{"id":35011,"date":"2019-10-31T22:01:50","date_gmt":"2019-10-31T19:01:50","guid":{"rendered":"https:\/\/prohoster.info\/blog\/kriticheskaya-uyazvimost-v-exim-pozvolyayushhaya-vypolnit-kod-na-servere-s-pravami-root\/"},"modified":"2019-10-31T22:01:50","modified_gmt":"2019-10-31T19:01:50","slug":"kriticheskaya-uyazvimost-v-exim-pozvolyayushhaya-vypolnit-kod-na-servere-s-pravami-root","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/kriticheskaya-uyazvimost-v-exim-pozvolyayushhaya-vypolnit-kod-na-servere-s-pravami-root","title":{"rendered":"Vulnerabilitet kritik n\u00eb Exim, i lejon ekzekutimin e kodit n\u00eb server me t\u00eb drejtat e rootit.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

N\u00eb serverin e post\u00ebs Exim u identifikua<\/a><\/noindex> kritike vulnerabiliteti<\/a><\/noindex> (CVE-2019-10149<\/a><\/noindex>), e cila mund t\u00eb \u00e7oj\u00eb n\u00eb ekzekutimin e kodit n\u00eb distanc\u00eb n\u00eb server me t\u00eb drejtat root gjat\u00eb p\u00ebrpunimit t\u00eb nj\u00eb k\u00ebrkese t\u00eb strukturuar posa\u00e7\u00ebrisht. Mund\u00ebsia e shfryt\u00ebzimit t\u00eb \u00e7\u00ebshtjes \u00ebsht\u00eb v\u00ebn\u00eb re n\u00eb versionet nga 4.87 deri n\u00eb 4.91 p\u00ebrfshire ose gjat\u00eb nd\u00ebrtimit me opsionin EXPERIMENTAL_EVENT.<\/p>\n

N\u00eb konfigurimin e paracaktuar, nj\u00eb sulm mund t\u00eb kryhet pa nd\u00ebrlikime t\u00eb tep\u00ebrta nga nj\u00eb p\u00ebrdorues lokal, p\u00ebr shkak se aplikohet ACL \u00abverify = recipient\u00bb, e cila kryen kontrolle shtes\u00eb p\u00ebr adresat e jashtme. Kryerja e nj\u00eb sulmi t\u00eb larg\u00ebt \u00ebsht\u00eb e mundur n\u00ebse ndryshohen cil\u00ebsimet, p\u00ebr shembull, kur punon si MX i dyt\u00eb p\u00ebr nj\u00eb domain tjet\u00ebr, duke hequr ACL \u00abverify = recipient\u00bb ose duke b\u00ebr\u00eb ndryshime t\u00eb caktuara n\u00eb local_part_suffix. Nj\u00eb sulm i larg\u00ebt \u00ebsht\u00eb gjithashtu i mundur n\u00ebse nj\u00eb agresor \u00ebsht\u00eb n\u00eb gjendje t\u00eb mbaj\u00eb lidhjen me serverin t\u00eb hapur p\u00ebr 7 dit\u00eb (p\u00ebr shembull, duke d\u00ebrguar nj\u00eb byte n\u00eb minut\u00eb p\u00ebr t\u00eb shmangur prerjen p\u00ebr shkak t\u00eb koh\u00ebs s\u00eb pritjes). N\u00eb k\u00ebt\u00eb rast, nuk p\u00ebrjashtohet q\u00eb p\u00ebr shfryt\u00ebzimin e problemeve nga distanca t\u00eb ekzistojn\u00eb vektor\u00eb sulmi m\u00eb t\u00eb thjesht\u00eb.<\/p>\n

Vulnerabiliteti shkaktohet nga kontrolli i pasakt\u00eb i adres\u00ebs s\u00eb marr\u00ebsit n\u00eb funksionin deliver_message(), e cila p\u00ebrcaktohet n\u00eb skedarin \/src\/deliver.c. N\u00ebp\u00ebrmjet manipulimit t\u00eb formatimit t\u00eb adres\u00ebs, sulmuesi mund t\u00eb arrij\u00eb t'i fut\u00eb t\u00eb dh\u00ebnat e tij n\u00eb argumentet e komand\u00ebs q\u00eb thirret p\u00ebrmes funksionit execv() me t\u00eb drejtat root. P\u00ebr shfryt\u00ebzimin e tij nuk k\u00ebrkohet p\u00ebrdorimi i teknikave komplekse, t\u00eb p\u00ebrdorura gjat\u00eb mbushjes s\u00eb buffer-ave ose d\u00ebmton memorjen, mjafton thjesht t\u00eb futen simbole. <\/p>\n

\u00c7\u00ebshtja \u00ebsht\u00eb e lidhur me aplikimin p\u00ebr konvertimin e adresave t\u00eb nd\u00ebrtimit:<\/p>\n

deliver_localpart = expand_string(
\n string_sprintf(\u00ab${local_part:%s}\u00bb, new->address));
\n deliver_domain = expand_string(
\n string_sprintf(\u00ab${domain:%s}\u00bb, new->address));<\/p>\n

Funksioni expand_string() \u00ebsht\u00eb nj\u00eb kombinim tep\u00ebr i komplikuar, duke p\u00ebrfshir\u00eb njohjen e komand\u00ebs \u00ab${run{komanda argumente}\u00bb, q\u00eb \u00e7on n\u00eb aktivizimin e nj\u00eb procesori t\u00eb jasht\u00ebm. K\u00ebshtu, p\u00ebr nj\u00eb sulm gjat\u00eb nj\u00eb seance SMTP, nj\u00eb p\u00ebrdorues lokal mjafton t\u00eb d\u00ebrgoj\u00eb komand\u00ebn e tipit \u2018RCPT TO \u00abusername+${run{...}}@localhost\u00bb\u2018, ku localhost \u00ebsht\u00eb nj\u00eb nga hostet n\u00eb list\u00ebn local_domains, nd\u00ebrsa username \u00ebsht\u00eb emri i nj\u00eb p\u00ebrdoruesi lokal ekzistues. <\/p>\n

N\u00ebse serveri funksionon si nj\u00eb rel\u00e9 postash, mjafton t\u00eb d\u00ebrgohet nj\u00eb komand\u00eb \u2018RCPT TO \u00ab${run{...}}@relaydomain.com\u00bb\u2018, ku relaydomain.com \u00ebsht\u00eb nj\u00eb nga hostet n\u00eb seksionin e cil\u00ebsimeve relay_to_domains. Duke qen\u00eb se n\u00eb parazgjedhje n\u00eb exim nuk aplikohet m\u00ebnyra e heqjes s\u00eb privilegjeve (deliver_drop_privilege = false), komandat e d\u00ebrguara p\u00ebrmes \u2018${run{...}}\u2019 do t\u00eb ekzekutohen me t\u00eb drejtat root.<\/p>\n

\u00cbsht\u00eb e r\u00ebnd\u00ebsishme t\u00eb theksohet se vulnerabiliteti u i eliminuar<\/a><\/noindex> n\u00eb versionin e dal\u00eb n\u00eb shkurt 4.92 pa theks t\u00eb ve\u00e7ant\u00eb se riparimi mund t\u00eb \u00e7oj\u00eb n\u00eb probleme t\u00eb sigurise. Nuk ka arsye p\u00ebr t\u00eb besuar se ka pasur mbulime t\u00eb q\u00ebllimshme t\u00eb vulnerabilitetit nga zhvilluesit e Exim, pasi \u00e7\u00ebshtja u zgjidh gjat\u00eb korrigjimeve<\/a><\/noindex> d\u00ebshtimit, q\u00eb ndodhi kur d\u00ebrgoheshin adresat e pasakta, dhe vulnerabiliteti u identifikua nga kompania Qualys gjat\u00eb auditimit t\u00eb ndryshimeve n\u00eb Exim. <\/p>\n

Riparimi p\u00ebr versionet e kaluara, t\u00eb cilat vazhdojn\u00eb t\u00eb aplikohen n\u00eb shp\u00ebrndarje, \u00ebsht\u00eb n\u00eb dispozicion vet\u00ebm n\u00eb form\u00ebn patch<\/a><\/noindex>. L\u00ebshimet korrigjuese p\u00ebr deg\u00ebt e kaluara me zgjidhjen e problemit jan\u00eb planifikuar p\u00ebr 11 qershor. P\u00ebrdit\u00ebsimet e paketave jan\u00eb p\u00ebrgatitur p\u00ebr Debian<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, openSUSE<\/a><\/noindex>. Arch Linux<\/a><\/noindex> dhe Fedora<\/a><\/noindex> ofrojn\u00eb versionin 4.92, ku problemi nuk shfaqet. RHEL dhe CentOS kan\u00eb probleme nuk jan\u00eb t\u00eb ekspozuara<\/a><\/noindex>, pasi Exim nuk \u00ebsht\u00eb pjes\u00eb e depozitave t\u00eb pakove t\u00eb tyre.<\/p>\n

<\/a><\/noindex><\/p>\n

Burimi: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 Exim \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2019-10149), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0437\u0430\u043f\u0440\u043e\u0441\u0430. \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043e\u0442\u043c\u0435\u0447\u0435\u043d\u0430 \u0432 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 \u0441 4.87 \u043f\u043e 4.91 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0438\u043b\u0438 \u043f\u0440\u0438 \u0441\u0431\u043e\u0440\u043a\u0435 \u0441 \u043e\u043f\u0446\u0438\u0435\u0439 EXPERIMENTAL_EVENT. \u0412 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0430\u0442\u0430\u043a\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0430 \u0431\u0435\u0437 \u043b\u0438\u0448\u043d\u0438\u0445 \u0443\u0441\u043b\u043e\u0436\u043d\u0435\u043d\u0438\u0439 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-35011","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Vulnerabilitet kritik n\u00eb Exim, i cili lejon ekzekutimin e kodit n\u00eb server me t\u00eb drejtat root | ProHoster","description":"N\u00eb serverin e post\u00ebs Exim \u00ebsht\u00eb identifikuar nj\u00eb vulnerabilitet kritik (CVE-2019-10149), i cili mund t\u00eb \u00e7oj\u00eb n\u00eb ekzekutimin e kodit n\u00eb distanc\u00eb n\u00eb server me t\u00eb drejtat root gjat\u00eb p\u00ebrpunimit t\u00eb k\u00ebrkesave t\u00eb strukturuara posa\u00e7\u00ebrisht. Mund\u00ebsia e shfryt\u00ebzimit t\u00eb \u00e7\u00ebshtjes \u00ebsht\u00eb v\u00ebn\u00eb re n\u00eb versionet nga 4.87 deri n\u00eb 4.91 p\u00ebrfshire ose gjat\u00eb nd\u00ebrtimit me opsionin EXPERIMENTAL_EVENT. N\u00eb konfigurimin e paracaktuar, sulmi mund t\u00eb kryhet pa komplikime t\u00eb panevojshme nga nj\u00eb p\u00ebrdorues lokal,","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/kriticheskaya-uyazvimost-v-exim-pozvolyayushhaya-vypolnit-kod-na-servere-s-pravami-root","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Exim, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root | ProHoster","og:description":"\u0412 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 Exim \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2019-10149), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0437\u0430\u043f\u0440\u043e\u0441\u0430. \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043e\u0442\u043c\u0435\u0447\u0435\u043d\u0430 \u0432 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 \u0441 4.87 \u043f\u043e 4.91 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0438\u043b\u0438 \u043f\u0440\u0438 \u0441\u0431\u043e\u0440\u043a\u0435 \u0441 \u043e\u043f\u0446\u0438\u0435\u0439 EXPERIMENTAL_EVENT. \u0412 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0430\u0442\u0430\u043a\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0430 \u0431\u0435\u0437 \u043b\u0438\u0448\u043d\u0438\u0445 \u0443\u0441\u043b\u043e\u0436\u043d\u0435\u043d\u0438\u0439 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c,","og:url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/kriticheskaya-uyazvimost-v-exim-pozvolyayushhaya-vypolnit-kod-na-servere-s-pravami-root","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:01:50+00:00","article:modified_time":"2019-10-31T19:01:50+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"35011","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 21:28:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:11:30","updated":"2026-01-21 21:28:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/35011","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=35011"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/35011\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=35011"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=35011"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=35011"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}