Exim 4.99.1 mail seva zosintha zokhala ndi chiopsezo

Chigamba cha seva ya makalata ya Exim 4.99.1 chasindikizidwa, kukonza vuto (CVE-2025-67896) lomwe limalola wowukira wakutali kuwononga kukumbukira kosalekeza. Vutoli lingagwiritsidwe ntchito pokonza ma code akutali pa seva, koma kugwiritsa ntchito sikunapangidwebe.

Chiwopsezo chilipo mu code ya database yamkati ya SQLite (Malangizo DB), yomwe imagwiritsidwa ntchito kusunga zambiri za nthawi, momwe mauthenga amatumizira, ndi deta yotumizira maimelo. Vutoli limayambitsidwa ndi zolemba za database zomwe zimasinthidwa mwachindunji kukhala kapangidwe ka mkati ka "dbdata_ratelimit_unique" popanda kutsimikizika koyenera. Izi zimachitika pamene gulu lokhazikika la 40-byte "bloom" limapangidwa, ndipo zomwe zili mu gawo la "bloom_size", zomwe zimatsimikiza kuchuluka kwa zinthu zomwe zalembedwa ku gulu, zimadalira kukula kwa deta ya database. Wowukira akhoza kulemba kupitirira buffer yoperekedwa poika deta mu database (pogwiritsa ntchito chiwopsezo china) ndi gawo la "bloom_size" lomwe mwadala limayikidwa pamtengo woposa kukula kwa gulu.

Vutoli limakhudza Exim 4.99 ndi 4.98.2, ndipo limakhudza makonzedwe okha ndi ACL ya ratelimit yomwe imagwiritsa ntchito magawo a "unique" kapena "per_addr" (monga, "warn ratelimit = 100 / 1h / per_addr / $sender_address" kapena "warn ratelimit = 100 / 1h / per_rcpt / unique=$sender_address"). Kuphatikiza apo, kuti muchite kuukiraku, Exim iyenera kukonzedwa ndi chithandizo cha SQLite (USE_SQLITE=yes) choyatsidwa mu fayilo yosinthira (hints_database = sqlite). Mu makonzedwe osatetezeka, kuyendetsa "exim -bV" kumabweretsa zotsatira za "Hints DB: Kugwiritsa ntchito sqlite3".

Pa magawidwe akuluakulu, mitundu yovuta idagwiritsidwa ntchito mu Debian 13, Ubuntu 25.10, SUSE/openSUSE, Chipilala Linux, Fedora, ndi FreeBSD. RHEL ndi ma derivatives ake sakhudzidwa ndi vutoli, chifukwa Exim siili m'malo awo osungiramo ma phukusi (EPEL sinasindikize zosintha ku phukusi la Exim).

Vekitala yatsopano yogwiritsira ntchito kufooka kwa CVE-2025-26794, yomwe idakhazikitsidwa mu kutulutsidwa kwa Exim 4.98.1 mu February, yadziwikanso. Kufooka kumeneku kumalola kusintha kwa SQL mu database yamkati (Malangizo DB). Kukonza komwe kudawonjezeredwa kale sikunapewe mawu amodzi. Chitsanzo cha lamulo la MAIL FROM lomwe likutsogolera kusintha kwa SQL: "MAIL FROM:<«x'/**/UNION/**/SELECT/**/X' '—«@attacker.com>». Kufooka kumeneku kungagwiritsidwe ntchito ngati poyambira popanga mikhalidwe ya kusefukira kwa buffer komwe kwafotokozedwa pamwambapa.

Source: opennet.ru