{"id":37876,"date":"2019-10-31T22:20:17","date_gmt":"2019-10-31T19:20:17","guid":{"rendered":"https:\/\/prohoster.info\/blog\/raskryty-podrobnosti-kriticheskoj-uyazvimosti-v-exim\/"},"modified":"2019-10-31T22:20:17","modified_gmt":"2019-10-31T19:20:17","slug":"raskryty-podrobnosti-kriticheskoj-uyazvimosti-v-exim","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/raskryty-podrobnosti-kriticheskoj-uyazvimosti-v-exim","title":{"rendered":"Avalikustatud on kriitilise haavatavuse \u00fcksikasjad Eximis","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Avaldatud<\/a><\/noindex> parandusversioon Exim 4.92.2<\/a><\/noindex> kriitilise k\u00f5rvaldamisega haavatavuse<\/a><\/noindex> (CVE-2019-15846<\/a><\/noindex>), mis vaikimisi seadistuses v\u00f5ib viia sissetungija koodi kaugk\u00e4itamiseni root \u00f5igustes. Probleem ilmneb ainult TLS toe lubamisel ja seda on v\u00f5imalik \u00e4ra kasutada spetsiaalselt vormistatud kliendisertifikaadi v\u00f5i muudetud SNI v\u00e4\u00e4rtuse edastamise kaudu. Haavatavus tuvastatud<\/a><\/noindex> on avastatud Qualys'i poolt.<\/p>\n

Probleem ainult hiina keeles.<\/a><\/noindex> erim\u00e4rgete v\u00e4ga muutmise t\u00f6\u00f6tlejas (string_interpret_escape()<\/a><\/noindex> juurest string.c) ja on p\u00f5hjustatud sellest, et s\u00fcmbol ‘\’ rea l\u00f5pus t\u00f5lgendatakse enne nullm\u00e4rki (‘\0’) ja selleks, et see tuleks v\u00e4lja. P\u00f5genemisel t\u00f5lgendatakse j\u00e4rjestus ‘\’ ja sellele j\u00e4rgnev nullkood rea l\u00f5pus \u00fcheks s\u00fcmboliks ning n\u00e4itaja nihkub andmetele, mis on rea j\u00e4tk, ja need t\u00f6\u00f6deldakse edasi. <\/p>\n

string_interpret_escape() kutsuv kood eraldab puhvri voolu p\u00f5hjal tegelikku suurust, ja seatud p\u00f6\u00f6rdus satub puhvri piirest v\u00e4ljapoole. Vastavalt sellele, kui sisendi rida t\u00f6\u00f6deldakse, tekib olukord, kus andmete lugemine toimub m\u00e4\u00e4ratud puhvri vahelt, ja katsed salvestada dekodeeritud rida v\u00f5ivad viia puhvri piirest v\u00e4ljapoole salvestamiseni.<\/p>\n

Vaikimisi seadistuses on haavatavus v\u00f5imalik \u00e4ra kasutada edastades spetsiaalselt vormistatud andmeid SNI kaudu turvalise \u00fchenduse loomisel serveriga. Probleem v\u00f5ib samuti olla \u00e4ra kasutatud peerdn v\u00e4\u00e4rtuste muutmise kaudu konfigureerimistes, mis on \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043d\u044b kliendi sertifikaadi autentimiseks, v\u00f5i sertifikaatide importimisel. R\u00fcnnak SNI ja peerdn kaudu on v\u00f5imalik alates versioonist Exim 4.80<\/a><\/noindex>, kus funktsiooni string_unprinting() rakendati peerdn ja SNI sisu d\u00e9codeerimiseks.<\/p>\n

SNI r\u00fcnnaku jaoks on valmis prototype eksploit, mis t\u00f6\u00f6tab i386 ja amd64 arhitektuuridel Linuxi s\u00fcsteemides Glibc'ga. Eksploit kasutab andmete kattumist m\u00e4lu piirkonnas, mis viib logifaili nimi \u00fcle kirjutamiseni. Failinime asendatakse «\\\/..\\\/..\\\/..\\\/..\\\/..\\\/..\\\/..\\\/..\\\/etc\\\/passwd». Edasi kirjutatakse muutuja saatja aadressiga, mis salvestatakse esimesena logisse, v\u00f5imaldades lisada uus kasutaja s\u00fcsteemi. <\/p>\n

Pakettide v\u00e4rskendused turvaaukude parandamisega on v\u00e4lja antud distributsioonides Debian<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, Fedora<\/a><\/noindex>, SUSE\/openSUSE<\/a><\/noindex> ja FreeBSD<\/a><\/noindex>. RHEL ja CentOS probleemile ei esine<\/a><\/noindex>, kuna Exim ei kuulu nende ametlikku pakettide hoidlasse (seal EPEL<\/a><\/noindex> uuendust juba<\/a><\/noindex> on loodud<\/a><\/noindex>, kuid praegu ei ole lisatud<\/a><\/noindex> avalikku hoidlasse). Eximi koodis lahendatakse probleem \u00fchetasemelise patchiga<\/a><\/noindex>, mis keelab tagaslaidi ekraani toimingu, kui see on rea l\u00f5pus.<\/p>\n

Ahnusev\u00e4simuse v\u00e4ltimiseks v\u00f5ib haavatavuse blokeerimiseks v\u00e4lja l\u00fclitada TLS-i toe v\u00f5i lisada
\nACL sektsioon «acl_smtp_mail»:\n<\/p>\n

keelatud tingimus = ${if eq{\\}{${substr{-1}{1}{$tls_in_sni}}}}
\n keelatud tingimus = ${if eq{\\}{${substr{-1}{1}{$tls_in_peerdn}}}}<\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0439 \u0432\u044b\u043f\u0443\u0441\u043a Exim 4.92.2 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2019-15846), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u0440\u0438 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 TLS \u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u043e\u0433\u043e \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 \u0438\u043b\u0438 \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0432 SNI. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Qualys. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0435 \u044d\u043a\u0440\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u043f\u0435\u0446\u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-37876","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Kriitilise haavatavuse \u00fcksikasjad on paljastatud Eximis | ProHoster","description":"Parandusv\u00e4ljaanne Exim on v\u00e4lja antud.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/raskryty-podrobnosti-kriticheskoj-uyazvimosti-v-exim","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Exim | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0439 \u0432\u044b\u043f\u0443\u0441\u043a Exim.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/raskryty-podrobnosti-kriticheskoj-uyazvimosti-v-exim","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:20:17+00:00","article:modified_time":"2019-10-31T19:20:17+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37876","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 19:36:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:19:22","updated":"2026-01-23 19:36:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/37876","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=37876"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/37876\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=37876"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=37876"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=37876"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}