{"id":37876,"date":"2019-10-31T22:20:17","date_gmt":"2019-10-31T19:20:17","guid":{"rendered":"https:\/\/prohoster.info\/blog\/raskryty-podrobnosti-kriticheskoj-uyazvimosti-v-exim\/"},"modified":"2019-10-31T22:20:17","modified_gmt":"2019-10-31T19:20:17","slug":"raskryty-podrobnosti-kriticheskoj-uyazvimosti-v-exim","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/raskryty-podrobnosti-kriticheskoj-uyazvimosti-v-exim","title":{"rendered":"Details of a critical vulnerability in Exim have been disclosed","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Published<\/a><\/noindex> corrective release Exim 4.92.2<\/a><\/noindex> with the critical a vulnerability<\/a><\/noindex> (CVE-2019-15846<\/a><\/noindex>), which in the default configuration may lead to remote code execution by an attacker with root privileges. The issue only manifests when TLS support is enabled and is exploited by sending a specially crafted client certificate or a modified value in SNI. The vulnerability identified<\/a><\/noindex> was discovered by Qualys.<\/p>\n

The Problem has been present<\/a><\/noindex> in the special character escaping handler in the string (string_interpret_escape()<\/a><\/noindex> from string.c) and is caused by the symbol \u2018\u2019 at the end of the string being interpreted before the null character (\u2018\u2019) and escaping it. When escaping, the sequence \u2018\u2019 and the subsequent null code of the end of the string are processed as a single character, causing the pointer to shift to data beyond the string, which is treated as its continuation. <\/p>\n

The code calling string_interpret_escape() allocates a buffer for the input stream based on its actual size, and the resulting pointer ends up outside the buffer boundaries. Consequently, when attempting to process the input string, there is a read situation from outside the allocated buffer, and trying to write the unescaped string may lead to writing beyond the buffer.<\/p>\n

In the default configuration, the vulnerability can be exploited by sending specially crafted data in SNI during the establishment of a secure connection to the server. The issue can also be exploited by modifying peerdn values in configurations set up for client certificate authentication or during the import of certificates. An attack via SNI and peerdn is possible starting from the release Exim 4.80<\/a><\/noindex>, where the string_unprinting() function was applied to unescape the contents of peerdn and SNI.<\/p>\n

A prototype exploit for an attack via SNI has been developed, operating on i386 and amd64 architectures in Linux systems with Glibc. The exploit uses data overlaying on the heap area, leading to memory overwrite where the log filename is stored. The filename is replaced with \u2018\/..\/..\/..\/..\/..\/..\/..\/..\/..\/..\/etc\/passwd\u2019. Then, the variable containing the sender\u2019s address, which is first saved in the log, is overwritten, allowing a new user to be added to the system. <\/p>\n

Packages with vulnerability remediation have been released by distributions Debian<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, Alpine<\/a><\/noindex>, Arch<\/a><\/noindex> and FreeBSD<\/a><\/noindex>. RHEL and CentOS regarding the issue as Exim is not included in their standard package repository.<\/a><\/noindex>, as Exim is not included in their standard package repository (in EPEL<\/a><\/noindex> update already<\/a><\/noindex> has been formed<\/a><\/noindex>, but are not yet not included<\/a><\/noindex> in the public repository). The issue in the Exim code is resolved with a single line a patch<\/a><\/noindex>, which disables the escaping action of the backslash if it is at the end of the line.<\/p>\n

As a workaround to block the vulnerability, you can disable TLS support or add to the
\nACL section \u2018acl_smtp_mail\u2019:\n<\/p>\n

deny condition = ${if eq{\\}{${substr{-1}{1}{$tls_in_sni}}}}
\n deny condition = ${if eq{\\}{${substr{-1}{1}{$tls_in_peerdn}}}}<\/p>\n

<\/a><\/noindex><\/p>\n

Source: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0439 \u0432\u044b\u043f\u0443\u0441\u043a Exim 4.92.2 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2019-15846), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u0440\u0438 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 TLS \u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u043e\u0433\u043e \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 \u0438\u043b\u0438 \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0432 SNI. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Qualys. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0435 \u044d\u043a\u0440\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u043f\u0435\u0446\u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-37876","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Details of the critical vulnerability in Exim revealed | ProHoster","description":"A corrective release of Exim has been published.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/news\/raskryty-podrobnosti-kriticheskoj-uyazvimosti-v-exim","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Exim | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0439 \u0432\u044b\u043f\u0443\u0441\u043a Exim.","og:url":"https:\/\/prohoster.info\/en\/blog\/news\/raskryty-podrobnosti-kriticheskoj-uyazvimosti-v-exim","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:20:17+00:00","article:modified_time":"2019-10-31T19:20:17+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37876","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 19:36:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:19:22","updated":"2026-01-23 19:36:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/37876","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=37876"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/37876\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=37876"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=37876"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=37876"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}