{"id":38040,"date":"2019-10-31T22:21:20","date_gmt":"2019-10-31T19:21:20","guid":{"rendered":"https:\/\/prohoster.info\/blog\/propatchil-exim-propatch-eshhe-raz-svezhee-remote-command-execution-v-exim-4-92-v-odin-zapros\/"},"modified":"2021-02-01T11:37:46","modified_gmt":"2021-02-01T09:37:46","slug":"propatchil-exim-propatch-eshhe-raz-svezhee-remote-command-execution-v-exim-4-92-v-odin-zapros","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/propatchil-exim-propatch-eshhe-raz-svezhee-remote-command-execution-v-exim-4-92-v-odin-zapros","title":{"rendered":"Patched Exim \u2014 patch again. Fresh Remote Command Execution in Exim 4.92 in one request","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Patched<\/p>\n

Recently, at the beginning of summer, there were widespread calls to update Exim to version 4.92 due to the CVE-2019-10149 vulnerability (Urgently update exim to 4.92 \u2014 active infections ongoing \/ Habr<\/a><\/noindex>). It has recently been discovered that the malware Sustes decided to exploit this vulnerability.<\/p>\n

Now all those who updated urgently can once again \"rejoice\": on July 21, 2019, researcher Zerons discovered a critical vulnerability in the Exim Mail Transfer Agent (MTA) when using TLS<\/strong> for versions from 4.80 to 4.92.1<\/strong> inclusive, allowing remote code execution with privileged rights<\/strong> (CVE-2019-15846<\/a><\/noindex>).<\/p>\n

<\/a><\/noindex><\/p>\n

The vulnerability<\/h3>\n

The vulnerability exists when using both GnuTLS and OpenSSL libraries when establishing a secure TLS connection.<\/p>\n

According to developer Heiko Schlittermann, the Exim configuration file by default does not use TLS, but many distributions create the necessary certificates during installation and include a secure connection. Also, newer versions of Exim set the option tls_advertise_hosts=*<\/em> and generate the necessary certificates.<\/p>\n

depends on the configuration. Most distros enable it by default, but Exim needs a certificate+key to work as a TLS server. Probably distros create a cert during setup. Newer Exims have the tls_advertise_hosts option defaulting to \"*\" and create a self-signed certificate if none is provided.<\/p><\/blockquote>\n

The vulnerability itself lies in the incorrect handling of SNI (Server Name Indication, a technology introduced in 2003 in RFC 3546 to request the correct certificate for the domain name from the client, TLS SNI standard dissemination \/ WEBO Group Blog \/ Habr<\/a><\/noindex>) during the TLS handshake. An attacker only needs to send an SNI ending with a backslash (\"\") and a null character (\"\").<\/p>\n

Researchers at Qualys discovered a bug in the string_printing(tls_in.sni) function, which involves incorrect escaping of \"\". As a result, a backslash is recorded in unescaped form in the print spool header file. Then this file, with privileged rights, is read by the spool_read_header() function, leading to a heap overflow.<\/p>\n

It's worth noting that currently Exim developers have created a PoC for the vulnerability with command execution on a remote vulnerable server, but it is not publicly available yet. Due to the ease of exploiting the bug, it\u2019s only a matter of time, and quite a short one at that.<\/strong><\/p>\n

A more detailed investigation of the company Qualys can be found. here<\/a><\/noindex>.<\/p>\n

\"Patched<\/p>\n

Use of SNI in TLS<\/em><\/p>\n

Number of potentially vulnerable public servers<\/h3>\n

According to statistics from a major hosting provider E-Soft Inc<\/strong> as of September 1, version 4.92 is used on more than 70% of rented servers.<\/p>\n

Version
\nNumber of Servers
\nPercent<\/p>\n

4.92.1
\n6471
\n1.28%<\/p>\n

4.92<\/strong>
\n376436<\/strong>
\n74.22%<\/strong><\/p>\n

4.91
\n58179
\n11.47%<\/p>\n

4.9
\n5732
\n1.13%<\/p>\n

4.89
\n10700
\n2.11%<\/p>\n

4.87
\n14177
\n2.80%<\/p>\n

4.84
\n9937
\n1.96%<\/p>\n

Other versions
\n25568
\n5.04%<\/p>\n

Statistics from E-Soft Inc<\/em><\/p>\n

If you turn to the search engine Shodan<\/strong><\/a><\/noindex>, out of 5,250,000 in the server database:<\/p>\n