{"id":35011,"date":"2019-10-31T22:01:50","date_gmt":"2019-10-31T19:01:50","guid":{"rendered":"https:\/\/prohoster.info\/blog\/kriticheskaya-uyazvimost-v-exim-pozvolyayushhaya-vypolnit-kod-na-servere-s-pravami-root\/"},"modified":"2019-10-31T22:01:50","modified_gmt":"2019-10-31T19:01:50","slug":"kriticheskaya-uyazvimost-v-exim-pozvolyayushhaya-vypolnit-kod-na-servere-s-pravami-root","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/kriticheskaya-uyazvimost-v-exim-pozvolyayushhaya-vypolnit-kod-na-servere-s-pravami-root","title":{"rendered":"Kriitiline haavatavus Eximis, mis v\u00f5imaldab t\u00e4ita koodi serveris root \u00f5igustega","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Eximi postiserveris tuvastatud<\/a><\/noindex> kriitiline haavatavus<\/a><\/noindex> (CVE-2019-10149<\/a><\/noindex>), mis v\u00f5ib viia kaugkoodide t\u00e4itmisele serveris root \u00f5igustes, kui t\u00f6\u00f6deldakse spetsiaalselt vormindatud p\u00e4ringut. Probleemi v\u00e4ljendusv\u00f5imet on m\u00e4rgatud versioonides 4.87 kuni 4.91, sealhulgas v\u00f5i versioonide puhul, mis on koostatud EXPERIMENTAL_EVENT valikuga.<\/p>\n

Vaikimisi seadistustes v\u00f5ib r\u00fcnnak olla kohaliku kasutaja poolt teostatav h\u00f5lpsasti, kuna rakendatakse ACL 'verify = recipient', mis teeb t\u00e4iendavaid kontrollimisi v\u00e4listele aadressidele. Kaugr\u00fcnnak on v\u00f5imalik seadistuste muutmise korral, n\u00e4iteks t\u00f6\u00f6des teise domeeni sekundaarse MX rollis, ACL 'verify = recipient' eemaldamise v\u00f5i kohaliku osanime muudatuste korral. Kaugr\u00fcnnak on samuti v\u00f5imalik, kui kurjategija suudab hoida serveriga \u00fchendust avatud 7 p\u00e4eva jooksul (n\u00e4iteks saates \u00fche baitide minuti jooksul, et v\u00e4ltida katkestust ajutise katkestamise t\u00f5ttu). Samuti ei saa v\u00e4listada, et probleemide kaugkasutamiseks on lihtsamaid r\u00fcnnakuteed.<\/p>\n

Haavatavus on p\u00f5hjustatud vigasest adressaadi kontrollimisest funktsioonis deliver_message(), mis on m\u00e4\u00e4ratletud failis \/src\/deliver.c. Ahnuseraadios formateerimise manipuleerimise kaudu suudab r\u00fcndaja sisestada oma andmed k\u00e4skude argumentidesse, mida kutsutakse funktsiooni execv() kaudu root \u00f5igustes. Kasutamiseks ei ole vaja keerukate tehnikate rakendamist, mis on seotud puhversettide \u00fclev\u00e4litamise v\u00f5i m\u00e4lukahjustustega, piisab lihtsalt m\u00e4rkide sisestamisest. <\/p>\n

Probleem on seotud aadresside muutmise keelestruktuuride rakendamisega:<\/p>\n

deliver_localpart = expand_string(
\n string_sprintf('${local_part:%s}', new->address));
\n deliver_domain = expand_string(
\n string_sprintf('${domain:%s}', new->address));<\/p>\n

Funktsioon expand_string() on \u00fcleliia keeruline kombineeritud t\u00f6\u00f6tlus, sealhulgas k\u00e4su '${run{komanda argumendid}' tuvastamine, mis k\u00e4ivitab v\u00e4lise t\u00f6\u00f6tlija. Seega on SMTP-seansi raames kohaliku kasutaja jaoks piisav, et edastada k\u00e4sk vormingus 'RCPT TO '${username+${run{\u2026}}@localhost}', kus localhost on \u00fcks local_domains nimekirjas olevatest hostidest ja username on olemasoleva kohaliku kasutaja nimi. <\/p>\n

Kui server t\u00f6\u00f6tab postireleena, piisab kaugelt k\u00e4su edastamisest 'RCPT TO '${run{\u2026}}@relaydomain.com', kus relaydomain.com on \u00fcks hostidest, mis on loetletud relay_to_domains seadete sektsioonis. Kuna vaikimisi ei rakendata eximis privileegide t\u00fchistamise re\u017eiimi (deliver_drop_privilege = false), siis k\u00e4ideldakse k\u00e4skusid, mis edastatakse '${run{\u2026}}' kaudu root \u00f5igustes.<\/p>\n

T\u00e4htis on, et haavatavus oli eemaldatud<\/a><\/noindex> v\u00e4lja antud veebruaris versioonis 4.92 ilma sellele t\u00e4helepanu juhtimata, et parandamine v\u00f5ib tekitada turvaprobleeme. Pole p\u00f5hjusi arvata, et Eximi arendajad oleksid teadlikult haavatavust varjanud, kuna probleem raviti parandustele<\/a><\/noindex> viga, mis tekkis, kui edastati valeid aadresse, ja haavatavus avastati ettev\u00f5tte Qualys poolt Eximi muudatuste auditi k\u00e4igus. <\/p>\n

Parandus varasemate versioonide jaoks, mida j\u00e4tkuvalt kasutatakse jaotustes, on hetkel saadaval vaid pat\u0161<\/a><\/noindex>. Probleemide lahendamiseks kavandatud parandused vanadele versioonidele plaanitakse 11. juuniks. Pakettide v\u00e4rskendused on ette valmistatud Debian<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, openSUSE<\/a><\/noindex>. Arch Linuxis<\/a><\/noindex> ja Fedora<\/a><\/noindex> toodavad versioon 4.92, milles probleem ei esine. RHEL ja CentOS probleemile ei ole haavatavad<\/a><\/noindex>, kuna Exim ei kuulu nende tavap\u00e4rase paketiloendi hulka.<\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 Exim \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2019-10149), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0437\u0430\u043f\u0440\u043e\u0441\u0430. \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043e\u0442\u043c\u0435\u0447\u0435\u043d\u0430 \u0432 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 \u0441 4.87 \u043f\u043e 4.91 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0438\u043b\u0438 \u043f\u0440\u0438 \u0441\u0431\u043e\u0440\u043a\u0435 \u0441 \u043e\u043f\u0446\u0438\u0435\u0439 EXPERIMENTAL_EVENT. \u0412 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0430\u0442\u0430\u043a\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0430 \u0431\u0435\u0437 \u043b\u0438\u0448\u043d\u0438\u0445 \u0443\u0441\u043b\u043e\u0436\u043d\u0435\u043d\u0438\u0439 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-35011","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kriitiline haavatavus Eximis, mis v\u00f5imaldab k\u00e4ivitada koodi serveris root \u00f5igustes | ProHoster","description":"Eximi postiserveris avastati kriitiline haavatavus (CVE-2019-10149), mis v\u00f5ib viia kaugkoodide t\u00e4itmisele serveris root \u00f5igustes, kui t\u00f6\u00f6deldakse spetsiaalselt vormindatud p\u00e4ringut. Probleemi v\u00e4ljendusv\u00f5imet on m\u00e4rgatud versioonides 4.87 kuni 4.91, sealhulgas v\u00f5i versioonide puhul, mis on koostatud EXPERIMENTAL_EVENT valikuga. Vaikeseadistuses saab r\u00fcnnakut teha kohaliku kasutaja poolt","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/kriticheskaya-uyazvimost-v-exim-pozvolyayushhaya-vypolnit-kod-na-servere-s-pravami-root","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Exim, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root | ProHoster","og:description":"\u0412 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 Exim \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2019-10149), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0437\u0430\u043f\u0440\u043e\u0441\u0430. \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043e\u0442\u043c\u0435\u0447\u0435\u043d\u0430 \u0432 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 \u0441 4.87 \u043f\u043e 4.91 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0438\u043b\u0438 \u043f\u0440\u0438 \u0441\u0431\u043e\u0440\u043a\u0435 \u0441 \u043e\u043f\u0446\u0438\u0435\u0439 EXPERIMENTAL_EVENT. \u0412 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0430\u0442\u0430\u043a\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0430 \u0431\u0435\u0437 \u043b\u0438\u0448\u043d\u0438\u0445 \u0443\u0441\u043b\u043e\u0436\u043d\u0435\u043d\u0438\u0439 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c,","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/kriticheskaya-uyazvimost-v-exim-pozvolyayushhaya-vypolnit-kod-na-servere-s-pravami-root","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:01:50+00:00","article:modified_time":"2019-10-31T19:01:50+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"35011","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 21:28:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:11:30","updated":"2026-01-21 21:28:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/35011","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=35011"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/35011\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=35011"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=35011"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=35011"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}