{"id":169325,"date":"2026-04-19T11:11:58","date_gmt":"2026-04-19T09:11:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/udalyonnoe-vypolnenie-koda-v-forke-pochtovogo-servera-qmail-ot-proekta-sagredo"},"modified":"2026-04-19T11:11:58","modified_gmt":"2026-04-19T09:11:58","slug":"udalyonnoe-vypolnenie-koda-v-forke-pochtovogo-servera-qmail-ot-proekta-sagredo","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/udalyonnoe-vypolnenie-koda-v-forke-pochtovogo-servera-qmail-ot-proekta-sagredo","title":{"rendered":"Esecuzione remota di codice nel fork del server di posta qmail del progetto Sagredo","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Nel fork del server di posta qmail sviluppato dal progetto Sagredo \u00e8 stata scoperta una vulnerabilit\u00e0 (CVE-2026-41113) che consente l'esecuzione remota di comandi arbitrari sul server con i diritti dell'utente qmailr. La vulnerabilit\u00e0 \u00e8 causata dalla mancanza di escaping dei caratteri speciali nel nome host restituito dal server DNS durante la determinazione del gateway MX, combinata con il passaggio del nome ottenuto al comando popen senza adeguata separazione e filtraggio degli argomenti durante la chiamata della shell. La vulnerabilit\u00e0 \u00e8 stata corretta nella versione del 07 aprile 2026. \u00c8 stata pubblicata una toolkit accessibile per l'exploitation della vulnerabilit\u00e0. <\/p>\n

Nel mese di ottobre 2024, il progetto Sagredo ha apportato una modifica all'utilit\u00e0 qmail-remote, aggiungendo la funzione \"notlshosts_auto\", che memorizza gli host con un'implementazione non corretta del protocollo TLS, con cui non \u00e8 possibile stabilire una connessione TLS, per evitare il loop di invio della posta ai suddetti host difettosi. <\/p>\n

Il problema \u00e8 che il salvataggio del nome host veniva effettuato tramite l'esecuzione di una shell utilizzando la funzione popen() con l'argomento \"\/bin\/touch %s\/control\/notlshosts\/'%s'\" in cui veniva inserito il nome dell'host MX restituito dal server DNS. Un attaccante poteva avviare il proprio server DNS, restituendo nei record DNS un nome di tipo \"x'id>\/tmp\/pwned'y.evil.com\", e ottenere l'esecuzione del codice inserito, creando le condizioni per invocare la funzione di salvataggio del nome dell'host di posta difettoso. server<\/a>.
\n
Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u043e\u043c \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c Sagredo \u0444\u043e\u0440\u043a\u0435 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430 qmail \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2026-41113), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u043a\u043e\u043c\u0430\u043d\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f qmailr. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435\u043c \u044d\u043a\u0440\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u043f\u0435\u0446\u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432 \u0432 \u0438\u043c\u0435\u043d\u0438 \u0445\u043e\u0441\u0442\u0430, \u0432\u043e\u0437\u0432\u0440\u0430\u0449\u0430\u0435\u043c\u043e\u0433\u043e DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u043c \u043f\u0440\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u0438 MX-\u0448\u043b\u044e\u0437\u0430, \u0432 \u0441\u043e\u0447\u0435\u0442\u0430\u043d\u0438\u0438 \u0441 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0435\u0439 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u043d\u043e\u0433\u043e \u0438\u043c\u0435\u043d\u0438 \u0432 \u043a\u043e\u043c\u0430\u043d\u0434\u0443 popen \u0431\u0435\u0437 \u0434\u043e\u043b\u0436\u043d\u043e\u0433\u043e \u0440\u0430\u0437\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0438 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u0430\u0440\u0433\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u043f\u0440\u0438 \u0432\u044b\u0437\u043e\u0432\u0435 shell. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-169325","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Esecuzione remota di codice nel fork del server di posta qmail del progetto Sagredo | ProHoster","description":"Nel progetto in sviluppo Sagredo, un fork del server di posta qmail, \u00e8 stata identificata una vulnerabilit\u00e0 (CVE-2026-41113) che consente di ottenere l'esecuzione remota di comandi arbitrari sul server con i diritti dell'utente qmailr. La vulnerabilit\u00e0 \u00e8 causata dalla mancanza di escape dei caratteri speciali nel nome host restituito dal server DNS durante la determinazione del gateway MX, combinata con la trasmissione del nome ottenuto al comando popen senza una corretta separazione e filtraggio degli argomenti durante la chiamata della shell. Vulnerabilit\u00e0","canonical_url":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/udalyonnoe-vypolnenie-koda-v-forke-pochtovogo-servera-qmail-ot-proekta-sagredo","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u0432 \u0444\u043e\u0440\u043a\u0435 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430 qmail \u043e\u0442 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Sagredo | ProHoster","og:description":"\u0412 \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u043e\u043c \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c Sagredo \u0444\u043e\u0440\u043a\u0435 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430 qmail \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2026-41113), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u043a\u043e\u043c\u0430\u043d\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f qmailr. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435\u043c \u044d\u043a\u0440\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u043f\u0435\u0446\u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432 \u0432 \u0438\u043c\u0435\u043d\u0438 \u0445\u043e\u0441\u0442\u0430, \u0432\u043e\u0437\u0432\u0440\u0430\u0449\u0430\u0435\u043c\u043e\u0433\u043e DNS-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u043c \u043f\u0440\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u0438 MX-\u0448\u043b\u044e\u0437\u0430, \u0432 \u0441\u043e\u0447\u0435\u0442\u0430\u043d\u0438\u0438 \u0441 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0435\u0439 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u043d\u043e\u0433\u043e \u0438\u043c\u0435\u043d\u0438 \u0432 \u043a\u043e\u043c\u0430\u043d\u0434\u0443 popen \u0431\u0435\u0437 \u0434\u043e\u043b\u0436\u043d\u043e\u0433\u043e \u0440\u0430\u0437\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0438 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u0430\u0440\u0433\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u043f\u0440\u0438 \u0432\u044b\u0437\u043e\u0432\u0435 shell. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c","og:url":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/udalyonnoe-vypolnenie-koda-v-forke-pochtovogo-servera-qmail-ot-proekta-sagredo","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-04-19T09:11:58+00:00","article:modified_time":"2026-04-19T09:11:58+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/169325","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=169325"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/169325\/revisions"}],"predecessor-version":[{"id":170739,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/169325\/revisions\/170739"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=169325"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=169325"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=169325"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}