{"id":82266,"date":"2020-05-20T19:42:07","date_gmt":"2020-05-20T17:42:07","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/udalyonno-ekspluatiruemaya-uyazvimost-v-pochtovom-servere-qmail"},"modified":"2020-05-20T19:42:07","modified_gmt":"2020-05-20T17:42:07","slug":"udalyonno-ekspluatiruemaya-uyazvimost-v-pochtovom-servere-qmail","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/udalyonno-ekspluatiruemaya-uyazvimost-v-pochtovom-servere-qmail","title":{"rendered":"Kaugjuhtimisv\u00f5imalus qmaili meiliserveris","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Qualys'i turvauuringute meeskond tulemustest selgus<\/a><\/noindex> v\u00f5imalus haavatavuse<\/a><\/noindex> leidsid haavatavuse qmaili postiserveris, kuulsa<\/a><\/noindex> mis on olemas olnud alates 2005. aastast (CVE-2005-1513), kuid j\u00e4i parandamata, kuna qmaili autor v\u00e4itis, et t\u00f6\u00f6tava eksploidiga r\u00fcnnaku tekitamine vaikimisi seadistustes on ebausutav. Qualys suutis koostada eksploidiga, mis t\u00f5estab seda arvamust ja v\u00f5imaldab kaugelt koodi t\u00e4itmist serveris, saates spetsiaalselt vormindatud s\u00f5numi.<\/p>\n

Probleem tuleneb t\u00e4isarvu \u00fclet\u00e4itumisest funktsiooni stralloc_readyplus() k\u00e4igus, mis v\u00f5ib esineda v\u00e4ga suurte s\u00f5numite t\u00f6\u00f6tlemisel. \u00c4rirakenduseks oli vajalik 64-bitine s\u00fcsteem, mille virtuaalm\u00e4lu maht \u00fcletab 4GB. Rikkumise esialgsel anal\u00fc\u00fcsil 2005. aastal v\u00e4itis Daniel Bernstein, et koodis esinev eeldus, et eraldatava massiivi suurus mahub alati 32-bitise v\u00e4\u00e4rtuse sisse, p\u00f5hines sellel, et keegi ei paku iga protsessi jaoks gigabaite m\u00e4lu. Viimase 15 aasta jooksul on 64-bitised s\u00fcsteemid serverites asendanud 32-bitiseid, oluliselt on suurenenud saadetava m\u00e4lu maht ja v\u00f5rgukiirus. <\/p>\n

Qmaili tugipaketid arvestasid Bernstein'i kommentaari ja piiravad qmail-smtpd protsessi k\u00e4ivitamisel kasutatavat m\u00e4lu (nt Debian 10 puhul on limiit 7MB). Kuid Qualys'e insenerid avastasid, et see pole piisav, kuna qmail-smtpd k\u00f5rval saab kaugr\u00fcnnak teha ka qmail-local protsessile, mis j\u00e4i k\u00f5ikides kontrollitud pakettides piiramatuks. T\u00f5endina oli valmis protot\u00fc\u00fcp eksploidiks, mis sobib Debian'i vaikimisi konfiguratsioonis oleva qmail paketi r\u00fcndamiseks.
\nKaugkoodi k\u00e4ivitamise korraldamiseks r\u00fcnnaku k\u00e4igus on serveris vajalik 4 GB vaba kettaruumi ja 8 GB RAM-i.
\nEksploit v\u00f5imaldab k\u00e4ivitada mis tahes shell-k\u00e4ske mis tahes s\u00fcsteemi kasutaja \u00f5igustes, v\u00e4lja arvatud root ja s\u00fcsteemikasutajad, kellel pole oma alamkausta kaustas «\/home» (qmail-local protsess k\u00e4ivitatakse kohaliku kasutaja \u00f5igustes, kellele toimub kohaletoimetamine).<\/p>\n

R\u00fcnnak toimub
\nsuure postis\u00f5numi saatmise kaudu, mis sisaldab mitmeid ridu p\u00e4ises, suurusega umbes 4GB ja 576MB. Sellise rea t\u00f6\u00f6tlemine qmail-local toob kaasa t\u00e4isarvude \u00fclet\u00e4itumise, kui proovida s\u00f5numit kohalikele kasutajatele toimetada. T\u00e4isarvude \u00fclet\u00e4itumine viib omakorda puhverdamise \u00fclet\u00e4itumiseni andmete kopeerimise ajal ja v\u00f5imaldab m\u00e4lulehtede \u00fcle kirjutamist libc-koodiga. Andmete edastamise manipuleerimise kaudu on v\u00f5imalik ka kirjutada \u00fcle funktsiooni 'open()' aadress, asendades selle funktsiooni 'system()' aadressiga. <\/p>\n

Seej\u00e4rel, qmail-locali qmesearch() kutseprotsessi k\u00e4igus avatakse fail '.qmail-extension' funktsiooni open() kaudu, mis toob kaasa tegeliku funktsiooni
\nsystem('.qmail-extension') k\u00e4ivitamise. Kuna osa failist 'extension' moodustatakse adressaadi aadressi p\u00f5hjal (n\u00e4iteks 'localuser-extension@localdomain'), saavad r\u00fcndajad korraldada k\u00e4su edastamise, m\u00e4\u00e4rates s\u00f5numi adressaadiks 'localuser-;command;@localdomain'. <\/p>\n

Koodi anal\u00fc\u00fcsi k\u00e4igus tuvastati ka kaks haavatavust lisapaketis qmail-verify, mis on osa Debian'i paketist. Esimene haavatavus (CVE-2020-3811<\/a><\/noindex>) v\u00f5imaldab m\u00f6\u00f6da minna e-posti aadressi kontrollist, ja teine (CVE-2020-3812<\/a><\/noindex>) viib kohalikku teavet lekkimiseni. T\u00e4psemalt v\u00f5imaldab esimene haavatavus m\u00f6\u00f6da minna aadressi kehtivuse kontrollist, mida kasutatakse eksploiteerimise k\u00e4igus k\u00e4su edastamisel (kontroll ei toimi aadresside puhul, millel ei ole domeeni, nagu «localuser-;command;»). Teist haavatavust saab kasutada s\u00fcsteemis failide ja kataloogide olemasolu kontrollimiseks, sealhulgas selliste, mis on saadaval ainult root'ile (qmail-verify k\u00e4ivitub root'i \u00f5igustega), otsep\u00f6\u00f6rdumise kaudu kohalikku t\u00f6\u00f6tlejasse.<\/p>\n

Probleemi lahendamiseks soovitas Bernstein k\u00e4ivitada qmaili protsessid, seadistades \u00fchiste jaotatud m\u00e4lu piiri (\"softlimit -m12345678\"), ning sel juhul probleem blokeerub. Alternatiivse kaitsemeetodina mainitakse ka t\u00f6\u00f6tleva s\u00f5numi maksimaalse suuruse piirangut faili \"control\/databytes\" kaudu (tingimustel, kus qmail j\u00e4\u00e4b vaikimisi haavatavaks, seda faili vaikimisi ei loodud). Lisaks ei kaitse \"control\/databytes\" kohalike s\u00fcsteemikasutajate r\u00fcnnakute eest, kuna piirangut arvestatakse ainult qmail-smtpd-protsessis.<\/p>\n

Probleem puudutab paketti netqmail<\/a><\/noindex>, mis on Debian'i hoidlatest. Selle paketi jaoks on v\u00e4lja t\u00f6\u00f6tatud komplekt pat\u0161e, mis k\u00f5rvaldab nii vanad haavatavused aastast 2005 (lisades koodi funktsiooni alloc() j\u00e4ikade m\u00e4lu piiride seadmiseks) kui ka uued probleemid qmail-verify's. Eraldi on valmistatud<\/a><\/noindex> uuendatud qmail-verify pat\u0161. haru<\/a><\/noindex> notqmail<\/a><\/noindex> arendajad on koostanud oma pat\u0161id vanade probleemide blokeerimiseks ning algatanud t\u00f6\u00f6, et k\u00f5rvaldada k\u00f5ik v\u00f5imalike t\u00e4isarvude \u00fclet\u00e4itumised koodis.<\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Qualys \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 qmail, \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0439 \u0435\u0449\u0451 \u0441 2005 \u0433\u043e\u0434\u0430 (CVE-2005-1513), \u043d\u043e \u043e\u0441\u0442\u0430\u0432\u0430\u0432\u0448\u0435\u0439\u0441\u044f \u043d\u0435\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u043e\u0439, \u0442\u0430\u043a \u043a\u0430\u043a \u0430\u0432\u0442\u043e\u0440 qmail \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u043b \u043e \u043d\u0435\u0440\u0435\u0430\u043b\u0438\u0441\u0442\u0438\u0447\u043d\u043e\u0441\u0442\u0438 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0435\u0433\u043e \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043c\u043e\u0433 \u0431\u044b \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e. \u0412 Qualys \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u0438\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u043e\u043f\u0440\u043e\u0432\u0435\u0440\u0433\u0430\u044e\u0449\u0438\u0439 \u0434\u0430\u043d\u043d\u043e\u0435 \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0438\u043d\u0438\u0446\u0438\u0438\u0440\u043e\u0432\u0430\u0442\u044c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-82266","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kaugjuhtimise haavatavus qmail posti serveris | ProHoster","description":"Turvauuringute spetsialistid ettev\u00f5ttest Qualys n\u00e4itasid v\u00f5imalust","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/udalyonno-ekspluatiruemaya-uyazvimost-v-pochtovom-servere-qmail","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 qmail | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Qualys \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/udalyonno-ekspluatiruemaya-uyazvimost-v-pochtovom-servere-qmail","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-20T17:42:07+00:00","article:modified_time":"2020-05-20T17:42:07+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"82266","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 15:41:28","updated":"2022-09-27 18:41:59","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/82266","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=82266"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/82266\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=82266"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=82266"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=82266"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}