{"id":82266,"date":"2020-05-20T19:42:07","date_gmt":"2020-05-20T17:42:07","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/udalyonno-ekspluatiruemaya-uyazvimost-v-pochtovom-servere-qmail"},"modified":"2020-05-20T19:42:07","modified_gmt":"2020-05-20T17:42:07","slug":"udalyonno-ekspluatiruemaya-uyazvimost-v-pochtovom-servere-qmail","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/udalyonno-ekspluatiruemaya-uyazvimost-v-pochtovom-servere-qmail","title":{"rendered":"O vulnerabilitate exploatabil\u0103 de la distan\u021b\u0103 \u00een serverul de e-mail qmail","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Cercet\u0103torii de securitate de la compania Qualys s-a prezentat<\/a><\/noindex> posibilitatea exploat\u0103rii<\/a><\/noindex> vulnerabilit\u0103\u021bile din serverul de email qmail, cunoscut\u0103<\/a><\/noindex> \u00eenc\u0103 din 2005 (CVE-2005-1513), dar a r\u0103mas nerezolvat\u0103, deoarece autorul qmail a sus\u021binut c\u0103 este nerealist s\u0103 se creeze un exploit func\u021bional care ar putea fi folosit pentru a ataca sistemele \u00een configura\u021bia implicit\u0103. La Qualys, s-a reu\u0219it preg\u0103tirea unui exploit care contrazice aceast\u0103 presupunere \u0219i permite ini\u021bierea execut\u0103rii de cod de la distan\u021b\u0103 pe server prin trimiterea unui mesaj format special.<\/p>\n

Problema este cauzat\u0103 de o dep\u0103\u0219ire a num\u0103rului \u00eentreg \u00een func\u021bia stralloc_readyplus(), care poate ap\u0103rea la procesarea unui mesaj foarte mare. Pentru exploatare era necesar un sistem pe 64 de bi\u021bi cu mai mult de 4 GB de memorie virtual\u0103. La analiza ini\u021bial\u0103 a vulnerabilit\u0103\u021bii \u00een 2005, Daniel Bernstein a afirmat c\u0103 presupunerea din cod c\u0103 dimensiunea array-ului alocat se \u00eencadreaz\u0103 \u00eentotdeauna \u00eentr-o valoare pe 32 de bi\u021bi se bazeaz\u0103 pe ideea c\u0103 nimeni nu ofer\u0103 gigabytes de memorie fiec\u0103rui proces. \u00cen ultimii 15 ani, sistemele pe 64 de bi\u021bi pe servere au \u00eenlocuit sistemele pe 32 de bi\u021bi, volumul de memorie livrat a crescut radical \u0219i capacitatea de band\u0103 a re\u021belelor. <\/p>\n

Pachetele \u00eenso\u021bitoare ale qmail au \u021binut cont de observa\u021bia lui Bernstein \u0219i, la ini\u021bierea procesului qmail-smtpd, au restric\u021bionat memoria disponibil\u0103 (de exemplu, \u00een Debian 10 este setat un limit\u0103 de 7MB). \u00cens\u0103 inginerii de la Qualys au descoperit c\u0103 aceasta nu este suficient \u0219i, pe l\u00e2ng\u0103 qmail-smtpd, un atac de la distan\u021b\u0103 poate fi efectuat \u0219i asupra procesului qmail-local, care \u00een toate pachetele verificate a r\u0103mas f\u0103r\u0103 restric\u021bii. Ca dovad\u0103, a fost preg\u0103tit un prototip de exploit potrivit pentru atacul asupra pachetului qmail livrat \u00een Debian \u00een configura\u021bia implicit\u0103.
\nPentru a organiza executarea de cod de la distan\u021b\u0103 \u00een timpul atacului, este necesar ca pe server s\u0103 existe 4GB de spa\u021biu liber pe disc \u0219i 8GB de RAM.
\nExploitul permite executarea oric\u0103ror comenzi shell cu permisiunile oric\u0103rui utilizator din sistem, cu excep\u021bia utilizatorilor root \u0219i a utilizatorilor de sistem care nu au un subdirector \u00een directorul \"\/home\" (procesul qmail-local este ini\u021biat cu permisiunile utilizatorului local c\u0103ruia i se face livrarea).<\/p>\n

Atacul se desf\u0103\u0219oar\u0103
\nprin trimiterea unui mesaj po\u0219tal foarte mare, incluz\u00e2nd mai multe r\u00e2nduri \u00een antet, cu o dimensiune de aproximativ 4GB \u0219i 576MB. Procesarea unui astfel de r\u00e2nd \u00een qmail-local duce la o dep\u0103\u0219ire a capacit\u0103\u021bii \u00eentregi \u00een timpul livr\u0103rii mesajului c\u0103tre utilizatorul local. Dep\u0103\u0219irea capacit\u0103\u021bii duce ulterior la o dep\u0103\u0219ire a buffer-ului \u00een timpul copiei datelor \u0219i posibilitatea de a suprascrie paginile de memorie cu codul libc. Prin manipularea structurii datelor transmise, se poate, de asemenea, suprascrie adresa func\u021biei \"open()\", \u00eenlocuind-o cu adresa func\u021biei \"system()\". <\/p>\n

\u00cen continuare, \u00een procesul apel\u0103rii qmesearch() \u00een qmail-local, se deschide fi\u0219ierul \".qmail-extension\" prin func\u021bia open(), care duce la lansarea efectiv\u0103 a func\u021biei
\nsystem(\".qmail-extension\"). Dar, deoarece o parte din fi\u0219ierul \"extension\" este generat\u0103 pe baza adresei destinatarului (de exemplu, \"localuser-extension@localdomain\"), atacatorii pot organiza transmiterea unei comenzi de executat, specific\u00e2nd utilizatorul \"localuser-;command;@localdomain\" ca destinatar al mesajului. <\/p>\n

\u00cen analiza codului au fost identificate de asemenea dou\u0103 vulnerabilit\u0103\u021bi \u00een patchul suplimentar qmail-verify, care face parte din pachetul pentru Debian. Prima vulnerabilitate (CVE-2020-3811<\/a><\/noindex>) permite ocolirea verific\u0103rii adresei de email, iar a doua (CVE-2020-3812<\/a><\/noindex>) duce la scurgerea informa\u021biilor locale. \u00cen special, prima vulnerabilitate permite ocolirea verific\u0103rii corectitudinii adresei utilizate \u00een exploit pentru transmiterea comenzii (verificarea nu se activeaz\u0103 pentru adrese f\u0103r\u0103 domeniu, cum ar fi \"localuser-;command;\"). A doua vulnerabilitate poate fi utilizat\u0103 pentru a verifica existen\u021ba fi\u0219ierelor \u0219i directoarelor \u00een sistem, inclusiv cele accesibile doar pentru root (qmail-verify este ini\u021biat cu permisiunile root), prin acces direct la procesorul local.<\/p>\n

Pentru a ocoli problema, Bernstein a recomandat lansarea proceselor qmail cu stabilirea unei limite comune pentru memoria disponibil\u0103 (\"softlimit -m12345678\"), iar \u00een acest caz problema este blocat\u0103. Ca metod\u0103 alternativ\u0103 de protec\u021bie, se men\u021bioneaz\u0103 de asemenea limitarea dimensiunii maxime a mesajului procesat prin fi\u0219ierul \"control\/databytes\" (\u00een mod implicit nu se creeaz\u0103 cu set\u0103rile implicite, qmail r\u0103m\u00e2n\u00e2nd vulnerabil). \u00cen plus, \"control\/databytes\" nu protejeaz\u0103 \u00eempotriva atacurilor locale din partea utilizatorilor sistemului, deoarece limita este luat\u0103 \u00een considerare doar \u00een qmail-smtpd.<\/p>\n

Problema afecteaz\u0103 pachetul netqmail<\/a><\/noindex>, inclus \u00een repositoarele Debian. Pentru acest pachet a fost preg\u0103tit un set de patch-uri care elimin\u0103 at\u00e2t vulnerabilit\u0103\u021bile vechi din 2005 (prin ad\u0103ugarea \u00een cod a func\u021biei alloc() cu limite stricte de memorie), c\u00e2t \u0219i probleme recente \u00een qmail-verify. Separat preg\u0103tit<\/a><\/noindex> versiunea actualizat\u0103 a patch-ului qmail-verify. Dezvoltatorii ramifica\u021bia<\/a><\/noindex> notqmail<\/a><\/noindex> au preg\u0103tit patch-urile lor pentru a bloca problemele vechi \u0219i au \u00eenceput munca pentru a elimina toate posibilele dep\u0103\u0219iri de capacitate \u00een cod.<\/p>\n

<\/a><\/noindex><\/p>\n

Sursa: opennet.ro<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Qualys \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 qmail, \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0439 \u0435\u0449\u0451 \u0441 2005 \u0433\u043e\u0434\u0430 (CVE-2005-1513), \u043d\u043e \u043e\u0441\u0442\u0430\u0432\u0430\u0432\u0448\u0435\u0439\u0441\u044f \u043d\u0435\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u043e\u0439, \u0442\u0430\u043a \u043a\u0430\u043a \u0430\u0432\u0442\u043e\u0440 qmail \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u043b \u043e \u043d\u0435\u0440\u0435\u0430\u043b\u0438\u0441\u0442\u0438\u0447\u043d\u043e\u0441\u0442\u0438 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0435\u0433\u043e \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043c\u043e\u0433 \u0431\u044b \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e. \u0412 Qualys \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u0438\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u043e\u043f\u0440\u043e\u0432\u0435\u0440\u0433\u0430\u044e\u0449\u0438\u0439 \u0434\u0430\u043d\u043d\u043e\u0435 \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0438\u043d\u0438\u0446\u0438\u0438\u0440\u043e\u0432\u0430\u0442\u044c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-82266","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitate exploatabil\u0103 de la distan\u021b\u0103 \u00een serverul de mail qmail | ProHoster","description":"Cercet\u0103torii \u00een securitate de la Qualys au demonstrat posibilitatea","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/udalyonno-ekspluatiruemaya-uyazvimost-v-pochtovom-servere-qmail","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 qmail | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Qualys \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/udalyonno-ekspluatiruemaya-uyazvimost-v-pochtovom-servere-qmail","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-20T17:42:07+00:00","article:modified_time":"2020-05-20T17:42:07+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"82266","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 15:41:28","updated":"2022-09-27 18:41:59","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/82266","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=82266"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/82266\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=82266"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=82266"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=82266"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}