{"id":37876,"date":"2019-10-31T22:20:17","date_gmt":"2019-10-31T19:20:17","guid":{"rendered":"https:\/\/prohoster.info\/blog\/raskryty-podrobnosti-kriticheskoj-uyazvimosti-v-exim\/"},"modified":"2019-10-31T22:20:17","modified_gmt":"2019-10-31T19:20:17","slug":"raskryty-podrobnosti-kriticheskoj-uyazvimosti-v-exim","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/raskryty-podrobnosti-kriticheskoj-uyazvimosti-v-exim","title":{"rendered":"Detalii despre vulnerabilitatea critic\u0103 \u00een Exim au fost divulgate","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Publicat<\/a><\/noindex> versiune corectiv\u0103 Exim 4.92.2<\/a><\/noindex> cu eliminarea critic\u0103 vulnerabilit\u0103\u021bi<\/a><\/noindex> (CVE-2019-15846<\/a><\/noindex>), care \u00een configura\u021bia implicit\u0103 poate duce la executarea de cod de la distan\u021b\u0103 de c\u0103tre un atacator cu privilegii root. Problema se manifest\u0103 doar atunci c\u00e2nd suportul TLS este activat \u0219i este exploatat\u0103 prin transmiterea unui certificat client special format sau a unei valori modificate \u00een SNI. Vulnerabilitate a fost identificat\u0103<\/a><\/noindex> de c\u0103tre compania Qualys.<\/p>\n

Problema exist\u0103<\/a><\/noindex> \u00een handler-ul de escapare a caracterelor speciale din \u0219ir (string_interpret_escape()<\/a><\/noindex> din string.c) \u0219i este cauzat\u0103 de faptul c\u0103 simbolul \u2018\u2019 de la sf\u00e2r\u0219itul \u0219irului este interpretat \u00eenainte de caracterul nul (\u2018\u2019) \u0219i \u00eel escapeaz\u0103. La escapes, secven\u021ba \u2018\u2019 \u0219i codul nul urm\u0103tor de sf\u00e2r\u0219it de \u0219ir sunt tratate ca un singur caracter, iar pointer-ul se mut\u0103 pe datele dincolo de \u0219ir, care sunt procesate ca o continuare a acestuia. <\/p>\n

Codul care apeleaz\u0103 string_interpret_escape() aloc\u0103 un buffer pentru stocare, baz\u00e2ndu-se pe dimensiunea real\u0103, iar pointerul ob\u021binut ajunge \u00een zona din afara limitelor buffer-ului. Prin urmare, c\u00e2nd se \u00eencearc\u0103 procesarea \u0219irului de intrare, apare o situa\u021bie de citire a datelor din zona din afara limitelor buffer-ului alocat, iar \u00eencercarea de a scrie \u0219irul dezescapat poate duce la o scriere peste limita buffer-ului.<\/p>\n

\u00cen configura\u021bia implicit\u0103, vulnerabilitatea poate fi exploatat\u0103 prin transmiterea de date special concepute \u00een SNI atunci c\u00e2nd se stabile\u0219te o conexiune securizat\u0103 la server. Problema poate fi, de asemenea, exploatat\u0103 prin modificarea valorilor peerdn \u00een configura\u021biile configurate pentru autentificarea prin certificat de client sau la importul certificatelor. Atacul prin SNI \u0219i peerdn este posibil \u00eencep\u00e2nd cu versiunea Exim 4.80<\/a><\/noindex>, \u00een care func\u021bia string_unprinting() a fost aplicat\u0103 pentru dezescaparea con\u021binutului peerdn \u0219i SNI.<\/p>\n

Pentru atacul prin SNI, a fost preg\u0103tit un prototip de exploit care func\u021bioneaz\u0103 pe arhitecturile i386 \u0219i amd64 \u00een sistemele Linux cu Glibc. \u00cen exploit, se folose\u0219te suprapunerea datelor pe zona heap, conduc\u00e2nd la scrierea \u00een memorie \u00een care este stocat numele fi\u0219ierului de log. Numele fi\u0219ierului este \u00eenlocuit cu \u2018\/..\/\/..\/\/..\/\/..\/\/..\/\/..\/\/..\/\/..\/\/etc\/\/passwd\u2019. \u00cen continuare, se rescrie variabila cu adresa expeditorului, care este prima salvat\u0103 \u00een log, permi\u021b\u00e2nd ad\u0103ugarea unui nou utilizator \u00een sistem. <\/p>\n

Actualiz\u0103rile pachetelor cu remedieri ale vulnerabilit\u0103\u021bii au fost lansate de distribu\u021bii Debian<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, Fedora<\/a><\/noindex>, SUSE\/openSUSE<\/a><\/noindex> \u0219i FreeBSD<\/a><\/noindex>. RHEL \u0219i CentOS problema vulnerabile<\/a><\/noindex>, deoarece Exim nu face parte din repository-ul lor standard de pachete (\u00een EPEL<\/a><\/noindex> actualizare este deja<\/a><\/noindex> formatat<\/a><\/noindex>, dar p\u00e2n\u0103 acum nu este inclus<\/a><\/noindex> \u00eentr-un depozit public). \u00cen codul Exim, problema este rezolvat\u0103 cu o singur\u0103 linie patch-ul<\/a><\/noindex>, dezactiv\u00e2nd ac\u021biunea de escapare a backslash-ului, dac\u0103 se afl\u0103 la sf\u00e2r\u0219itul liniei.<\/p>\n

Ca o solu\u021bie pentru blocarea vulnerabilit\u0103\u021bii, se poate dezactiva suportul TLS sau ad\u0103uga \u00een
\nsec\u021biunea ACL \u2018acl_smtp_mail\u2019:\n<\/p>\n

deny condition = ${if eq{\\}{${substr{-1}{1}{$tls_in_sni}}}}
\n deny condition = ${if eq{\\}{${substr{-1}{1}{$tls_in_peerdn}}}}<\/p>\n

<\/a><\/noindex><\/p>\n

Sursa: opennet.ro<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0439 \u0432\u044b\u043f\u0443\u0441\u043a Exim 4.92.2 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2019-15846), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u0440\u0438 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 TLS \u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u043e\u0433\u043e \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 \u0438\u043b\u0438 \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0432 SNI. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Qualys. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0435 \u044d\u043a\u0440\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u043f\u0435\u0446\u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-37876","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Detalii despre vulnerabilitatea critic\u0103 \u00een Exim | ProHoster","description":"A fost publicat un patch corectiv pentru Exim.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/raskryty-podrobnosti-kriticheskoj-uyazvimosti-v-exim","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Exim | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0439 \u0432\u044b\u043f\u0443\u0441\u043a Exim.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/raskryty-podrobnosti-kriticheskoj-uyazvimosti-v-exim","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:20:17+00:00","article:modified_time":"2019-10-31T19:20:17+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37876","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 19:36:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:19:22","updated":"2026-01-23 19:36:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/37876","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=37876"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/37876\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=37876"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=37876"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=37876"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}