Chiwopsezo chachikulu mu Exim chomwe chimalola kuti code ichitike pa seva yokhala ndi mwayi woyambira

Mu Exim mail seva kudziwika wotsutsa kusatetezeka (CVE-2019-10149), zomwe zingapangitse kuti pakhale ma code akutali pa seva ndi ufulu wa mizu pokonza pempho lopangidwa mwapadera. Kuthekera kwakugwiritsa ntchito vutoli kudadziwika m'matembenuzidwe kuyambira 4.87 mpaka 4.91 kuphatikiza kapena pomanga ndi EXPERIMENTAL_EVENT.

Mukusintha kosasintha, kuukira kungathe kuchitidwa popanda zovuta zosafunikira ndi wogwiritsa ntchito wamba, popeza "Verify = Recipient" ACL imagwiritsidwa ntchito, yomwe imapanga macheke owonjezera a ma adilesi akunja. Kuwukira kwakutali kumatha kuchitika pomwe zosintha zasinthidwa, monga kuchita ngati MX yachiwiri ya domain ina, kuchotsa "verify=recipient" ACL, kapena kusintha kwina kwa local_part_suffix). Kuwukira kwakutali kumathekanso ngati wowukirayo atha kusunga kulumikizana ndi seva kutseguka kwa masiku 7 (mwachitsanzo, kutumiza beti imodzi pamphindi kuti idutse nthawi). Panthawi imodzimodziyo, n'zotheka kuti pali ma vectors osavuta ogwiritsira ntchito vutoli.

Chiwopsezochi chimadza chifukwa cha kutsimikizira kolakwika kwa adilesi ya wolandirayo mu deliver_message() ntchito yofotokozedwa mu fayilo ya /src/deliver.c. Posintha makonzedwe a ma adilesi, wowukira atha kukwaniritsa kulowetsa kwa data yake m'mawu alamulo otchedwa kudzera mu execv() ntchito yokhala ndi maufulu a mizu. Kugwira ntchito sikufuna kugwiritsa ntchito njira zovuta zomwe zimagwiritsidwa ntchito pakusefukira kwa bafa kapena kuwonongeka kwa kukumbukira; kusintha mawonekedwe osavuta ndikokwanira.

Vutoli likugwirizana ndi kugwiritsa ntchito mapangidwe kuti asinthe ma adilesi:

deliver_localpart = expand_string(
string_sprintf("${local_part:%s}", new->address));
deliver_domain = expand_string(
string_sprintf("${domain:%s}", new->address));

The expand_string() ntchito ndi chophatikizira chovuta kwambiri, kuphatikizapo kuzindikira lamulo "${run{command arguments}", zomwe zimatsogolera kukhazikitsidwa kwa wothandizira kunja. Chifukwa chake, kuti aukire mkati mwa gawo la SMTP, wogwiritsa ntchito wakomweko amangofunika kutumiza lamulo ngati 'RCPT KUTI "username+${run{...}}@localhost"', pomwe localhost ndi m'modzi mwa omwe ali nawo pamndandanda wa local_domains, ndipo dzina lolowera ndi dzina la munthu wamba.

Ngati seva ikugwira ntchito ngati kutumiza maimelo, ndikokwanira kutumiza patali lamulo la 'RCPT TO "${run{...}}@relaydomain.com"', pomwe relaydomain.com ndi amodzi mwa omwe adatchulidwa mu relay_to_domains. zoikamo gawo. Popeza Exim siisintha kusiya mwayi (deliver_drop_privilege = zabodza), malamulo odutsa "${run{...}}" adzaperekedwa ngati mizu.

N'zochititsa chidwi kuti chiopsezo chinali kuthetsedwa mu kutulutsidwa kwa 4.92 komwe kunatulutsidwa mu February, popanda kutsindika kuti kukonza kungayambitse mavuto a chitetezo. Palibe chifukwa chokhulupirira kuti panali kubisala mwadala za kusatetezeka kwa opanga Exim, popeza vutoli lidakonzedwa panthawiyi. Malangizo kulephera komwe kumachitika pamene ma adilesi olakwika atumizidwa, ndipo kusatetezeka kudazindikirika ndi Qualys pakuwunika kosintha kwa Exim.

Kukonzekera kwamatembenuzidwe am'mbuyomu omwe akupitilizabe kugwiritsidwa ntchito pogawa akupezeka ngati chigamba. Zotulutsa zowongolera za nthambi zam'mbuyomu kuti zithetse vutoli zakonzedwa pa June 11. Zosintha zapaketi zakonzeka Debian, Ubuntu, Tsegulani. Arch Linux и Fedora Amapereka mtundu wa 4.92, momwe vutoli silikuwonekera. RHEL ndi vuto la CentOS osatengeka, popeza Exim siyikuphatikizidwa m'malo awo okhazikika.

Source: opennet.ru