corrective release with the critical (), which in the default configuration may lead to remote code execution by an attacker with root privileges. The issue only manifests when TLS support is enabled and is exploited by sending a specially crafted client certificate or a modified value in SNI. The vulnerability was discovered by Qualys.
The Problem in the special character escaping handler in the string ( from string.c) and is caused by the fact that the '\' character at the end of the string is interpreted before the null character (‘\0’), and escapes it. When escaping, the sequence ‘\’ and the subsequent null code marking the end of the string are treated as a single character, and the pointer shifts to data beyond the string, which is processed as its continuation.
The code calling string_interpret_escape() allocates a buffer for the input stream based on its actual size, and the resulting pointer ends up outside the buffer boundaries. Consequently, when attempting to process the input string, there is a read situation from outside the allocated buffer, and trying to write the unescaped string may lead to writing beyond the buffer.
In the default configuration, the vulnerability can be exploited by sending specially crafted data in SNI during the establishment of a secure connection to the server. The issue can also be exploited by modifying peerdn values in configurations set up for client certificate authentication or during the import of certificates. An attack via SNI and peerdn is possible starting from the release , where the string_unprinting() function was applied to unescape the contents of peerdn and SNI.
An exploit prototype for the SNI attack has been prepared, working on i386 and amd64 architectures in Linux systems with Glibc. The exploit uses data overlay on the heap area, leading to the overwriting of memory where the log file name is stored. The file name is replaced with ‘/../../../../../../../../../../../etc/passwd’. Next, the variable with the sender address, which is first logged, is overwritten, allowing a new user to be added to the system.
Packages with vulnerability remediation have been released by distributions , , , and . RHEL and CentOS regarding the issue , as Exim is not included in their standard package repository (in update , but are not yet in the public repository). The issue in the Exim code is resolved with a single line , which disables the escaping action of the backslash if it is at the end of the line.
As a workaround to block the vulnerability, you can disable TLS support or add to the
ACL section "acl_smtp_mail":
deny condition = ${if eq{\}{${substr{-1}{1}{$tls_in_sni}}}}
deny condition = ${if eq{\}{${substr{-1}{1}{$tls_in_peerdn}}}}
Source: opennet.ru
