{"id":71318,"date":"2020-02-25T07:34:19","date_gmt":"2020-02-25T04:34:19","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimosti-v-opensmtpd-pozvolyayushhie-udalyonno-i-lokalno-poluchit-prava-root"},"modified":"2020-03-03T16:10:53","modified_gmt":"2020-03-03T13:10:53","slug":"uyazvimosti-v-opensmtpd-pozvolyayushhie-udalyonno-i-lokalno-poluchit-prava-root","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimosti-v-opensmtpd-pozvolyayushhie-udalyonno-i-lokalno-poluchit-prava-root","title":{"rendered":"Zranite\u013enosti v OpenSMTPD, ktor\u00e9 umo\u017e\u0148uj\u00fa vzdialen\u00e9 a lok\u00e1lne z\u00edskanie pr\u00e1v spr\u00e1vcu (root)","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Spolo\u010dnos\u0165 Qualys identifikovala<\/a><\/noindex> \u010fal\u0161iu vzdialen\u00fa kritick\u00fa zranite\u013enos\u0165 (CVE-2020-8794) v po\u0161tovom serveri OpenSMTPD<\/a><\/noindex>, vyv\u00edjanom projektom OpenBSD. Rovnako ako zisten\u00e1 na konci janu\u00e1ra zranite\u013enos\u0165<\/a><\/noindex>, nov\u00fd probl\u00e9m umo\u017e\u0148uje vzdialene vykona\u0165 \u013eubovo\u013en\u00e9 pr\u00edkazy shell na serveri s pr\u00e1vami pou\u017e\u00edvate\u013ea root. Zranite\u013enos\u0165 bola odstr\u00e1nen\u00e1<\/a><\/noindex> v vydan\u00ed OpenSMTPD 6.6.4p1<\/a><\/noindex>. <\/p>\n

Probl\u00e9m je sp\u00f4soben\u00fd chybou v k\u00f3de, ktor\u00fd zabezpe\u010duje doru\u010dovanie po\u0161ty na vzdialen\u00fd po\u0161tov\u00fd server (nie v k\u00f3de, ktor\u00fd spracov\u00e1va prich\u00e1dzaj\u00face spojenia). \u00datok je mo\u017en\u00fd ako na strane klienta, tak aj na strane servera. Na strane klienta je \u00fatok mo\u017en\u00fd v predvolenej konfigur\u00e1cii OpenSMTPD, v ktorej OpenSMTPD akceptuje po\u017eiadavky iba na vn\u00fatornom sie\u0165ovom rozhran\u00ed (localhost) a odosiela po\u0161tov\u00e9 spr\u00e1vy na extern\u00e9 servery. Na vykonanie zranite\u013enosti sta\u010d\u00ed, aby po\u010das doru\u010dovania e-mailu OpenSMTPD nadviazal rel\u00e1ciu s po\u0161tov\u00fdm serverom ovl\u00e1dan\u00fdm \u00fato\u010dn\u00edkom, alebo aby \u00fato\u010dn\u00edk mohol zasiahnu\u0165 do spojenia klienta (MITM alebo presmerovanie po\u010das \u00fatokov cez DNS alebo BGP).<\/p>\n

Na \u00fatok na strane servera je potrebn\u00e9, aby bol OpenSMTPD nastaven\u00fd na prij\u00edmanie extern\u00fdch sie\u0165ov\u00fdch po\u017eiadaviek od in\u00fdch po\u0161tov\u00fdch serverov alebo obsluhoval extern\u00e9 slu\u017eby, ktor\u00e9 umo\u017e\u0148uj\u00fa zasla\u0165 po\u017eiadavku na \u013eubovo\u013en\u00fd e-mail (napr\u00edklad formul\u00e1re potvrdzuj\u00face adresu na webov\u00fdch str\u00e1nkach). Napr\u00edklad \u00fato\u010dn\u00edk sa m\u00f4\u017ee pripoji\u0165 k serveru OpenSMTPD a odosla\u0165 neplatn\u00fd e-mail (neexistuj\u00facemu pou\u017e\u00edvate\u013eovi), \u010do sp\u00f4sob\u00ed sp\u00e4tn\u00fa reakciu s chybov\u00fdm k\u00f3dom (bounce) na server \u00fato\u010dn\u00edka. \u00dato\u010dn\u00edk m\u00f4\u017ee zranite\u013enos\u0165 vyu\u017ei\u0165 v okamihu, ke\u010f sa OpenSMTPD pripoj\u00ed na doru\u010denie ozn\u00e1menia na server \u00fato\u010dn\u00edka. Vlo\u017eenej po\u010das \u00fatoku shell-pr\u00edkazy sa ukladaj\u00fa do s\u00faboru, ktor\u00fd sa vykon\u00e1 s pr\u00e1vami root pri re\u0161tartovan\u00ed OpenSMTPD, preto \u00fato\u010dn\u00edk mus\u00ed na potvrdenie \u00fatoku po\u010dka\u0165 na re\u0161tart OpenSMTPD alebo iniciova\u0165 p\u00e1d OpenSMTPD.<\/p>\n

Probl\u00e9m spo\u010d\u00edva vo funkcii mta_io() v k\u00f3de na anal\u00fdzu viacriadkov\u00e9ho odpovede, ktor\u00e9 vr\u00e1ti vzdialen\u00fd server po nadviazan\u00ed spojenia (napr\u00edklad \u201e250-ENHANCEDSTATUSCODES\u201c a \u201e250 HELP\u201c). V OpenSMTPD sa predpoklad\u00e1, \u017ee prv\u00fd riadok obsahuje trojcifern\u00e9 \u010d\u00edslo a text oddelen\u00e9 znakom \u201e-\u201c, a druh\u00fd riadok trojcifern\u00e9 \u010d\u00edslo a text oddelen\u00e9 medzerou. Ak vo druhom riadku za trojcifern\u00fdm \u010d\u00edslom nasleduje text bez medzery, ukazovate\u013e pou\u017eit\u00fd na ur\u010denie textu sa nastav\u00ed na bajt nasleduj\u00faci za znakom '0' a pok\u00fa\u0161a sa skop\u00edrova\u0165 do vyrovn\u00e1vacej pam\u00e4te d\u00e1ta nasleduj\u00face za koncom riadka.<\/p>\n

Na \u017eiados\u0165 projektu OpenBSD bola publik\u00e1cia podrobnost\u00ed o zneu\u017eite\u013enosti odlo\u017een\u00e1 do 26. febru\u00e1ra, aby sa pou\u017e\u00edvate\u013eom umo\u017enilo aktualizova\u0165 svoje syst\u00e9my. Probl\u00e9m sa nach\u00e1dza v k\u00f3dovej z\u00e1kladni od decembra 2015, ale zneu\u017eitie umo\u017e\u0148uj\u00face vykonanie k\u00f3du s pr\u00e1vami root je mo\u017en\u00e9 od m\u00e1ja 2018. V\u00fdskumn\u00edci pripravili funk\u010dn\u00fd prototyp exploit-u, ktor\u00fd bol \u00faspe\u0161ne testovan\u00fd na zostav\u00e1ch OpenSMTPD pre OpenBSD 6.6, OpenBSD 5.9, Debian 10, Debian 11 (testing) a Fedora 31. <\/p>\n

V OpenSMTPD sa nach\u00e1dza bola zisten\u00e1<\/a><\/noindex> e\u0161te jedna zranite\u013enos\u0165 (CVE-2020-8793), ktor\u00e1 umo\u017e\u0148uje lok\u00e1lnemu pou\u017e\u00edvate\u013eovi pre\u010d\u00edta\u0165 prv\u00fd riadok ak\u00e9hoko\u013evek s\u00faboru v syst\u00e9me. Napr\u00edklad je mo\u017en\u00e9 pre\u010d\u00edta\u0165 prv\u00fd riadok \/etc\/master.passwd, kde je ulo\u017een\u00fd hash hesla pou\u017e\u00edvate\u013ea root. Zranite\u013enos\u0165 tie\u017e umo\u017e\u0148uje pre\u010d\u00edta\u0165 cel\u00fd obsah s\u00faboru, ktor\u00fd patr\u00ed in\u00e9mu pou\u017e\u00edvate\u013eovi, ak sa tento s\u00fabor nach\u00e1dza v tej istej FS ako adres\u00e1r \/var\/spool\/smtpd\/. Probl\u00e9m nie je zneu\u017eite\u013en\u00fd vo viacer\u00fdch distrib\u00faci\u00e1ch Linuxu, v ktor\u00fdch je hodnota \/proc\/sys\/fs\/protected_hardlinks nastaven\u00e1 na 1. <\/p>\n

Probl\u00e9m je d\u00f4sledkom ne\u00fapln\u00e9ho odstr\u00e1nenia probl\u00e9mom<\/a><\/noindex>, ktor\u00e9 boli uveden\u00e9 po\u010das auditu vykonan\u00e9ho spolo\u010dnos\u0165ou Qualys v roku 2015. \u00dato\u010dn\u00edk m\u00f4\u017ee dosiahnu\u0165 vykonanie svojho k\u00f3du s pr\u00e1vami skupiny \u201e_smtpq\u201c, ke\u010f nastav\u00ed premenn\u00fa \u201ePATH=.\u201c, a umiestni v aktu\u00e1lnom adres\u00e1ri skript s n\u00e1zvom makemap (n\u00e1stroj smtpctl sp\u00fa\u0161\u0165a makemap bez v\u00fdslovn\u00e9ho uvedenia cesty). Z\u00edskan\u00edm pr\u00edstupu k skupine \u201e_smtpq\u201c m\u00f4\u017ee \u00fato\u010dn\u00edk vyvola\u0165 stav pretekania (vytvori\u0165 ve\u013ek\u00fd s\u00fabor v adres\u00e1ri offline a posla\u0165 sign\u00e1l SIGSTOP) a pred dokon\u010den\u00edm spracovania zmeni\u0165 s\u00fabor v adres\u00e1ri offline na tvrd\u00fd symbolick\u00fd odkaz, ktor\u00fd ukazuje na cie\u013eov\u00fd s\u00fabor, ktor\u00e9ho obsah treba pre\u010d\u00edta\u0165.<\/p>\n

Zauj\u00edmav\u00e9 je, \u017ee vo Fedore 31 zranite\u013enos\u0165 umo\u017e\u0148uje okam\u017eit\u00e9 z\u00edskanie privil\u00e9gi\u00ed skupiny root, preto\u017ee proces smtpctl m\u00e1 flag setgid root namiesto setgid smtpq. Z\u00edskan\u00edm pr\u00edstupu do skupiny root je mo\u017en\u00e9 prepisova\u0165 obsah \/var\/lib\/sss\/mc\/passwd a z\u00edska\u0165 pln\u00fd root pr\u00edstup v syst\u00e9me.<\/p>\n

<\/a><\/noindex><\/p>\n

Zdroj: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0435\u0449\u0451 \u043e\u0434\u043d\u0443 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u0443\u044e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-8794) \u0432 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 OpenSMTPD, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u043e\u043c \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c OpenBSD. \u041a\u0430\u043a \u0438 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u0430\u044f \u0432 \u043a\u043e\u043d\u0446\u0435 \u044f\u043d\u0432\u0430\u0440\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043d\u043e\u0432\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0434\u0430\u0451\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b shell \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f root. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0435 OpenSMTPD 6.6.4p1. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043e\u0448\u0438\u0431\u043a\u043e\u0439 \u0432 \u043a\u043e\u0434\u0435, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u044e\u0449\u0435\u043c \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0443 \u043f\u043e\u0447\u0442\u044b \u043d\u0430 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u044b\u0439 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-71318","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranite\u013enosti v OpenSMTPD, ktor\u00e9 umo\u017e\u0148uj\u00fa vzdialen\u00fd a lok\u00e1lny pr\u00edstup k pr\u00e1vam root | ProHoster","description":"Spolo\u010dnos\u0165 Qualys identifikovala \u010fal\u0161iu vzdialen\u00fa kritick\u00fa zranite\u013enos\u0165 (CVE-2020-8794) v po\u0161tovom serveri.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimosti-v-opensmtpd-pozvolyayushhie-udalyonno-i-lokalno-poluchit-prava-root","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 OpenSMTPD, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0438 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0435\u0449\u0451 \u043e\u0434\u043d\u0443 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u0443\u044e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-8794) \u0432 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimosti-v-opensmtpd-pozvolyayushhie-udalyonno-i-lokalno-poluchit-prava-root","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-25T04:34:19+00:00","article:modified_time":"2020-03-03T13:10:53+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"71318","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:04:24","updated":"2022-09-28 08:07:40","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/71318","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=71318"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/71318\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=71318"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=71318"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=71318"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}