{"id":38040,"date":"2019-10-31T22:21:20","date_gmt":"2019-10-31T19:21:20","guid":{"rendered":"https:\/\/prohoster.info\/blog\/propatchil-exim-propatch-eshhe-raz-svezhee-remote-command-execution-v-exim-4-92-v-odin-zapros\/"},"modified":"2021-02-01T11:37:46","modified_gmt":"2021-02-01T09:37:46","slug":"propatchil-exim-propatch-eshhe-raz-svezhee-remote-command-execution-v-exim-4-92-v-odin-zapros","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/propatchil-exim-propatch-eshhe-raz-svezhee-remote-command-execution-v-exim-4-92-v-odin-zapros","title":{"rendered":"Patche Exim - aplikujte ho e\u0161te raz. Nov\u00e1 zranite\u013enos\u0165 vzdialen\u00e9ho vykon\u00e1vania pr\u00edkazov v Exim 4.92 na jeden po\u017eiadavok","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Patche<\/p>\n

Len ned\u00e1vno, na za\u010diatku leta, sa objavili hromadn\u00e9 v\u00fdzvy na aktualiz\u00e1ciu Exim na verziu 4.92 kv\u00f4li zranite\u013enosti CVE-2019-10149 (Urgentne aktualizujte exim na 4.92 \u2013 prebieha akt\u00edvne nakazenie \/ Habr<\/a><\/noindex>). A ned\u00e1vno sa zistilo, \u017ee \u0161kodliv\u00fd Sustes sa rozhodol vyu\u017ei\u0165 t\u00fato zranite\u013enos\u0165.<\/p>\n

Teraz sa v\u0161etci, ktor\u00ed sa n\u00fadzovo aktualizovali, m\u00f4\u017eu op\u00e4\u0165 \u201ete\u0161i\u0165\u201c: 21. j\u00fala 2019 v\u00fdskumn\u00edk Zerons objavil kritick\u00fa zranite\u013enos\u0165 v Exim Mail Transfer agent (MTA) pri pou\u017e\u00edvan\u00ed TLS<\/strong> pre verzie od 4.80 do 4.92.1<\/strong> vr\u00e1tane, \u010do umo\u017e\u0148uje vzdialene vykon\u00e1va\u0165 k\u00f3d s privilegovan\u00fdmi pr\u00e1vami<\/strong> (CVE-2019-15846<\/a><\/noindex>).<\/p>\n

<\/a><\/noindex><\/p>\n

Zranite\u013enos\u0165<\/h3>\n

Zranite\u013enos\u0165 sa vyskytuje pri pou\u017e\u00edvan\u00ed kni\u017en\u00edc ako GnuTLS, tak aj OpenSSL pri nastaven\u00ed zabezpe\u010den\u00e9ho TLS spojenia.<\/p>\n

Pod\u013ea slov v\u00fdvoj\u00e1ra Heika Schlittermanna s\u00fa konfigura\u010dn\u00e9 s\u00fabory v Exim predvolene nastaven\u00e9 tak, aby nepou\u017e\u00edvali TLS, av\u0161ak mnoh\u00e9 distrib\u00facie po\u010das in\u0161tal\u00e1cie vytv\u00e1raj\u00fa potrebn\u00e9 certifik\u00e1ty a zah\u0155\u0148aj\u00fa zabezpe\u010den\u00e9 spojenie. Tie\u017e nov\u0161ie verzie Exim nastavuj\u00fa mo\u017enos\u0165 tls_advertise_hosts=*<\/em> a generuj\u00fa potrebn\u00e9 certifik\u00e1ty.<\/p>\n

z\u00e1vis\u00ed od konfigur\u00e1cie. V\u00e4\u010d\u0161ina distrib\u00faci\u00ed to povol\u00ed predvolene, ale Exim potrebuje certifik\u00e1t + k\u013e\u00fa\u010d, aby fungoval ako server TLS. Pravdepodobne distrib\u00facie vytvor\u00ed certifik\u00e1t po\u010das nastavenia. Nov\u0161ie verzie Eximu maj\u00fa predvolene mo\u017enos\u0165 tls_advertise_hosts nastaven\u00fa na «*» a vytv\u00e1raj\u00fa samostatne podp\u00edsan\u00fd certifik\u00e1t, ak nie je poskytnut\u00fd.<\/p><\/blockquote>\n

Samotn\u00e1 zranite\u013enos\u0165 spo\u010d\u00edva v nespr\u00e1vnom spracovan\u00ed SNI (Server Name Indication, technol\u00f3gia zaveden\u00e1 v roku 2003 v RFC 3546 na po\u017eiadanie klienta o spr\u00e1vny certifik\u00e1t pre dom\u00e9nov\u00e9 meno, \u0160\u00edrenie \u0161tandardu TLS SNI \/ Blog spolo\u010dnosti WEBO Group \/ Habr<\/a><\/noindex>) po\u010das TLS handshake. \u00dato\u010dn\u00edkovi sta\u010d\u00ed posla\u0165 SNI, ktor\u00fd kon\u010d\u00ed sp\u00e4tn\u00fdm lom\u00edtkom («») a nulov\u00fdm symbolom (» «).<\/p>\n

V\u00fdskumn\u00edci z firmy Qualys objavili chybu vo funkcii string_printing(tls_in.sni), ktor\u00e1 spo\u010d\u00edva v nespr\u00e1vnom \u00fanikovan\u00ed «». V d\u00f4sledku toho sa do s\u00faboru hlavi\u010diek print spool zapisuje sp\u00e4tn\u00e9 lom\u00edtko v neunikovanej podobe. Potom sa tento s\u00fabor s privil\u00e9giami \u010d\u00edta funkciou spool_read_header(), \u010do vedie k prete\u010deniu hromady (heap overflow).<\/p>\n

Je potrebn\u00e9 poznamena\u0165, \u017ee v s\u00fa\u010dasnosti v\u00fdvoj\u00e1ri Exim vytvorili PoC zranite\u013enosti s vykonan\u00edm pr\u00edkazov na vzdialenom zranite\u013enom serveri, ale v verejnom pr\u00edstupe zatia\u013e nie je. Vzh\u013eadom na jednoduchos\u0165 vyu\u017eitia chyby je to len ot\u00e1zka \u010dasu, a to dos\u0165 kr\u00e1tkeho.<\/strong><\/p>\n

S podrobnej\u0161\u00edm v\u00fdskumom spolo\u010dnosti Qualys sa m\u00f4\u017eete obozn\u00e1mi\u0165 tu<\/a><\/noindex>.<\/p>\n

\"Patche<\/p>\n

Pou\u017e\u00edvanie SNI v TLS<\/em><\/p>\n

Po\u010det potenci\u00e1lne zranite\u013en\u00fdch verejn\u00fdch serverov<\/h3>\n

Pod\u013ea \u0161tatist\u00edk ve\u013ek\u00e9ho poskytovate\u013ea hostingu E-Soft Inc<\/strong> k 1. septembru sa na prenajat\u00fdch serveroch verzia 4.92 pou\u017e\u00edva na viac ako 70 % hostov.<\/p>\n

Verzia
\nPo\u010det serverov
\nPercento<\/p>\n

4.92.1
\n6471
\n1.28%<\/p>\n

4.92<\/strong>
\n376436<\/strong>
\n74.22%<\/strong><\/p>\n

4.91
\n58179
\n11.47%<\/p>\n

4.9
\n5732
\n1.13%<\/p>\n

4.89
\n10700
\n2.11%<\/p>\n

4.87
\n14177
\n2.80%<\/p>\n

4.84
\n9937
\n1.96%<\/p>\n

In\u00e9 verzie
\n25568
\n5.04%<\/p>\n

\u0160tatistika spolo\u010dnosti E-Soft Inc<\/em><\/p>\n

Ak sa obr\u00e1time na vyh\u013ead\u00e1va\u010d Shodan<\/strong><\/a><\/noindex>, z 5 250 000 v datab\u00e1ze serverov:<\/p>\n