Kure kure kushandiswa kunokanganisa mu qmail mail server

Vaongorori vekuchengetedza kubva kuQualys yakaratidza mukana kushandiswa kushaya simba mu qmail mail server, mukurumbira kumashure muna 2005 (CVE-2005-1513), asi yakaramba isina kunyorwa nekuti munyori weqmail akapokana kuti zvaisaita kugadzira basa rinoshanda rinogona kushandiswa kurwisa masisitimu mune yekumisikidzwa. Qualys akakwanisa kugadzirira kushandiswa kunoramba fungidziro iyi uye inobvumira munhu kuti atange kure kure kodhi kuuraya pavhavha nekutumira meseji yakanyatsogadzirwa.

Dambudziko rinokonzerwa nekuwanda kwehuwandu mu stralloc_readyplus () basa, rinogona kuitika kana kugadzirisa mharidzo yakakura kwazvo. Kushanda kwaida 64-bit system ine inodarika 4GB yevirtual memory. Apo kukanganisa kwakatanga kuongororwa muna 2005, Daniel J. Bernstein akatsigira kuti fungidziro mukodhi iyo hukuru hwehuwandu hwakagoverwa hunogara huri mukati me32-bit kukosha kunobva pakuti hakuna munhu anopa gigabytes yekuyeuka kune imwe neimwe nzira. Kwemakore gumi nemashanu apfuura, 15-bit masisitimu pamaseva akatsiva 64-bit masisitimu, uye huwandu hwekuyeuka hwakapihwa uye network bandwidth yakawedzera zvakanyanya.

Iwo qmail mapakeji vanochengeta vakatora chinyorwa chaBernstein muakaunti uye vakaganhura ndangariro iripo pavakatanga iyo qmail-smtpd maitiro (semuenzaniso, muDebian 10 muganho wakaiswa ku7MB). Asi mainjiniya kubva kuQualys vakaona kuti izvi hazvina kukwana uye, mukuwedzera kune qmail-smtpd, kurwiswa kure kunogona kuitwa pane qmail-yenzvimbo maitiro, iyo yakaramba isina kurambidzwa mumapakeji ese akaedzwa. Sehumbowo, prototype yekubiridzira yakagadzirirwa iyo yaive yakakodzera kurwisa Debian package ine qmail mune yekumisikidzwa.
Kuronga kure kure kodhi kuuraya panguva yekurwiswa, sevha inoda 4GB yemahara disk nzvimbo uye 8GB ye RAM.
Iko kushandiswa kunokubvumira kuti umhanye chero mirairo yegomba nekodzero dzechero mushandisi muhurongwa, kunze kwemidzi uye vashandisi vehurongwa vasina yavo subdirectory mu "/ kumba" dhairekitori (iyo qmail-yenzvimbo maitiro inotangwa nekodzero. yemushandisi wepanzvimbo uyo anotumirwa).

Kurwiswa kunoitwa
kuburikidza nekutumira meseji yakakura kwazvo, kusanganisira mitsetse yemusoro yakati wandei, inoyera ingangoita 4GB uye 576MB. Kugadzira tambo yakadaro mu qmail-yenzvimbo inoguma mune yakazara kufashukira paunenge uchiedza kuendesa meseji kumushandisi wenzvimbo. Kufashukira kwakazara kunozotungamira kune buffer kufashukira paunenge uchikopa data uye mukana wekunyora mapeji endangariro ne libc kodhi. Nekugadzirisa marongerwo e data yakatumirwa, zvinokwanisika zvakare kunyora kero ye "open ()" basa, kuitsiva nekero ye "system ()" basa.

Zvadaro, mukuita kudana qmesearch () mu qmail-yemunharaunda, faira ".qmail-extension" inovhurwa kuburikidza neakavhurika () basa, rinotungamirira kukuita chaiko kwekuita basa.
system(".qmail-extension"). Asi sezvo chikamu che "wedzero" chefaira chichigadzirwa zvichienderana nekero yeari kugamuchira (semuenzaniso, "localuser-extension@localdomain"), vanorwisa vanogona kuronga kuti murairo utumirwe nekutsanangura mushandisi "localuser-; command. ;@localdomain” semunhu anogamuchira meseji.

Munguva yekuongorora kodhi, kusakwana kuviri kwakaonekwawo mune yekuwedzera qmail-verify chigamba, icho chiri chikamu chepasuru yeDebian. Kutanga kusagadzikana (CVE-2020-3811) inokutendera kuti upfuure email kero yekuongorora, uye yechipiri (CVE-2020-3812) inotungamira mukuburitswa kweruzivo rwenzvimbo. Kunyanya, kusazvibata kwekutanga kunotendera kuti upfuure nekuona kwechokwadi kwekero yakashandiswa mukushandisa kutumira murairo (iyo ongororo haishande kumakero asina dura, senge "localuser-; command;"). Kusagadzikana kwechipiri kunogona kushandiswa kutarisa kuvepo kwemafaira uye madhairekitori pane system, kusanganisira ayo anowanikwa chete kumidzi (qmail-verify inomhanya ine midzi kodzero), kuburikidza nekufona kwakananga kumugadziri wenzvimbo.

Kuti ushande kutenderedza dambudziko, Bernstein akakurudzira kumhanya qmail maitiro ane muganho wakazara pane iripo ndangariro ("softlimit -m12345678"), mune iyo nyaya dambudziko rakavharwa. Seimwe nzira yekudzivirira, kudzikisira saizi yakakura yemeseji yakagadziridzwa kuburikidza ne "control/databytes" faira inotaurwa zvakare (nedefault haina kugadzirwa ine default marongero, qmail inoramba iri panjodzi). Uye zvakare, "control/databytes" haidziviriri kurwiswa kwenzvimbo kubva kuvashandisi vehurongwa, sezvo muganho unongoverengerwa muqmail-smtpd.

Dambudziko rinokanganisa pasuru netqmail, inosanganisirwa muDebian repositories. Seti yezvigamba yakagadzirirwa pasuru iyi, ichibvisa zvese zvekare kusagadzikana kubva 2005 (nekuwedzera yakaoma yekurangarira miganho kune alloc () kodhi yebasa) uye matambudziko matsva muqmail-simbisa. Takaparadzana gadzirira yakagadziridzwa vhezheni yeiyo qmail-simbisa chigamba. Developers mapazi notqmail vakagadzirira zvigamba zvavo kuti vavhare matambudziko ekare, uye vakatangawo kushanda kuti vabvise zvese zvingangoitika zvakafashukira mukodhi.

Source: opennet.ru