Qualys Company yet another remote critical vulnerability (CVE-2020-8794) in the mail server , developed by the OpenBSD project. Like the one discovered at the end of January , this new issue allows for arbitrary shell commands to be executed remotely on the server with root user privileges. The vulnerability in the release .
stems from an error in the code responsible for delivering mail to a remote mail server (not in the code handling incoming connections). The attack can occur on both the client and server sides. On the client side, the attack is possible in the default OpenSMTPD configuration, where OpenSMTPD only accepts requests on the internal network interface (localhost) and sends emails to external servers. To exploit the vulnerability, it is sufficient for OpenSMTPD to establish a session with a mail server controlled by the attacker during the delivery of an email, or for the attacker to intercept the client connection (MITM or redirection during attacks via DNS or BGP).
For a server-side attack, OpenSMTPD must be configured to accept external network requests from other mail servers or serve third-party services that allow sending requests to arbitrary email addresses (for example, address confirmation forms on websites). For instance, an attacker can connect to the OpenSMTPD server and send an incorrect email (to a non-existent user), which will result in a bounced email being sent back to the attacker's server with an error code. The attacker can exploit the vulnerability at the moment when OpenSMTPD connects to deliver a notification to the attacker's server. The injected shell commands during the attack are placed in a file that executes with root privileges upon the restart of OpenSMTPD, so the attacker must wait for OpenSMTPD to restart or initiate a crash of OpenSMTPD.
The issue exists in the mta_io() function in the code that parses the multiline response returned by the remote server after establishing a connection (for example, "250-ENHANCEDSTATUSCODES" and "250 HELP"). In OpenSMTPD, it is assumed that the first line contains a three-digit number and text separated by a hyphen, while the second line contains a three-digit number and text separated by a space. If there is no space and text following the three-digit number in the second line, the pointer used to determine the text is set to the byte following the '\0' character, and an attempt is made to copy the data in the buffer that follows the end of the line.
At the request of the OpenBSD project, the publication of details regarding the vulnerability exploitation has been postponed until February 26 to give users the opportunity to update their systems. The issue has been present in the codebase since December 2015, but exploitation to execute code with root privileges has been possible since May 2018. Researchers have prepared a working prototype of the exploit, which has been successfully tested in OpenSMTPD builds for OpenBSD 6.6, OpenBSD 5.9, Debian 10, Debian 11 (testing), and Fedora 31.
In OpenSMTPD, there is also another vulnerability (CVE-2020-8793) that allows a local user to read the first line of any file in the system. For example, one can read the first line of /etc/master.passwd, which contains the hash of the root user's password. The vulnerability also allows reading the entire content of a file owned by another user if that file is in the same filesystem as the /var/spool/smtpd/ directory. The problem is not exploitable in many Linux distributions where the value of /proc/sys/fs/protected_hardlinks is set to 1.
The issue is the result of incomplete remediation , as outlined during the audit conducted by Qualys in 2015. An attacker can achieve the execution of their code with the group privileges of "_smtpq" by setting the variable "PATH=." and placing a script named makemap in the current directory (the smtpctl utility invokes makemap without specifying the path). Gaining access to the "_smtpq" group, the attacker can then trigger a race condition (create a large file in the offline directory and send a SIGSTOP signal) and, before processing is completed, replace the file in the offline directory with a hard symlink pointing to the target file whose content needs to be read.
Notably, in Fedora 31, the vulnerability allows immediate acquisition of root group privileges, as the smtpctl process is equipped with the setgid root flag instead of setgid smtpq. Gaining access to the root group enables overwriting the contents of /var/lib/sss/mc/passwd and obtaining full root access to the system.
Source: opennet.ru
