{"id":71318,"date":"2020-02-25T07:34:19","date_gmt":"2020-02-25T04:34:19","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimosti-v-opensmtpd-pozvolyayushhie-udalyonno-i-lokalno-poluchit-prava-root"},"modified":"2020-03-03T16:10:53","modified_gmt":"2020-03-03T13:10:53","slug":"uyazvimosti-v-opensmtpd-pozvolyayushhie-udalyonno-i-lokalno-poluchit-prava-root","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimosti-v-opensmtpd-pozvolyayushhie-udalyonno-i-lokalno-poluchit-prava-root","title":{"rendered":"Vulnerabilities in OpenSMTPD allow remote and local root access","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Qualys Company has identified<\/a><\/noindex> yet another remote critical vulnerability (CVE-2020-8794) in the mail server OpenSMTPD<\/a><\/noindex>, developed by the OpenBSD project. Like the one discovered at the end of January vulnerability<\/a><\/noindex>, this new issue allows for arbitrary shell commands to be executed remotely on the server with root user privileges. The vulnerability has been closed<\/a><\/noindex> in the release OpenSMTPD 6.6.4p1<\/a><\/noindex>. <\/p>\n

stems from an error in the code responsible for delivering mail to a remote mail server (not in the code handling incoming connections). The attack can occur on both the client and server sides. On the client side, the attack is possible in the default OpenSMTPD configuration, where OpenSMTPD only accepts requests on the internal network interface (localhost) and sends emails to external servers. To exploit the vulnerability, it is sufficient for OpenSMTPD to establish a session with a mail server controlled by the attacker during the delivery of an email, or for the attacker to intercept the client connection (MITM or redirection during attacks via DNS or BGP).<\/p>\n

For a server-side attack, OpenSMTPD must be configured to accept external network requests from other mail servers or serve third-party services that allow sending requests to arbitrary email addresses (for example, address confirmation forms on websites). For instance, an attacker can connect to the OpenSMTPD server and send an incorrect email (to a non-existent user), which will result in a bounced email being sent back to the attacker's server with an error code. The attacker can exploit the vulnerability at the moment when OpenSMTPD connects to deliver a notification to the attacker's server. The injected shell commands during the attack are placed in a file that executes with root privileges upon the restart of OpenSMTPD, so the attacker must wait for OpenSMTPD to restart or initiate a crash of OpenSMTPD.<\/p>\n

The issue exists in the mta_io() function in the code for parsing the multiline response returned by the remote server after the connection is established (for example, \"250-ENHANCEDSTATUSCODES\" and \"250 HELP\"). In OpenSMTPD, it is expected that the first line contains a three-digit number and text separated by the \"-\" character, while the second line has a three-digit number and text separated by a space. If there is no space and text following the three-digit number in the second line, the pointer used to determine the text is set to the byte following the character '\\0' and an attempt is made to copy the data into the buffer following the end of the line.<\/p>\n

At the request of the OpenBSD project, the publication of details regarding the vulnerability exploitation has been postponed until February 26 to give users the opportunity to update their systems. The issue has been present in the codebase since December 2015, but exploitation to execute code with root privileges has been possible since May 2018. Researchers have prepared a working prototype of the exploit, which has been successfully tested in OpenSMTPD builds for OpenBSD 6.6, OpenBSD 5.9, Debian 10, Debian 11 (testing), and Fedora 31. <\/p>\n

In OpenSMTPD, there is also identified<\/a><\/noindex> another vulnerability (CVE-2020-8793) that allows a local user to read the first line of any file in the system. For example, one can read the first line of \/etc\/master.passwd, which contains the hash of the root user's password. The vulnerability also allows reading the entire content of a file owned by another user if that file is in the same filesystem as the \/var\/spool\/smtpd\/ directory. The problem is not exploitable in many Linux distributions where the value of \/proc\/sys\/fs\/protected_hardlinks is set to 1. <\/p>\n

The issue is the result of incomplete remediation issues<\/a><\/noindex>, mentioned in the audit conducted by Qualys in 2015. An attacker can achieve code execution with the privileges of the group \"_smtpq\" by setting the variable \"PATH=.\" and placing a script named makemap in the current directory (the smtpctl utility runs makemap without explicitly specifying a path). Once access to the group \"_smtpq\" is obtained, the attacker can trigger a race condition (create a large file in the offline directory and send a SIGSTOP signal) and, before the processing is completed, replace the file in the offline directory with a hard symbolic link pointing to the target file whose contents need to be read.<\/p>\n

Notably, in Fedora 31, the vulnerability allows immediate acquisition of root group privileges, as the smtpctl process is equipped with the setgid root flag instead of setgid smtpq. Gaining access to the root group enables overwriting the contents of \/var\/lib\/sss\/mc\/passwd and obtaining full root access to the system.<\/p>\n

<\/a><\/noindex><\/p>\n

Source: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0435\u0449\u0451 \u043e\u0434\u043d\u0443 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u0443\u044e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-8794) \u0432 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 OpenSMTPD, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u043e\u043c \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c OpenBSD. \u041a\u0430\u043a \u0438 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u0430\u044f \u0432 \u043a\u043e\u043d\u0446\u0435 \u044f\u043d\u0432\u0430\u0440\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043d\u043e\u0432\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0434\u0430\u0451\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b shell \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f root. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0435 OpenSMTPD 6.6.4p1. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043e\u0448\u0438\u0431\u043a\u043e\u0439 \u0432 \u043a\u043e\u0434\u0435, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u044e\u0449\u0435\u043c \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0443 \u043f\u043e\u0447\u0442\u044b \u043d\u0430 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u044b\u0439 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-71318","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilities in OpenSMTPD that allow remote and local acquisition of root rights | ProHoster","description":"Qualys has identified another critical remote vulnerability (CVE-2020-8794) in the mail server.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimosti-v-opensmtpd-pozvolyayushhie-udalyonno-i-lokalno-poluchit-prava-root","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 OpenSMTPD, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0438 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0435\u0449\u0451 \u043e\u0434\u043d\u0443 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u0443\u044e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-8794) \u0432 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435.","og:url":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimosti-v-opensmtpd-pozvolyayushhie-udalyonno-i-lokalno-poluchit-prava-root","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-25T04:34:19+00:00","article:modified_time":"2020-03-03T13:10:53+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"71318","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:04:24","updated":"2022-09-28 08:07:40","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/71318","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=71318"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/71318\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=71318"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=71318"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=71318"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}