{"id":170699,"date":"2026-05-15T06:24:37","date_gmt":"2026-05-15T04:24:37","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-exim-privodyashhaya-k-udalyonnomu-vypolneniyu-koda-na-servere"},"modified":"2026-05-15T06:24:37","modified_gmt":"2026-05-15T04:24:37","slug":"uyazvimost-v-exim-privodyashhaya-k-udalyonnomu-vypolneniyu-koda-na-servere","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/news\/uyazvimost-v-exim-privodyashhaya-k-udalyonnomu-vypolneniyu-koda-na-servere","title":{"rendered":"Ranjivost u Eximu koja dovodi do daljinskog izvr\u0161avanja koda na serveru","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Na Exim po\u0161tanskom poslu\u017eitelju otkrivena je kriti\u010dna ranjivost (CVE-2026-45185) koja omogu\u0107ava daljinsko izvr\u0161enje koda na poslu\u017eitelju. Problem se javlja od verzije Exim 4.97 kada se gradi s GnuTLS knji\u017enicom («USE_GNUTLS=yes») i ispravljen je u izdanju Exim 4.99.3. Gra\u0111evine s OpenSSL-om i drugim knji\u017enicama osim GnuTLS nisu pogo\u0111ene ovom ranjivo\u0161\u0107u. <\/p>\n

Problem je uzrokovan pristupom ve\u0107 oslobo\u0111enoj memoriji (use-after-free) u GnuTLS backendu i mo\u017ee se iskoristiti kada se obra\u0107ate poslu\u017eiteljima koji podr\u017eavaju ekstenziju «ESMTP CHUNKING» i BDAT naredbu za prijenos tijela poruke u dijelovima umjesto prijenosa cijelog bloka s DATA naredbom. O\u0161te\u0107enje sadr\u017eaja memorije procesa nastaje kada klijent inicira prerano zatvaranje TLS sesije s naredbom close_notify tijekom prijenosa tijela poruke putem BDAT-a, nakon \u010dega slijedi slanje jednog bajta bez enkripcije u istom TCP povezivanju. <\/p>\n

Prilikom primanja naredbe close_notify u backendu GnuTLS poziva se funkcija prekida TLS sesije koja osloba\u0111a povezane baferieme. Zbog gre\u0161ke u kodu backend-a, unato\u010d osloba\u0111anju TLS bafera, procesor BDAT nastavlja \u010ditati podatke iz toka i poziva funkciju ungetc(), \u0161to rezultira zapisivanjem jednog bajta u ve\u0107 oslobo\u0111eni bafer kada se \u0161alju neenkriptirani podaci. Ovaj bajt o\u0161te\u0107uje metapodatke alokatora memorije u hrpi (heap), \u0161to je kori\u0161teno za provo\u0111enje eksperimenata u stvaranju eksploita koji izvr\u0161ava proizvoljan kod na. serveru<\/a>. <\/p>\n

Na po\u010detku su istra\u017eiva\u010di generirali djelomi\u010dno funkcionalan exploit putem AI-a, koji je omogu\u0107io izvr\u0161avanje koda, ali je bio operativan samo u uvjetima staklenika, na sustavima s isklju\u010denom za\u0161titom ASLR i PIE, i odre\u0111enom verzijom biblioteke libc. Nakon toga je poduzeta poku\u0161aj izrade eksploita uz sudjelovanje \u010dovjeka, u kojem je dio pote\u0161ko\u0107a uspje\u0161no prevladan i postignut je curenje adrese stoga, no do planiranog datuma otkrivanja ranjivosti exploit nije dovr\u0161en. Prema mi\u0161ljenju istra\u017eiva\u010da koji su otkrili ranjivost, AI asistenti jo\u0161 uvijek nisu sposobni stvarati exploite za slo\u017eene proizvode, ali se nadaju da \u0107e u budu\u0107nosti drugi istra\u017eiva\u010di mo\u0107i dovr\u0161iti njihov rad i napisati potpuno funkcionalan exploit. <\/p>\n

U ve\u0107im distribucijama, verzije Exim 4.97+ koriste se u Debian 13, Ubuntu 24.04+, SUSE\/openSUSE, Arch Linux, Alpine Linux 3.19+, ALT Linux p11, ROSA, Gentoo, OpenWRT, Fedora, EPEL (exim nije uklju\u010d\u0435\u043d u standardni repozitorij RHEL) i FreeBSD. Izrada Exima s GnuTLS koristi se prema zadanim postavkama u Debiana i Ubuntua, dok u drugim distribucijama to treba provjeriti. Kao zaobilazno rje\u0161enje za blokiranje ranjivosti, mo\u017eete onemogu\u0107iti pro\u0161irenje CHUNKING pomo\u0107u postavke chunking_advertise_hosts u konfiguracijskoj datoteci.
\n
Izvor: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 Exim \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2026-45185), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u0435\u0442\u043a\u0438 Exim 4.97 \u043f\u0440\u0438 \u0441\u0431\u043e\u0440\u043a\u0435 \u0441 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u043e\u0439 GnuTLS («USE_GNUTLS=yes») \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0435 Exim 4.99.3. \u0421\u0431\u043e\u0440\u043a\u0438 \u0441 OpenSSL \u0438 \u0434\u0440\u0443\u0433\u0438\u043c\u0438 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u043c\u0438, \u043e\u0442\u043b\u0438\u0447\u043d\u044b\u043c\u0438 \u043e\u0442 GnuTLS, \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0435 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u0435\u043c \u043a \u0443\u0436\u0435 \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0451\u043d\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 (use-after-free) \u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-170699","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ranjivost u Eximu koja dovodi do udaljenog izvr\u0161avanja koda na poslu\u017eitelju | ProHoster","description":"U po\u0161tanskom poslu\u017eitelju Exim otkrivena je kriti\u010dna ranjivost (CVE-2026-45185) koja omogu\u0107ava udaljeno izvr\u0161avanje koda na poslu\u017eitelju.","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/news\/uyazvimost-v-exim-privodyashhaya-k-udalyonnomu-vypolneniyu-koda-na-servere","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Exim, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 | ProHoster","og:description":"\u0412 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 Exim \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2026-45185), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435.","og:url":"https:\/\/prohoster.info\/hr\/blog\/news\/uyazvimost-v-exim-privodyashhaya-k-udalyonnomu-vypolneniyu-koda-na-servere","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-05-15T04:24:37+00:00","article:modified_time":"2026-05-15T04:24:37+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/170699","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=170699"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/170699\/revisions"}],"predecessor-version":[{"id":170706,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/170699\/revisions\/170706"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=170699"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=170699"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=170699"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}