{"id":71318,"date":"2020-02-25T07:34:19","date_gmt":"2020-02-25T04:34:19","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimosti-v-opensmtpd-pozvolyayushhie-udalyonno-i-lokalno-poluchit-prava-root"},"modified":"2020-03-03T16:10:53","modified_gmt":"2020-03-03T13:10:53","slug":"uyazvimosti-v-opensmtpd-pozvolyayushhie-udalyonno-i-lokalno-poluchit-prava-root","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-opensmtpd-pozvolyayushhie-udalyonno-i-lokalno-poluchit-prava-root","title":{"rendered":"Vulnerabilit\u0103\u021bi \u00een OpenSMTPD care permit ob\u021binerea de drepturi root de la distan\u021b\u0103 \u0219i local","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Compania Qualys a eviden\u021biat<\/a><\/noindex> o alt\u0103 vulnerabilitate critic\u0103 de la distan\u021b\u0103 (CVE-2020-8794) \u00een serverul de email , multiplexorul de terminal text (similar cu GNU screen)<\/a><\/noindex>, dezvoltat de proiectul OpenBSD. Ca \u0219i vulnerabilitatea identificat\u0103 la sf\u00e2r\u0219itul lunii ianuarie, vulnerabilitatea<\/a><\/noindex>, noua problem\u0103 ofer\u0103 posibilitatea execut\u0103rii de comenzi shell arbitrare pe server cu drepturi de utilizator root. Vulnerabilitatea remediat\u0103<\/a><\/noindex> \u00een versiunea OpenSMTPD 6.6.4p1<\/a><\/noindex>. <\/p>\n

Problema este cauzat\u0103 de o eroare \u00een codul care se ocup\u0103 cu livrarea emailurilor pe serverele de email externe (nu \u00een codul care proceseaz\u0103 conexiunile de intrare). Atacul poate avea loc at\u00e2t pe partea clientului, c\u00e2t \u0219i pe partea serverului. Pe partea clientului, atacul este posibil \u00een configura\u021bia implicit\u0103 OpenSMTPD, \u00een care OpenSMTPD accept\u0103 cereri doar pe interfa\u021ba de re\u021bea intern\u0103 (localhost) \u0219i trimite mesaje de email pe servere externe. Pentru a exploata vulnerabilitatea, este suficient ca \u00een timpul livr\u0103rii unui email, OpenSMTPD s\u0103 stabileasc\u0103 o sesiune cu un server de email controlat de atacator sau ca atacatorul s\u0103 se poat\u0103 interfera \u00een conexiunea clientului (MITM sau redirec\u021bionare \u00een timpul atacurilor prin DNS sau BGP).<\/p>\n

Pentru a ataca pe partea serverului, OpenSMTPD trebuie configurat pentru a accepta cereri externe de la alte servere de email sau s\u0103 ofere servicii externe care permit trimiterea de cereri pentru un email arbitrariu (de exemplu, formulare de confirmare a adresei pe site-uri). De exemplu, un atacator poate s\u0103 se conecteze la serverul OpenSMTPD \u0219i s\u0103 trimit\u0103 un email invalid (c\u0103tre un utilizator inexistent), ceea ce va duce la trimiterea unui email de r\u0103spuns cu un cod de eroare (bounce) c\u0103tre serverul atacatorului. Atacatorul poate exploata vulnerabilitatea \u00een momentul \u00een care OpenSMTPD se conecteaz\u0103 pentru a livra notificarea pe serverul atacatorului. Comenzile shell injectate \u00een timpul atacului sunt plasate \u00eentr-un fi\u0219ier care este executat cu drepturi de root la repornirea OpenSMTPD, a\u0219a c\u0103 atacatorul trebuie s\u0103 a\u0219tepte repornirea OpenSMTPD sau s\u0103 ini\u021bieze o c\u0103dere a OpenSMTPD.<\/p>\n

Problema apare \u00een func\u021bia mta_io() din codul pentru analiza r\u0103spunsului multilinie, returnat de serverul \u00eendep\u0103rtat dup\u0103 stabilirea conexiunii (de exemplu, \u00ab250-ENHANCEDSTATUSCODES\u00bb \u0219i \u00ab250 HELP\u00bb). \u00cen OpenSMTPD, se consider\u0103 c\u0103 prima linie include un num\u0103r de trei cifre \u0219i text, separate prin caracterul \u00ab-\u00bb, iar a doua linie un num\u0103r de trei cifre \u0219i text, separate printr-un spa\u021biu. Dac\u0103 \u00een a doua linie nu urmeaz\u0103 un spa\u021biu \u0219i text dup\u0103 num\u0103rul de trei cifre, indicatorul folosit pentru a determina textul este setat pe byte-ul urm\u0103tor caracterului \u2018\u2019 \u0219i se \u00eencearc\u0103 copierea \u00een bufferul de date care urmeaz\u0103 dup\u0103 sf\u00e2r\u0219itul liniei.<\/p>\n

La cererea proiectului OpenBSD, publicarea detaliilor despre exploatarea vulnerabilit\u0103\u021bii a fost am\u00e2nat\u0103 p\u00e2n\u0103 pe 26 februarie, pentru a oferi utilizatorilor oportunitatea de a-\u0219i actualiza sistemele. Problema este prezent\u0103 \u00een codul de baz\u0103 din decembrie 2015, \u00eens\u0103 exploatarea pentru execu\u021bia codului cu privilegii root este posibil\u0103 din mai 2018. Cercet\u0103torii au preg\u0103tit un prototip de exploit func\u021bional, care a fost testat cu succes \u00een versiunile OpenSMTPD pentru OpenBSD 6.6, OpenBSD 5.9, Debian 10, Debian 11 (testing) \u0219i Fedora 31. <\/p>\n

\u00cen OpenSMTPD exist\u0103 \u0219i a fost identificat\u0103<\/a><\/noindex> o alt\u0103 vulnerabilitate (CVE-2020-8793), care permite unui utilizator local s\u0103 citeasc\u0103 prima linie a oric\u0103rui fi\u0219ier din sistem. De exemplu, este posibil s\u0103 se citeasc\u0103 prima linie \/etc\/master.passwd, \u00een care este stocat hash-ul parolei utilizatorului root. Vulnerabilitatea permite, de asemenea, citirea \u00eentregului con\u021binut al unui fi\u0219ier apar\u021bin\u00e2nd unui alt utilizator, dac\u0103 acel fi\u0219ier se afl\u0103 \u00een aceea\u0219i FS cu directorul \/var\/spool\/smtpd\/. Problema nu este exploatabil\u0103 \u00een multe distribu\u021bii Linux, \u00een care valoarea \/proc\/sys\/fs\/protected_hardlinks este setat\u0103 pe 1. <\/p>\n

Problema este rezultatul unei elimin\u0103ri incomplete problemelor<\/a><\/noindex>, men\u021bionate \u00een timpul auditului efectuat de Qualys \u00een 2015. Atacatorul poate ob\u021bine executarea codului s\u0103u cu drepturile grupului \u00ab_smtpq\u00bb, set\u00e2nd variabila \u00abPATH=.\u00bb \u0219i plas\u00e2nd \u00een directorul curent un script numit makemap (utilitarul smtpctl ruleaz\u0103 makemap f\u0103r\u0103 a specifica explicit calea). Ob\u021bin\u00e2nd acces la grupul \u00ab_smtpq\u00bb, atacatorul poate genera o stare de competi\u021bie (crea un fi\u0219ier mare \u00een directorul offline \u0219i trimite un semnal SIGSTOP) \u0219i, p\u00e2n\u0103 la finalizarea proces\u0103rii, poate \u00eenlocui fi\u0219ierul din directorul offline cu un link simbolic tare care indic\u0103 fi\u0219ierul \u021bint\u0103, al c\u0103rui con\u021binut trebuie citit.<\/p>\n

Este remarcabil c\u0103 \u00een Fedora 31 vulnerabilitatea permite ob\u021binerea imediat\u0103 a privilegiilor grupului root, deoarece procesul smtpctl este dotat cu un flag setgid root, \u00een loc de setgid smtpq. Ob\u021bin\u00e2nd acces la grupul root, se poate rescrie con\u021binutul \/var\/lib\/sss\/mc\/passwd \u0219i se poate ob\u021bine acces complet root \u00een sistem.<\/p>\n

<\/a><\/noindex><\/p>\n

Sursa: opennet.ro<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0435\u0449\u0451 \u043e\u0434\u043d\u0443 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u0443\u044e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-8794) \u0432 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 OpenSMTPD, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u043e\u043c \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c OpenBSD. \u041a\u0430\u043a \u0438 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u0430\u044f \u0432 \u043a\u043e\u043d\u0446\u0435 \u044f\u043d\u0432\u0430\u0440\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043d\u043e\u0432\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0434\u0430\u0451\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b shell \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f root. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0435 OpenSMTPD 6.6.4p1. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043e\u0448\u0438\u0431\u043a\u043e\u0439 \u0432 \u043a\u043e\u0434\u0435, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u044e\u0449\u0435\u043c \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0443 \u043f\u043e\u0447\u0442\u044b \u043d\u0430 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u044b\u0439 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-71318","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Vulnerabilit\u0103\u021bile din OpenSMTPD, care permit ob\u021binerea drepturilor root at\u00e2t de la distan\u021b\u0103, c\u00e2t \u0219i local | ProHoster","description":"Compania Qualys a descoperit \u00eenc\u0103 o vulnerabilitate critic\u0103 la distan\u021b\u0103 (CVE-2020-8794) \u00een serverul de po\u0219t\u0103.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-opensmtpd-pozvolyayushhie-udalyonno-i-lokalno-poluchit-prava-root","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 OpenSMTPD, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0438 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0435\u0449\u0451 \u043e\u0434\u043d\u0443 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u0443\u044e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-8794) \u0432 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-opensmtpd-pozvolyayushhie-udalyonno-i-lokalno-poluchit-prava-root","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-25T04:34:19+00:00","article:modified_time":"2020-03-03T13:10:53+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"71318","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:04:24","updated":"2022-09-28 08:07:40","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/71318","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=71318"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/71318\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=71318"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=71318"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=71318"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}