{"id":151908,"date":"2025-12-17T23:11:58","date_gmt":"2025-12-17T21:11:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/obnovlenie-pochtovogo-servera-exim-4-99-1-s-ustraneniem-uyazvimosti"},"modified":"2025-12-17T23:11:58","modified_gmt":"2025-12-17T21:11:58","slug":"obnovlenie-pochtovogo-servera-exim-4-99-1-s-ustraneniem-uyazvimosti","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/obnovlenie-pochtovogo-servera-exim-4-99-1-s-ustraneniem-uyazvimosti","title":{"rendered":"Postiserveri Exim 4.99.1 uuendus, mis k\u00f5rvaldab haavatavuse.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V\u00e4lja antud korrigeeritud versioon e-posti serverist Exim 4.99.1, kus on k\u00f5rvaldatud haavatavus (CVE-2025-67896), mis v\u00f5imaldab kaugpiiratud r\u00fcndajal h\u00e4vitada m\u00e4lus sisu v\u00e4ljaspool reserveeritud puhverserverit. Potentsiaalselt v\u00f5ib probleem v\u00f5imaldada koodijooksu serveris, kuid toimivat ekspluateerimist pole veel ette valmistatud. <\/p>\n

Haavatavus on olemas koodis, mis t\u00f6\u00f6tab koos sise andmebaasiga (Hints DB), mis p\u00f5hineb SQLite'il ja mida kasutatakse ajutise teabe, s\u00f5numite kohaletoimetamise oleku ja postituste intensiivsuse andmete salvestamiseks. Probleem tuleneb sellest, et andmebaasi salvestused muundati otse sisemise struktuuri «dbdata_ratelimit_unique» ilma n\u00f5uetekohase kontrollita. Tekkis olukord, kus loodi fikseeritud massiiv «bloom», suurusega 40 baiti, ning v\u00e4lja «bloom_size», mis m\u00e4\u00e4rab massiivi elementide arvu, s\u00f5ltus andmete suurusest andmebaasis. R\u00fcndaja v\u00f5is korraldada kirjutamise v\u00e4ljapoole eraldatud puhver, sisestades andmebaasi andmeid (kasutades veel \u00fchte haavatavust), mille puhul «bloom_size» v\u00f5ttis v\u00e4\u00e4rtuse, mis oli selgelt suurem kui massiivi suurus. <\/p>\n

Probleem ilmneb versioonides Exim 4.99 ja 4.98.2 ning puudutab ainult ACL ratelimit konfigureerimisi, kus kasutatakse parameetreid «unique» v\u00f5i «per_addr» (n\u00e4iteks «warn ratelimit = 100 \/ 1h \/ per_addr \/ $sender_address» v\u00f5i «warn ratelimit = 100 \/ 1h \/ per_rcpt \/ unique=$sender_address»). Lisaks peab r\u00fcnnaku sooritamiseks olema Exim koostatud SQLite'i toetusega (USE_SQLITE=yes), mis on aktiveeritud konfigureerimisfailis (hints_database = sqlite). Haavatavates konfiguratsioonides annab «exim -bV» k\u00e4ivitamisel tulemuseks «Hints DB: Using sqlite3». <\/p>\n

Probleemsed versioonid on kasutusel suuremates distributsioonides nagu Debian 13, Ubuntu 25.10, SUSE\/openSUSE, Arch Linux, Fedora ja FreeBSD. RHEL ja selle derivaadid ei ole probleemile vastuv\u00f5tlikud, kuna Exim ei kuulu nende ametlikku pakettide reposi (EPEL-is ei ole Eximi paketi v\u00e4rskendust veel avaldatud). <\/p>\n

Samuti on tuvastatud uus vektor haavatavuse CVE-2025-26794, mis likvideeriti veebruari v\u00e4ljaandes Exim 4.98.1, \u00e4rakasutamiseks. Haavatavus v\u00f5imaldab SQL-koodi s\u00fcstimist sise andmebaasi (Hints DB). Varasemalt lisatud parandused ei v\u00e4listanud \u00fchekordseid tsitaate. N\u00e4ide k\u00e4sklusest MAIL FROM, mis toob esile SQL-koodi s\u00fcstimise: «MAIL FROM:<«x’\/**\/UNION\/**\/SELECT\/**\/X'<hex_blob>’—«@attacker.com>». Seda haavatavust saab kasutada alguslingina, et luua tingimusi eespool kirjeldatud puhver \u00fcleujutuse tekkimiseks.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0439 \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430 Exim 4.99.1, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-67896), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u043f\u043e\u0432\u0440\u0435\u0434\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043f\u0430\u043c\u044f\u0442\u0438 \u0432\u043d\u0435 \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0431\u0443\u0444\u0435\u0440\u0430. \u041f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435, \u043d\u043e \u0440\u0430\u0431\u043e\u0447\u0438\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u043f\u043e\u043a\u0430 \u043d\u0435 \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u043a\u043e\u0434\u0435 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0441 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0439 \u0411\u0414 (Hints DB) \u043d\u0430 \u0431\u0430\u0437\u0435 SQLite, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0439 \u0434\u043b\u044f \u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-151908","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Postiserveri Exim 4.99.1 uuendus haavatavuse k\u00f5rvaldamisega | ProHoster","description":"On avaldatud korrigeeritud v\u00e4ljaanne Exim 4.99.1 postiserverist, milles on k\u00f5rvaldatud haavatavus (CVE-2025-67896), mis v\u00f5imaldab kaugtungijatel m\u00e4lu sisu kahjustada v\u00e4ljaspool eraldatud puhvrit.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/obnovlenie-pochtovogo-servera-exim-4-99-1-s-ustraneniem-uyazvimosti","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430 Exim 4.99.1 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0439 \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430 Exim 4.99.1, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-67896), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u043f\u043e\u0432\u0440\u0435\u0434\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043f\u0430\u043c\u044f\u0442\u0438 \u0432\u043d\u0435 \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0431\u0443\u0444\u0435\u0440\u0430.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/obnovlenie-pochtovogo-servera-exim-4-99-1-s-ustraneniem-uyazvimosti","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-12-17T21:11:58+00:00","article:modified_time":"2025-12-17T21:11:58+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"151908","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-20 15:12:54","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-20 15:12:54","updated":"2026-01-20 15:12:54","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/151908","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=151908"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/151908\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=151908"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=151908"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=151908"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}