{"id":37876,"date":"2019-10-31T22:20:17","date_gmt":"2019-10-31T19:20:17","guid":{"rendered":"https:\/\/prohoster.info\/blog\/raskryty-podrobnosti-kriticheskoj-uyazvimosti-v-exim\/"},"modified":"2019-10-31T22:20:17","modified_gmt":"2019-10-31T19:20:17","slug":"raskryty-podrobnosti-kriticheskoj-uyazvimosti-v-exim","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/raskryty-podrobnosti-kriticheskoj-uyazvimosti-v-exim","title":{"rendered":"Kriitilise haavatavuse \u00fcksikasjad Eximis on avalikustatud","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Avaldatud<\/a><\/noindex> korrektsiooniv\u00e4ljaanne Exim 4.92.2<\/a><\/noindex> h\u00e4daga kriitiline haavatavusest<\/a><\/noindex> (CVE-2019-15846<\/a><\/noindex>), mis vaikekonfiguratsioonis v\u00f5ib viia kaugk\u00e4ivitatud koodi t\u00e4ideviimiseni r\u00fcndaja poolt root \u00f5igustega. Probleem ilmneb ainult TLS toe lubamisel ja seda \u00e4rakasutatakse spetsiaalselt vormindatud kliendisertifikaadi v\u00f5i muudetud SNI v\u00e4\u00e4rtuse edastamise kaudu. Haavatavus tuvastatud<\/a><\/noindex> ettev\u00f5tte Qualys.<\/p>\n

Probleem on olemas<\/a><\/noindex> eraldi s\u00fcmbolite eristamise t\u00f6\u00f6tlejas (string_interpret_escape()<\/a><\/noindex> on string.c) ja see on tingitud sellest, et s\u00fcmbol ‘\’ rea l\u00f5pus t\u00f5lgendatakse nulls\u00fcmboli (‘\0’) ees ja pahatihti see varjab seda. Varjamise korral t\u00f5lgendatakse j\u00e4rjestus ‘\’ ja j\u00e4rgnev nullkood rea l\u00f5pus \u00fche s\u00fcmbolina ning n\u00e4itaja nihkub andmetesse, mis asuvad reast v\u00e4ljaspool ja t\u00f5lgendatakse nende j\u00e4tkuna. <\/p>\n

Kood, mis kutsub esile string_interpret_escape(), eraldab puhvri voolu p\u00f5hjal tegelikku suurust, ja m\u00e4\u00e4ratud n\u00e4idik satub puhvri piiridest v\u00e4ljapoole. Seet\u00f5ttu, kui sisendstringi t\u00f6\u00f6deldakse, tekib olukord, kus andmeid loetakse eraldatud puhvri piiridest v\u00e4ljapoole, ja dekodeeritud stringi kirjutamise katsed v\u00f5ivad viia kirjutamiseni puhvri \u00fcle.<\/p>\n

Vaikimisi seadistustes saab haavatavust \u00e4ra kasutada, edastades spetsiaalselt vormindatud andmeid SNI kaudu, kui luuakse turvaline \u00fchendus serveriga. Probleemi saab samuti \u00e4ra kasutada, muutes peerdn v\u00e4\u00e4rtusi konfiguratsioonides, mis on seadistatud kliendi sertifikaadi autentimiseks, v\u00f5i sertifikaatide importimisel. R\u00fcnnak SNI ja peerdn kaudu on v\u00f5imalik alates v\u00e4ljalaskest Exim 4.80<\/a><\/noindex>, kus funktsioon string_unprinting() kasutati peerdn ja SNI sisu dekodeerimiseks.<\/p>\n

SNI r\u00fcnnaku jaoks on valmistatud t\u00f5end, mis t\u00f6\u00f6tab i386 ja amd64 arhitektuuridel Linuxi s\u00fcsteemides, millel on Glibc. T\u00f5endis kasutatakse andmete kattumist heap'i alal, mis viib m\u00e4lu kirjutamiseni, kus hoitakse logifaili nime. Logifaili nimi asendatakse v\u00e4\u00e4rtusega «\/..\/..\/..\/..\/..\/..\/..\/..\/etc\/passwd». Edasi kirjutatakse \u00fcmber muutujad, kus hoitakse saatja aadressi, mis salvestatakse esimesena logisse, v\u00f5imaldades seel\u00e4bi lisada s\u00fcsteemi uue kasutaja. <\/p>\n

Pakettide uuendused, mis lahendavad haavatavuse, on v\u00e4lja andnud distributsioonid Debian<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, Fedora<\/a><\/noindex>, SUSE\/openSUSE<\/a><\/noindex> ja FreeBSD<\/a><\/noindex>. RHEL ja CentOS probleemile ei ole haavatavad<\/a><\/noindex>, kuna Exim ei kuulu nende ametlikku paketirepositooriumi ( EPEL<\/a><\/noindex> uuendus juba<\/a><\/noindex> on loodud<\/a><\/noindex>, kuid hetkel ei ole paigutatud<\/a><\/noindex> avalikku repositooriumisse). Eximi koodis lahendatakse probleem \u00fche rea patch<\/a><\/noindex>, mis keelab tagurpidi kaldkriipsu p\u00f5him\u00f5tte, kui see on rea l\u00f5pus.<\/p>\n

K\u00e4itumise \u00fcmberminekuks haavatavuse blokeerimiseks v\u00f5ib v\u00e4lja l\u00fclitada TLS toe v\u00f5i lisada
\nACL sektsioon «acl_smtp_mail»:\n<\/p>\n

keelatud tingimus = ${if eq{\\}{${substr{-1}{1}{$tls_in_sni}}}}
\n keelatud tingimus = ${if eq{\\}{${substr{-1}{1}{$tls_in_peerdn}}}}<\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0439 \u0432\u044b\u043f\u0443\u0441\u043a Exim 4.92.2 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2019-15846), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u0440\u0438 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 TLS \u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u043e\u0433\u043e \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 \u0438\u043b\u0438 \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0432 SNI. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Qualys. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0435 \u044d\u043a\u0440\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u043f\u0435\u0446\u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-37876","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kriitilise haavatavuse \u00fcksikasjad Exim'is | ProHoster","description":"Avaldati Eximi parandav v\u00e4ljaanne.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/raskryty-podrobnosti-kriticheskoj-uyazvimosti-v-exim","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Exim | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0439 \u0432\u044b\u043f\u0443\u0441\u043a Exim.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/raskryty-podrobnosti-kriticheskoj-uyazvimosti-v-exim","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:20:17+00:00","article:modified_time":"2019-10-31T19:20:17+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37876","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 19:36:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:19:22","updated":"2026-01-23 19:36:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/37876","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=37876"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/37876\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=37876"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=37876"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=37876"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}