In the Exim mail server critical (), which can lead to remote code execution on the server with root privileges when processing a specifically formatted request. The vulnerability is present in versions 4.87 through 4.91 inclusive or when compiled with the EXPERIMENTAL_EVENT option.
In the default configuration, an attack can be carried out without much complication by a local user, as the ACL ‘verify = recipient’ is applied, performing additional checks for external addresses. Remote attack is possible when settings are adjusted, for instance, when acting as a secondary MX for another domain, removing the ACL ‘verify = recipient’, or certain changes in local_part_suffix). A remote attack is also feasible if the attacker can keep the connection with the server open for 7 days (for example, by sending one byte per minute to bypass the timeout disconnection). It cannot be ruled out that there are simpler attack vectors for remote exploitation of the vulnerability.
The vulnerability is caused by incorrect recipient address verification in the deliver_message() function, defined in the file /src/deliver.c. By manipulating the address formatting, an attacker can substitute their data into the arguments of a command invoked via the execv() function with root privileges. Exploitation does not require complex techniques used in buffer overflows or memory corruption; it is sufficient to simply substitute characters.
The issue is related to the use of the following construct for address transformation:
deliver_localpart = expand_string(
string_sprintf('${local_part:%s}', new->address));
deliver_domain = expand_string(
string_sprintf('${domain:%s}', new->address));
The expand_string() function is an overly complex combiner, which includes recognizing the command ‘${run{command arguments}’, leading to the launch of an external handler. Thus, during the SMTP session, it is sufficient for a local user to pass a command like ‘RCPT TO
If the server acts as a mail relay, it is sufficient to send the command ‘RCPT TO «${run{…}}@relaydomain.com»‘, where relaydomain.com is one of the hosts listed in the relay_to_domains settings section. Since by default, Exim does not apply the privilege drop mode (deliver_drop_privilege = false), commands passed through ‘${run{…}}’ will be executed with root privileges.
It is noteworthy that the vulnerability was in the February release 4.92 without drawing attention to the fact that the fix could lead to security issues. There is no reason to believe that the Exim developers intentionally concealed the vulnerability, as the issue was resolved during for a failure occurring when transmitting incorrect addresses, and the vulnerability was identified by Qualys during an audit of changes in Exim.
The fix for earlier versions, which continue to be used in distributions, is currently available only in the form of . Correction releases for earlier branches to address the issue are scheduled for June 11. Package updates have been prepared for , , . and which deliver version 4.92, in which the issue does not occur. RHEL and CentOS are not affected by the issue, , as Exim is not included in their standard package repository.
Source: opennet.ru
