{"id":151908,"date":"2025-12-17T23:11:58","date_gmt":"2025-12-17T21:11:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/obnovlenie-pochtovogo-servera-exim-4-99-1-s-ustraneniem-uyazvimosti"},"modified":"2025-12-17T23:11:58","modified_gmt":"2025-12-17T21:11:58","slug":"obnovlenie-pochtovogo-servera-exim-4-99-1-s-ustraneniem-uyazvimosti","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/obnovlenie-pochtovogo-servera-exim-4-99-1-s-ustraneniem-uyazvimosti","title":{"rendered":"Postiserveri Exim 4.99.1 v\u00e4rskendus, mis k\u00f5rvaldab haavatavuse","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Avaldatud on Exim 4.99.1 meilirakenduse parandav v\u00e4ljaanne, milles on k\u00f5rvaldatud haavatavus (CVE-2025-67896), mis v\u00f5imaldab r\u00fcndajal kaugelt rikutud m\u00e4lu sisu. Probleem v\u00f5ib potentsiaalselt v\u00f5imaldada kaugtegevust serveris, kuid toimiva eksploodi jaoks pole seni ette valmistatud. <\/p>\n

Haavatavus esineb koodis, mis t\u00f6\u00f6tab sisemise andmebaasi (Hints DB) SQLite'i baasil, mis on m\u00f5eldud ajutiste andmete, s\u00f5numite edastamise oleku ja e-kirjade saatmise intensiivsuse teabe salvestamiseks. Probleem tuleneb asjaolust, et andmebaasi kirjed muundati otse sisemisse struktuuri «dbdata_ratelimit_unique» ilma n\u00f5uetekohase kontrollita. Tekkis olukord, kus loodi fikseeritud massiiv «bloom», mille suurus oli 40 baiti, ja v\u00e4lja «bloom_size», mis m\u00e4\u00e4rab massiivi elementide arvu, s\u00f5ltus andmete suurusest andmebaasis. R\u00fcndaja v\u00f5is korraldada kirjutamise v\u00e4ljapoole eraldatud puhverdusala, sisestades andmebaasi andmed (kasutades veel \u00fchte haavatavust), mille korral v\u00e4li «bloom_size» v\u00f5ttis v\u00e4\u00e4rtuse, mis oli selgelt suurem kui massiivi suurus. <\/p>\n

Probleem ilmneb Exim 4.99 ja 4.98.2 v\u00e4ljaannetes ning m\u00f5jutab ainult ACL ratelimit konfiguratsioone, kus kasutatakse parameetreid «unique» v\u00f5i «per_addr» (n\u00e4iteks «warn ratelimit = 100 \/ 1h \/ per_addr \/ $sender_address» v\u00f5i «warn ratelimit = 100 \/ 1h \/ per_rcpt \/ unique=$sender_address»). Lisaks peab Exim r\u00fcnnaku teostamiseks olema koostatud SQLite toe (USE_SQLITE=yes) selgelt m\u00e4\u00e4ratletud konfiguratsioonifailis (hints_database = sqlite). Haavatavas konfiguratsioonis, kui k\u00e4ivitada «exim -bV», kuvatakse «Hints DB: Using sqlite3». <\/p>\n

Suurtes distributsioonides on probleemsed versioonid kasutusel Debian 13, Ubuntu 25.10, SUSE\/openSUSE, Arch Linux, Fedora ja FreeBSD. RHEL ja selle derivatives ei ole probleemile vastuv\u00f5tlikud, kuna Exim ei kuulu nende p\u00f5hirepositoriumisse (EPEL-is pole Eximi paketi uuendust veel avaldatud). <\/p>\n

Samuti on tuvastatud uus vektor CVE-2025-26794 haavatavuse ekspluateerimiseks, mis likvideeriti Exim 4.98.1 veebruari v\u00e4ljaandes. Haavatavus v\u00f5imaldab SQL-koodi s\u00fcstimist sisemisse andmebaasi (Hints DB). Varasemalt lisatud paranduse k\u00e4igus ei olnud \u00fchekordseid t\u00fchikuid neutraalseks muudetud. N\u00e4ide MAIL FROM k\u00e4sust, mis p\u00f5hjustab SQL-koodi s\u00fcstimise: «MAIL FROM:<«x’\/**\/UNION\/**\/SELECT\/**\/X'<hex_blob>’—«@attacker.com>». Seda haavatavust saab kasutada alguspunktina, et luua tingimused \u00fclaltoodud puhver\u00fcletuse tekkimiseks.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0439 \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430 Exim 4.99.1, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-67896), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u043f\u043e\u0432\u0440\u0435\u0434\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043f\u0430\u043c\u044f\u0442\u0438 \u0432\u043d\u0435 \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0431\u0443\u0444\u0435\u0440\u0430. \u041f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435, \u043d\u043e \u0440\u0430\u0431\u043e\u0447\u0438\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u043f\u043e\u043a\u0430 \u043d\u0435 \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u043a\u043e\u0434\u0435 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0441 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0439 \u0411\u0414 (Hints DB) \u043d\u0430 \u0431\u0430\u0437\u0435 SQLite, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0439 \u0434\u043b\u044f \u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-151908","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Postiserveri Exim 4.99.1 v\u00e4rskendus haavatavuse k\u00f5rvaldamisega | ProHoster","description":"V\u00e4lja on antud Exim 4.99.1 postiserveri parandav versioon, milles on k\u00f5rvaldatud haavatavus (CVE-2025-67896), mis v\u00f5imaldab kaugseadmega r\u00fcndajal kahjustada m\u00e4lu sisu v\u00e4ljaspool eraldatud puhvrit. Probleemi saab potentsiaalselt kasutada kaugkoodi t\u00e4itmise jaoks serveris, kuid t\u00f6\u00f6tavat eksploitatsiooni ei ole veel v\u00e4ljat\u00f6\u00f6tatud. Haavatavus esineb koodis, mis t\u00f6\u00f6tleb sisemist andmebaasi (Hints DB), mis p\u00f5hineb SQLite-l ajutise salvestamiseks.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/obnovlenie-pochtovogo-servera-exim-4-99-1-s-ustraneniem-uyazvimosti","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430 Exim 4.99.1 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0439 \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430 Exim 4.99.1, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-67896), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u043f\u043e\u0432\u0440\u0435\u0434\u0438\u0442\u044c \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043f\u0430\u043c\u044f\u0442\u0438 \u0432\u043d\u0435 \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0431\u0443\u0444\u0435\u0440\u0430. \u041f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435, \u043d\u043e \u0440\u0430\u0431\u043e\u0447\u0438\u0439 \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u043f\u043e\u043a\u0430 \u043d\u0435 \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u043a\u043e\u0434\u0435 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0441 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0439 \u0411\u0414 (Hints DB) \u043d\u0430 \u0431\u0430\u0437\u0435 SQLite, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0439 \u0434\u043b\u044f \u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0439","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/obnovlenie-pochtovogo-servera-exim-4-99-1-s-ustraneniem-uyazvimosti","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-12-17T21:11:58+00:00","article:modified_time":"2025-12-17T21:11:58+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"151908","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-20 15:12:54","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-20 15:12:54","updated":"2026-01-20 15:12:54"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/151908","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=151908"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/151908\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=151908"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=151908"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=151908"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}