Security researchers from Qualys of vulnerabilities in the qmail mail server, existing since 2005 (CVE-2005-1513), but remaining unpatched, as the author of qmail claimed that it was unrealistic to create a working exploit that could be used to attack systems with default configurations. Qualys managed to prepare an exploit that disproves this assumption and allows for remote code execution on the server by sending a specially crafted message.
The issue is caused by an integer overflow in the stralloc_readyplus() function, which can occur when processing a very large message. A 64-bit system with more than 4GB of virtual memory was required for exploitation. When initially analyzing the vulnerability in 2005, Daniel J. Bernstein argued that the assumption present in the code that the size of the allocated array would always fit within a 32-bit value was based on the fact that nobody allocates gigabytes of memory to each process. Over the past 15 years, 64-bit systems have replaced 32-bit systems on servers, dramatically increasing the amounts of memory provided and network bandwidth.
The accompanying packages with qmail took Bernstein's remark into account and limited the available memory when the qmail-smtpd process was started (for example, in Debian 10, there is a 7MB limit). However, engineers from Qualys discovered that this was insufficient and, in addition to qmail-smtpd, a remote attack could also be conducted on the qmail-local process, which remained unrestricted in all checked packages. As proof, a prototype exploit was prepared, suitable for attacking the Debian-supplied qmail package in its default configuration.
To organize remote code execution during the attack, 4GB of free disk space and 8GB of RAM are required on the server.
The exploit allows any shell commands to be executed with the rights of any user in the system, except for root and system users who do not have their own subdirectory in the '/home' directory (the qmail-local process is started with the rights of the local user to whom the delivery is made).
The attack is carried out
through the sending of a very large email message, including several lines in the header, approximately 4GB and 576MB in size. Processing such a line in qmail-local leads to an integer overflow when attempting to deliver the message to a local user. The integer overflow subsequently causes a buffer overflow while copying data, allowing for the potential overwriting of memory pages containing libc code. By manipulating the layout of the transmitted data, it is also possible to overwrite the address of the ‘open()’ function, replacing it with the address of the ‘system()’ function.
Next, during the call to qmesearch() in qmail-local, the file ‘.qmail-extension’ is opened using the open() function, which leads to the actual invocation of the function
system(‘.qmail-extension’). However, since part of the ‘extension’ file is formed based on the recipient's address (for example, ‘localuser-extension@localdomain’), attackers can arrange to send a command for execution by specifying the user ‘localuser-;command;@localdomain’ as the email recipient.
As part of the code analysis, two vulnerabilities were also identified in the additional patch qmail-verify, which is included in the Debian package. The first vulnerability () allows bypassing the email address verification, while the second () leads to the leakage of local information. Specifically, the first vulnerability permits bypassing the validity check for the address used in the exploit for sending commands (the check does not trigger for addresses without a domain, such as ‘localuser-;command;’). The second vulnerability can be used to check for the existence of files and directories in the system, including those accessible only to root (qmail-verify is executed with root privileges), through direct access to the local handler.
To circumvent the problem, Bernstein recommended running qmail processes with a set limit on available memory (‘softlimit -m12345678’), which effectively blocks the issue. An alternative protection method also mentioned is limiting the maximum size of processed messages through the file ‘control/databytes’ (by default it is not created with the default settings, leaving qmail vulnerable). Additionally, ‘control/databytes’ does not protect against local attacks from system users, as the limit is only considered in qmail-smtpd.
The issue affects the package , included in the Debian repositories. A set of patches has been prepared for this package to address both old vulnerabilities from 2005 (by adding strict memory limits through the alloc() function) and new issues in qmail-verify. Separately the updated version of the qmail-verify patch. The developers have prepared their patches to block old problems and have also initiated work to eliminate any potential integer overflows in the code.
Source: opennet.ru
