{"id":82266,"date":"2020-05-20T19:42:07","date_gmt":"2020-05-20T17:42:07","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/udalyonno-ekspluatiruemaya-uyazvimost-v-pochtovom-servere-qmail"},"modified":"2020-05-20T19:42:07","modified_gmt":"2020-05-20T17:42:07","slug":"udalyonno-ekspluatiruemaya-uyazvimost-v-pochtovom-servere-qmail","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/udalyonno-ekspluatiruemaya-uyazvimost-v-pochtovom-servere-qmail","title":{"rendered":"Kaugel asuva haavatavuse qmail\u2019i postiserveris","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Turvauuringute t\u00f6\u00f6tajad Qualysest n\u00e4itasime, kuidas t\u00f6\u00f6tada Windows Server 2019 Core'iga ja kuidas sellele GUI installida.<\/a><\/noindex> v\u00f5imaluse lekke<\/a><\/noindex> haavatavused qmail\u2019i postiserveris, kuulsast<\/a><\/noindex> olenud teada alates 2005. aastast (CVE-2005-1513), kuid j\u00e4\u00e4nud lahendamata, kuna qmail\u2019i autor v\u00e4itis, et t\u00f6\u00f6kindla eksploitatsioonivahendi loomine, mis v\u00f5iks r\u00fcnnata vaikekonfiguratsiooniga s\u00fcsteeme, on ebat\u00f5en\u00e4oline. Qualysel \u00f5nnestus valmistada eksploit, mis t\u00f5estab selle oletuse vale ja v\u00f5imaldab algatada kaugel k\u00e4ivitatavat koodi serveris, saates spetsiaalselt kujundatud s\u00f5numi.<\/p>\n

Probleem on p\u00f5hjustatud t\u00e4isarvu \u00fclevoolust funktsioonis stralloc_readyplus(), mis v\u00f5ib tekkida v\u00e4ga suure s\u00f5numi t\u00f6\u00f6tlemise ajal. Ekspluateerimiseks oli vajalik 64-bitine s\u00fcsteem, millel on rohkem kui 4 GB virtuaalset m\u00e4lu. Kui 2005. aastal uuris haavatavust, v\u00e4itis Daniel J. Bernstein, et koodis olemasolev eeldus, et eraldatud massiivi suurus ei \u00fcleta 32-bitist v\u00e4\u00e4rtust, p\u00f5hineb sellel, et keegi ei anna igale protsessile gigabaite m\u00e4lu. Viimase 15 aasta jooksul on 64-bitised s\u00fcsteemid serverites t\u00f5rjunud 32-bitiseid, m\u00e4lu maht on oluliselt suurenenud ja v\u00f5rgukiirus on kasvanud. <\/p>\n

qmail\u2019iga kaasnevad paketid v\u00f5tsid Bernsteinile adresseeritud m\u00e4rkuse arvesse ja qmail-smtpd protsessi k\u00e4ivitamisel piirati k\u00e4ttesaadavat m\u00e4lu (n\u00e4iteks Debian 10 seades on piir 7MB). Kuid Qualyse insenerid avastasid, et see on ebapiisav ja lisaks qmail-smtpd-le on kaugr\u00fcnnak v\u00f5imalik ka qmail-local protsessi vastu, mis j\u00e4i k\u00f5ikides kontrollitud pakettides piiranguteta. T\u00f5endusena valmistati ette eksploitatsiooni protot\u00fc\u00fcp, mis sobib r\u00fcnnakuks vaikekonfiguratsiooniga Debian paketti qmail\u2019iga.
\nKaugel k\u00e4ivitatava koodi korraldamiseks r\u00fcnnaku k\u00e4igus on serveris vajalik 4 GB vaba kettaruumi ja 8 GB RAM-i.
\nEksploit v\u00f5imaldab k\u00e4ivitada igasuguseid shell-k\u00e4ske mistahes s\u00fcsteemi kasutaja \u00f5igustes, v\u00e4lja arvatud root ja s\u00fcsteemikasutajad, kellel ei ole oma alamkausta kaustas \"home\" (protsess qmail-local k\u00e4ivitatakse kohaliku kasutaja \u00f5igustes, kellele toimetatakse).<\/p>\n

R\u00fcnnak toimub
\nsuure posti saatmise kaudu, mis sisaldab mitut rida pealkirjas, suurusega umbes 4GB ja 576MB. Sellise rea t\u00f6\u00f6tlemine qmail-localis toob kaasa t\u00e4isarvutite \u00fclevoolu, kui proovida kohalikele kasutajatele s\u00f5numi kohaletoimetamist. T\u00e4isarvutite \u00fclevool viib seej\u00e4rel m\u00e4lubuffri \u00fcle jooksma andmete kopeerimise k\u00e4igus ning v\u00f5imaldab m\u00e4lulehtede asendamist libc koodiga. Andmete edastamise l\u00f5pliku kavandamise kaudu on v\u00f5imalik asendada ka funktsiooni \"open()\" aadress funktsiooni \"system()\" aadressiga. <\/p>\n

Seej\u00e4rel avatakse qmail-locali protsessi k\u00e4igus qmesearch() kaudu fail \".qmail-extension\" funktsiooni open() kaudu, mis viib tegeliku funktsiooni k\u00e4ivitamiseni
\nsystem(\".qmail-extension\"). Kuid kuna osa failist \"extension\" moodustatakse saaja aadressi p\u00f5hjal (nt \"localuser-extension@localdomain\"), saavad r\u00fcndajad korraldada k\u00e4su edastamise, m\u00e4\u00e4rates saajana \"localuser-;command;@localdomain\". <\/p>\n

Koodi anal\u00fc\u00fcsi k\u00e4igus avastati ka kaks haavatavust t\u00e4iendavas qmail-verify plaastris, mis kuulub Debian'i paketti. Esimene haavatavus (CVE-2020-3811<\/a><\/noindex>) v\u00f5imaldab v\u00e4ltida e-posti aadressi kontrollimist, teine (CVE-2020-3812<\/a><\/noindex>) viib kohaliku teabe lekkeeni. Eriti esimene haavatavus v\u00f5imaldab m\u00f6\u00f6da minna aadressi kehtivuse kontrollist, mida kasutatakse k\u00e4su edastamiseks (kontroll ei toimi aadresside puhul, millel ei ole domeeni, n\u00e4iteks \"localuser-;command;\"). Teine haavatavus v\u00f5imaldab kontrollida, kas failid ja kaustad on s\u00fcsteemis olemas, sealhulgas ainult rootile k\u00e4tte saadavad (qmail-verify k\u00e4ivitatakse root \u00f5igustes), kaasates otse kohaliku t\u00f6\u00f6tleja.<\/p>\n

Probleemi v\u00e4ltimiseks soovitas Bernstein k\u00e4ivitada qmaili protsessid, seades \u00fcldise piirangu saadaval olevale m\u00e4lule (\"softlimit -m12345678\"), ja sel juhul on probleem blokeeritud. Alternatiivse kaitsemeetodina mainitakse ka t\u00f6\u00f6deldava s\u00f5numi maksimaalse suuruse piiramist faili \"control\/databytes\" kaudu (vaikimisi ei luleta, seega qmail j\u00e4\u00e4b vaikimisi haavatavaks). Lisaks ei kaitse \"control\/databytes\" kohalike r\u00fcnnakute eest s\u00fcsteemi kasutajate poolt, kuna piirangut arvestatakse ainult qmail-smtpd-s.<\/p>\n

Probleem puudutab paketti netqmail<\/a><\/noindex>, mis sisaldu on Debiani hoidlas. Selle paketi jaoks on ette valmistatud plekkide kogum, mis k\u00f5rvaldab nii vanad 2005. aasta haavatavused (lisa kaudu alloc() funktsiooni m\u00e4lu piirangud) kui ka uued probleemid qmail-verify-s. Eristi on ette valmistatud<\/a><\/noindex> uuendatud versioon patch'ist qmail-verify. Arendajad haru<\/a><\/noindex> notqmail<\/a><\/noindex> valmistasid ette oma plaastrid vanade probleemide blokeerimiseks ning alustasid t\u00f6\u00f6d, et k\u00f5rvaldada k\u00f5ik v\u00f5imalikes koodis esinevad t\u00e4isarvude \u00fclet\u00e4itumised.<\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Qualys \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 qmail, \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0439 \u0435\u0449\u0451 \u0441 2005 \u0433\u043e\u0434\u0430 (CVE-2005-1513), \u043d\u043e \u043e\u0441\u0442\u0430\u0432\u0430\u0432\u0448\u0435\u0439\u0441\u044f \u043d\u0435\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u043e\u0439, \u0442\u0430\u043a \u043a\u0430\u043a \u0430\u0432\u0442\u043e\u0440 qmail \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u043b \u043e \u043d\u0435\u0440\u0435\u0430\u043b\u0438\u0441\u0442\u0438\u0447\u043d\u043e\u0441\u0442\u0438 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0435\u0433\u043e \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043c\u043e\u0433 \u0431\u044b \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e. \u0412 Qualys \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u0438\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u043e\u043f\u0440\u043e\u0432\u0435\u0440\u0433\u0430\u044e\u0449\u0438\u0439 \u0434\u0430\u043d\u043d\u043e\u0435 \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0438\u043d\u0438\u0446\u0438\u0438\u0440\u043e\u0432\u0430\u0442\u044c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-82266","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kaugt\u00f6\u00f6tatav haavatavus qmail meiliserveris | ProHoster","description":"Turva-uuringud ettev\u00f5ttest Qualys n\u00e4itasid v\u00f5imalust","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/udalyonno-ekspluatiruemaya-uyazvimost-v-pochtovom-servere-qmail","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 qmail | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Qualys \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/udalyonno-ekspluatiruemaya-uyazvimost-v-pochtovom-servere-qmail","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-20T17:42:07+00:00","article:modified_time":"2020-05-20T17:42:07+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"82266","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 15:41:28","updated":"2022-09-27 18:41:59","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/82266","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=82266"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/82266\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=82266"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=82266"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=82266"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}