{"id":170699,"date":"2026-05-15T06:24:37","date_gmt":"2026-05-15T04:24:37","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-exim-privodyashhaya-k-udalyonnomu-vypolneniyu-koda-na-servere"},"modified":"2026-05-15T06:24:37","modified_gmt":"2026-05-15T04:24:37","slug":"uyazvimost-v-exim-privodyashhaya-k-udalyonnomu-vypolneniyu-koda-na-servere","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-exim-privodyashhaya-k-udalyonnomu-vypolneniyu-koda-na-servere","title":{"rendered":"O vulnerabilitate \u00een Exim, care permite execu\u021bia la distan\u021b\u0103 a codului pe server","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

O server de email Exim a prezentat o vulnerabilitate critic\u0103 (CVE-2026-45185) care permite executarea codului de la distan\u021b\u0103 pe server. Problema apare \u00eencep\u00e2nd cu ramura Exim 4.97, atunci c\u00e2nd este compilat\u0103 cu biblioteca GnuTLS (\"USE_GNUTLS=yes\") \u0219i a fost corectat\u0103 \u00een versiunea Exim 4.99.3. Compil\u0103rile cu OpenSSL \u0219i alte biblioteci, diferite de GnuTLS, nu sunt afectate de aceast\u0103 vulnerabilitate. <\/p>\n

Problema este cauzat\u0103 de accesarea unei memorii deja eliberate (use-after-free) \u00een backend-ul GnuTLS \u0219i poate fi exploatat\u0103 prin accesarea serverelor care sus\u021bin extensia \"ESMTP CHUNKING\" \u0219i comanda BDAT pentru a trimite por\u021biuni din corpul mesajului \u00een loc de a-l transmite ca un bloc indivizibil prin comanda DATA. Corup\u021bia con\u021binutului memoriei procesului apare atunci c\u00e2nd clientul ini\u021biaz\u0103 o finalizare prematur\u0103 a sesiunii TLS prin comanda close_notify \u00een timpul transmiterii corpului mesajului prin BDAT \u0219i apoi trimite \u00een aceea\u0219i conexiune TCP un byte f\u0103r\u0103 criptare \u00een form\u0103 deschis\u0103. <\/p>\n

Dup\u0103 primirea comenzii close_notify \u00een backend-ul GnuTLS, se apeleaz\u0103 func\u021bia de \u00eentrerupere a sesiunii TLS, care elibereaz\u0103 buffer-urile asociate sesiunii. Datorit\u0103 unei erori \u00een codul backend-ului, \u00een ciuda eliber\u0103rii buffer-ului TLS, handler-ul BDAT continu\u0103 s\u0103 citeasc\u0103 date din flux \u0219i apeleaz\u0103 func\u021bia ungetc(), ceea ce, atunci c\u00e2nd sunt trimise urm\u0103toarele date necriptate, duce la scrierea unui byte \u00een buffer-ul deja eliberat. Acest byte corupe metadatele alocatorului de memorie din heap, fiind folosit pentru experimentele de creare a unui exploit capabil s\u0103 execute cod arbitrar pe server<\/a>. <\/p>\n

La \u00eenceput, cercet\u0103torii au generat un exploit par\u021bial func\u021bional prin AI, care a permis executarea codului, dar era operabil doar \u00een condi\u021bii controlate, pe sisteme cu protec\u021bia ASLR \u0219i PIE dezactivate \u0219i cu o anumit\u0103 versiune a bibliotecii libc. Apoi, a fost f\u0103cut\u0103 o \u00eencercare de a crea un exploit cu ajutorul oamenilor, \u00een care o parte din dificult\u0103\u021bi a fost dep\u0103\u0219it\u0103 \u0219i s-a reu\u0219it ob\u021binerea unei scurgeri a adresei stivei, dar p\u00e2n\u0103 la data planificat\u0103 pentru divulgarea informa\u021biilor despre vulnerabilitate, exploitul nu a fost finalizat. \u00cen opinia cercet\u0103torilor care au descoperit vulnerabilitatea, asisten\u021bii AI nu sunt \u00eenc\u0103 capabili s\u0103 creeze exploate pentru produse complexe, dar sper\u0103 c\u0103 \u00een viitor al\u021bi cercet\u0103tori vor putea finaliza munca lor \u0219i vor scrie un exploit complet func\u021bional. <\/p>\n

Dintre distribuitorii majori, versiunile Exim 4.97+ sunt utilizate \u00een Debian 13, Ubuntu 24.04+, SUSE\/openSUSE, Arch Linux, Alpine Linux 3.19+, ALT Linux p11, ROSA, Gentoo, OpenWRT, Fedora, EPEL (exim nu se afl\u0103 \u00een depozitul standard RHEL) \u0219i FreeBSD. Configurarea Exim cu GnuTLS este utilizat\u0103 implicit \u00een Debian \u0219i Ubuntu, \u00een alte distribu\u021bii necesit\u0103 specificarea. Ca o solu\u021bie alternativ\u0103 pentru blocarea vulnerabilit\u0103\u021bii, se poate dezactiva extensia CHUNKING prin ajustarea chunking_advertise_hosts \u00een fi\u0219ierul de configurare.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 Exim \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2026-45185), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u0435\u0442\u043a\u0438 Exim 4.97 \u043f\u0440\u0438 \u0441\u0431\u043e\u0440\u043a\u0435 \u0441 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u043e\u0439 GnuTLS («USE_GNUTLS=yes») \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0435 Exim 4.99.3. \u0421\u0431\u043e\u0440\u043a\u0438 \u0441 OpenSSL \u0438 \u0434\u0440\u0443\u0433\u0438\u043c\u0438 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u043c\u0438, \u043e\u0442\u043b\u0438\u0447\u043d\u044b\u043c\u0438 \u043e\u0442 GnuTLS, \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0435 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u0435\u043c \u043a \u0443\u0436\u0435 \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0451\u043d\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 (use-after-free) \u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-170699","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47O vulnerabilitate \u00een Exim, care conduce la executarea codului de la distan\u021b\u0103 pe server | ProHoster","description":"O vulnerabilitate critic\u0103 (CVE-2026-45185) a fost descoperit\u0103 \u00een serverul de po\u0219t\u0103 Exim, care permite executarea codului de la distan\u021b\u0103 pe server.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-exim-privodyashhaya-k-udalyonnomu-vypolneniyu-koda-na-servere","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Exim, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 | ProHoster","og:description":"\u0412 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 Exim \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2026-45185), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-exim-privodyashhaya-k-udalyonnomu-vypolneniyu-koda-na-servere","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-05-15T04:24:37+00:00","article:modified_time":"2026-05-15T04:24:37+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/170699","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=170699"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/170699\/revisions"}],"predecessor-version":[{"id":170706,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/170699\/revisions\/170706"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=170699"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=170699"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=170699"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}