{"id":35011,"date":"2019-10-31T22:01:50","date_gmt":"2019-10-31T19:01:50","guid":{"rendered":"https:\/\/prohoster.info\/blog\/kriticheskaya-uyazvimost-v-exim-pozvolyayushhaya-vypolnit-kod-na-servere-s-pravami-root\/"},"modified":"2019-10-31T22:01:50","modified_gmt":"2019-10-31T19:01:50","slug":"kriticheskaya-uyazvimost-v-exim-pozvolyayushhaya-vypolnit-kod-na-servere-s-pravami-root","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/kriticheskaya-uyazvimost-v-exim-pozvolyayushhaya-vypolnit-kod-na-servere-s-pravami-root","title":{"rendered":"Kriitiline haavatavus Eximis, mis v\u00f5imaldab k\u00e4ivitada koodi serveris root \u00f5igustega","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Eximi posti server tuvastatud<\/a><\/noindex> kriitiline haavatavus<\/a><\/noindex> (CVE-2019-10149<\/a><\/noindex>), mis v\u00f5ib viia koodi kaugse t\u00e4itmiseni serveris root \u00f5igustes spetsiaalselt vormindatud p\u00e4ringu t\u00f6\u00f6tlemisel. Probleemi \u00e4rakasutamise v\u00f5imalust on m\u00e4rgitud versioonides 4.87 kuni 4.91, sealhulgas v\u00f5i versioonide kogumisel EXPERIMENTAL_EVENT v\u00f5imalusega.<\/p>\n

Vaikese seadistuse korral v\u00f5ib r\u00fcnnak toimuda ilma liigsete keerukusteta kohalikult kasutajalt, kuna rakendatakse ACL «verify = recipient», mis teostab t\u00e4iendavaid kontrolle v\u00e4liste aadresside jaoks. Kaugr\u00fcnnaku sooritamine on v\u00f5imalik seadete muutmise korral, n\u00e4iteks t\u00f6\u00f6tades teise domeeni sekundaarse MX-na, eemaldades ACL «verify = recipient» v\u00f5i tehes teatud muudatusi local_part_suffix. Kaugr\u00fcnnak on samuti v\u00f5imalik, kui kurjategija suudab serveriga \u00fchendust h\u00f5ivata 7 p\u00e4eva jooksul (n\u00e4iteks edastades \u00fche bait iga minuti jooksul ajutise katkestamise v\u00e4ltimiseks). Samas ei saa v\u00e4listada, et kaugkasutamiseks v\u00f5ivad eksisteerida ka lihtsamad r\u00fcnnakuvektorid.<\/p>\n

Haavatavus tuleneb saaja aadressi vale kontrollimise t\u00f5ttu funktsioonis deliver_message(), mis on m\u00e4\u00e4ratletud failis \/src\/deliver.c. Aadressi vormindamise manipuleerimise kaudu saab r\u00fcndaja oma andmeid sisestada juur\u00f5igustega execv() funktsiooni kaudu kutsutud k\u00e4su argumentidesse. T\u00f5rke \u00e4rakasutamiseks ei ole vajalik keerukate tehnikate rakendamine, mis on seotud puut\u00fckkide \u00fclevoolu v\u00f5i m\u00e4lu kahjustamisega, piisab lihtsalt s\u00fcmbolite sisestamisest. <\/p>\n

Probleem on seotud aadresside muutmiseks konstruktsiooni rakendamisega:<\/p>\n

deliver_localpart = expand_string(
\n string_sprintf(«${local_part:%s}», new->address));
\n deliver_domain = expand_string(
\n string_sprintf(«${domain:%s}», new->address));<\/p>\n

Funktsioon expand_string() on \u00fclekeeruline kombain, mis tuvastab ka k\u00e4sku «${run{k\u00e4sk argumendid}», mis k\u00e4ivitab v\u00e4lise t\u00f6\u00f6tleja. Seega piisab SMTP-seansi raames kohalikule kasutajale, kui edastada k\u00e4sk kujul ‘RCPT TO «username+${run{…}}@localhost»‘, kus localhost on \u00fcks local_domains loendist ja username on olemasoleva kohaliku kasutaja nimi. <\/p>\n

Kui server toimib postiserverina, piisab, kui kaugelt saata k\u00e4sk ‘RCPT TO «${run{…}}@relaydomain.com»‘, kus relaydomain.com on \u00fcks hostidest, mis on loetletud relay_to_domains seadete sektsioonis. Kuna vaikimisi ei rakendata eximis privileegide t\u00fchistamise re\u017eiimi (deliver_drop_privilege = false), siis k\u00e4ivitatakse l\u00e4bi «${run{…}}» saadetud k\u00e4sud root-i \u00f5igustes.<\/p>\n

Oluline on m\u00e4rkida, et haavatavus esines on k\u00f5rvaldatud<\/a><\/noindex> v\u00e4ljaandmisel veebruaris 4.92, mitte p\u00f6\u00f6rates t\u00e4helepanu sellele, et parandamine v\u00f5ib tekitada turvaprobleeme. Ei ole alust arvata, et Eximi arendajad kikitasid teadlikult haavatavust, kuna probleem lahendati parandus<\/a><\/noindex> probleemi k\u00e4igus, mis tekkis vale aadresside edastamisel, ja haavatavuse avastas Qualys saatel Eximi muudatusi. <\/p>\n

Parandus vanadele versioonidele, mis j\u00e4tkuvad jaotustes, on seni saadaval ainult kujul patch<\/a><\/noindex>. Parandavaid v\u00e4ljalaskmisi vanadele harudele probleemide lahendamiseks on plaanitud 11. juuniks. Pakettide uuendused on ette valmistatud Debian<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, openSUSE<\/a><\/noindex>. Arch Linux<\/a><\/noindex> ja Fedora<\/a><\/noindex> toovad versiooni 4.92, kus probleem ei esine. RHEL ja CentOS probleem ei esine<\/a><\/noindex>, kuna Exim ei kuulu nende vaikimisi pakettide hoidlasse.<\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 Exim \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2019-10149), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0437\u0430\u043f\u0440\u043e\u0441\u0430. \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043e\u0442\u043c\u0435\u0447\u0435\u043d\u0430 \u0432 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 \u0441 4.87 \u043f\u043e 4.91 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0438\u043b\u0438 \u043f\u0440\u0438 \u0441\u0431\u043e\u0440\u043a\u0435 \u0441 \u043e\u043f\u0446\u0438\u0435\u0439 EXPERIMENTAL_EVENT. \u0412 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0430\u0442\u0430\u043a\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0430 \u0431\u0435\u0437 \u043b\u0438\u0448\u043d\u0438\u0445 \u0443\u0441\u043b\u043e\u0436\u043d\u0435\u043d\u0438\u0439 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-35011","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kriitiline haavatavus Eximis, mis v\u00f5imaldab k\u00e4ivitada koodi serveris root \u00f5igustes | ProHoster","description":"Eximis on tuvastatud kriitiline","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/kriticheskaya-uyazvimost-v-exim-pozvolyayushhaya-vypolnit-kod-na-servere-s-pravami-root","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Exim, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root | ProHoster","og:description":"\u0412 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 Exim \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/kriticheskaya-uyazvimost-v-exim-pozvolyayushhaya-vypolnit-kod-na-servere-s-pravami-root","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:01:50+00:00","article:modified_time":"2019-10-31T19:01:50+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"35011","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 21:28:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:11:30","updated":"2026-01-21 21:28:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/35011","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=35011"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/35011\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=35011"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=35011"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=35011"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}