{"id":35011,"date":"2019-10-31T22:01:50","date_gmt":"2019-10-31T19:01:50","guid":{"rendered":"https:\/\/prohoster.info\/blog\/kriticheskaya-uyazvimost-v-exim-pozvolyayushhaya-vypolnit-kod-na-servere-s-pravami-root\/"},"modified":"2019-10-31T22:01:50","modified_gmt":"2019-10-31T19:01:50","slug":"kriticheskaya-uyazvimost-v-exim-pozvolyayushhaya-vypolnit-kod-na-servere-s-pravami-root","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/kriticheskaya-uyazvimost-v-exim-pozvolyayushhaya-vypolnit-kod-na-servere-s-pravami-root","title":{"rendered":"O vulnerabilitate critic\u0103 \u00een Exim, care permite executarea codului pe server cu drepturi root","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00cen serverul de e-mail Exim a fost identificat\u0103<\/a><\/noindex> critic\u0103 vulnerabilitatea<\/a><\/noindex> (CVE-2019-10149<\/a><\/noindex>), care poate duce la execu\u021bia de cod de la distan\u021b\u0103 pe server cu drepturi de root \u00een urma proces\u0103rii unei cereri special formate. Posibilitatea exploat\u0103rii problemei a fost observat\u0103 \u00een versiunile de la 4.87 la 4.91 inclusiv sau la compilarea cu op\u021biunea EXPERIMENTAL_EVENT.<\/p>\n

\u00cen configura\u021bia implicit\u0103, un atac poate fi realizat f\u0103r\u0103 complica\u021bii suplimentare de un utilizator local, deoarece se aplic\u0103 ACL \u201everify = recipient\u201d, care efectueaz\u0103 verific\u0103ri suplimentare pentru adresele externe. Un atac remote devine posibil prin modificarea set\u0103rilor, de exemplu, atunci c\u00e2nd func\u021bioneaz\u0103 ca MX secundar pentru un alt domeniu, elimin\u00e2nd ACL \u201everify = recipient\u201d sau efectu\u00e2nd anumite modific\u0103ri \u00een local_part_suffix). Un atac remote este, de asemenea, posibil dac\u0103 un atacator reu\u0219e\u0219te s\u0103 men\u021bin\u0103 o conexiune deschis\u0103 cu serverul timp de 7 zile (de exemplu, trimi\u021b\u00e2nd un byte pe minut pentru a ocoli timpul de a\u0219teptare). De asemenea, nu se exclude faptul c\u0103 ar putea exista \u0219i vectori de atac mai simpli pentru exploatarea remote a problemei.<\/p>\n

Vulnerabilitatea este cauzat\u0103 de verificarea incorect\u0103 a adresei destinatarului \u00een func\u021bia deliver_message(), definit\u0103 \u00een fi\u0219ierul \/src\/deliver.c. Prin manipularea format\u0103rii adresei, atacatorul poate ob\u021bine substituirea datelor sale \u00een argumentele comenzii apelat\u0103 prin func\u021bia execv() cu drepturi de root. Pentru exploatare nu sunt necesare tehnici complexe, folosite \u00een cazul dep\u0103\u0219irilor de buffer sau coruperii memoriei, fiind suficient\u0103 doar substituirea simbolurilor. <\/p>\n

Problema este legat\u0103 de utilizarea pentru conversia adreselor a construc\u021biei:<\/p>\n

deliver_localpart = expand_string(
\n string_sprintf(\"${local_part:%s}\", new->address));
\n deliver_domain = expand_string(
\n string_sprintf(\"${domain:%s}\", new->address));<\/p>\n

Func\u021bia expand_string() este un combinator complicat, inclusiv care recunoa\u0219te comanda \"${run{comand\u0103 argumente}\", care duce la apelarea unui procesor extern. Astfel, pentru un atac \u00een cadrul sesiunii SMTP, este suficient ca un utilizator local s\u0103 transmit\u0103 o comand\u0103 de forma 'RCPT TO \"username+${run{\u2026}}@localhost\"', unde localhost este unul dintre hosturile din lista local_domains, iar username este numele unui utilizator local existent. <\/p>\n

Dac\u0103 serverul func\u021bioneaz\u0103 ca un releu po\u0219tal, este suficient s\u0103 trimite\u021bi de la distan\u021b\u0103 comanda 'RCPT TO \"${run{\u2026}}@relaydomain.com\"', unde relaydomain.com este unul dintre hosturile enumerate \u00een sec\u021biunea de set\u0103ri relay_to_domains. Deoarece \u00een mod implicit \u00een exim nu se aplic\u0103 modul de resetare a privilegiilor (deliver_drop_privilege = false), comenzile transmise prin \"${run{\u2026}}\" vor fi executate cu privilegiile root.<\/p>\n

Este demn de men\u021bionat c\u0103 vulnerabilitatea a fost remediat\u0103<\/a><\/noindex> \u00een versiunea 4.92 lansat\u0103 \u00een februarie, f\u0103r\u0103 a sublinia faptul c\u0103 remedierea ar putea duce la probleme de securitate. Nu exist\u0103 motive suficiente pentru a considera c\u0103 dezvoltatorii Exim au ascuns con\u0219tient vulnerabilitatea, av\u00e2nd \u00een vedere c\u0103 problema a fost rezolvat\u0103 \u00een timpul remediului<\/a><\/noindex> erorii ce apare la transmiterea de adrese incorecte, iar vulnerabilitatea a fost descoperit\u0103 de compania Qualys \u00een timpul unui audit al modific\u0103rilor din Exim. <\/p>\n

Remedierea pentru versiunile anterioare, care continu\u0103 s\u0103 fie utilizate \u00een distribu\u021bii, este disponibil\u0103 momentan doar sub form\u0103 de patch<\/a><\/noindex>. Rela\u021biile corective pentru ramurile anterioare cu solu\u021bionarea problemei sunt programate pentru 11 iunie. Actualiz\u0103rile pachetelor au fost preg\u0103tite pentru Debian<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, openSUSE<\/a><\/noindex>. Arch Linux<\/a><\/noindex> \u0219i Fedora<\/a><\/noindex> distribuie versiunea 4.92, \u00een care problema nu apare. RHEL \u0219i CentOS nu sunt vulnerabile<\/a><\/noindex>, deoarece Exim nu face parte din depozitul lor standard de pachete.<\/p>\n

<\/a><\/noindex><\/p>\n

Sursa: opennet.ro<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 Exim \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2019-10149), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0437\u0430\u043f\u0440\u043e\u0441\u0430. \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043e\u0442\u043c\u0435\u0447\u0435\u043d\u0430 \u0432 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 \u0441 4.87 \u043f\u043e 4.91 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0438\u043b\u0438 \u043f\u0440\u0438 \u0441\u0431\u043e\u0440\u043a\u0435 \u0441 \u043e\u043f\u0446\u0438\u0435\u0439 EXPERIMENTAL_EVENT. \u0412 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0430\u0442\u0430\u043a\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0430 \u0431\u0435\u0437 \u043b\u0438\u0448\u043d\u0438\u0445 \u0443\u0441\u043b\u043e\u0436\u043d\u0435\u043d\u0438\u0439 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-35011","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitate critic\u0103 \u00een Exim, permi\u021b\u00e2nd executarea de cod pe server cu drepturi root | ProHoster","description":"O vulnerabilitate critic\u0103 a fost identificat\u0103 \u00een serverul de e-mail Exim","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/kriticheskaya-uyazvimost-v-exim-pozvolyayushhaya-vypolnit-kod-na-servere-s-pravami-root","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Exim, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root | ProHoster","og:description":"\u0412 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 Exim \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/kriticheskaya-uyazvimost-v-exim-pozvolyayushhaya-vypolnit-kod-na-servere-s-pravami-root","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:01:50+00:00","article:modified_time":"2019-10-31T19:01:50+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"35011","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 21:28:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:11:30","updated":"2026-01-21 21:28:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/35011","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=35011"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/35011\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=35011"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=35011"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=35011"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}