164394,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/100086\/revisions\/164394"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=100086"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=100086"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=100086"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}