Exim 4.92.3 da aka buga tare da kawar da rashin ƙarfi na huɗu a cikin shekara guda

aka buga Sabar sabar ta musamman Fitowa 4.92.3 tare da kawar da wani m rauni (CVE-2019-16928), mai yuwuwar ba ku damar aiwatar da lambar ku a kan uwar garke ta hanyar wucewa na musamman da aka tsara a cikin umarnin EHLO. Rashin lahani yana bayyana a matakin bayan an sake saita gata kuma an iyakance shi ga aiwatar da lamba tare da haƙƙin mai amfani mara gata, wanda a ƙarƙashinsa ake aiwatar da mai sarrafa saƙo mai shigowa.

Matsalar ta bayyana ne kawai a cikin Exim 4.92 reshe (4.92.0, 4.92.1 da 4.92.2) kuma baya zoba tare da raunin da aka kafa a farkon wata. CVE-2019-15846. Rashin lahani yana faruwa ne ta hanyar buffer ambaliya a cikin wani aiki string_vformat(), an bayyana a cikin string.c. An nuna amfani yana ba ku damar haifar da haɗari ta hanyar wuce dogon kirtani (kilobytes da yawa) a cikin umarnin EHLO, amma ana iya amfani da raunin ta hanyar wasu umarni, kuma ana iya amfani da shi don tsara aiwatar da code.

Babu hanyoyin da za a bi don toshe raunin, don haka ana ba da shawarar duk masu amfani da su shigar da sabuntawa cikin gaggawa, yi amfani da su. faci ko tabbatar da amfani da fakitin da aka bayar ta hanyar rarrabawa waɗanda ke ɗauke da gyara don raunin halin yanzu. An saki hotfix don Ubuntu (ya shafi reshe kawai 19.04), Arch Linux, FreeBSD, Debian (kawai yana shafar Debian 10 Buster) da Fedora. RHEL da CentOS matsalar ba ta shafe su ba, tunda ba a haɗa Exim a cikin ma'ajin fakitin su ba (a ciki). EEL7 sabunta don yanzu babu). A cikin SUSE/openSUSE rashin lafiyar ba ya bayyana saboda amfani da reshen Exim 4.88.

source: budenet.ru

Add a comment