{"id":38040,"date":"2019-10-31T22:21:20","date_gmt":"2019-10-31T19:21:20","guid":{"rendered":"https:\/\/prohoster.info\/blog\/propatchil-exim-propatch-eshhe-raz-svezhee-remote-command-execution-v-exim-4-92-v-odin-zapros\/"},"modified":"2021-02-01T11:37:46","modified_gmt":"2021-02-01T09:37:46","slug":"propatchil-exim-propatch-eshhe-raz-svezhee-remote-command-execution-v-exim-4-92-v-odin-zapros","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/propatchil-exim-propatch-eshhe-raz-svezhee-remote-command-execution-v-exim-4-92-v-odin-zapros","title":{"rendered":"Kam patchuar Exim - patchoni p\u00ebrs\u00ebri. Ka nj\u00eb ekzekutim komand\u00ebs nga distanca n\u00eb Exim 4.92 me nj\u00eb k\u00ebrkes\u00eb","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Kam<\/p>\n

Koh\u00eb m\u00eb par\u00eb, n\u00eb fillim t\u00eb ver\u00ebs, filluan thirrjet masive p\u00ebr p\u00ebrdit\u00ebsimin e Exim n\u00eb versionin 4.92 p\u00ebr shkak t\u00eb dob\u00ebsis\u00eb CVE-2019-10149 (P\u00ebrdit\u00ebsoni urgjentisht exim n\u00eb 4.92 \u2014 ka infeksione aktive \/ Habr<\/a><\/noindex>). Disa dit\u00eb m\u00eb par\u00eb u zbulua se malware-i Sustes kishte vendosur t\u00eb shfryt\u00ebzonte k\u00ebt\u00eb dob\u00ebsi.<\/p>\n

Tani, ata q\u00eb p\u00ebrdit\u00ebsuan me urgjenc\u00eb mund t\u00eb g\u00ebzojn\u00eb s\u00ebrish: m\u00eb 21 korrik 2019, studiuesi Zerons zbuloi nj\u00eb dob\u00ebsi kritike n\u00eb Exim Mail Transfer Agent (MTA) kur p\u00ebrdor TLS<\/strong> p\u00ebr versionet nga 4.80 deri n\u00eb 4.92.1<\/strong> p\u00ebrfshir\u00eb, e cila lejon ekzekutimin e kodit me t\u00eb drejta privilegjuar<\/strong> (CVE-2019-15846<\/a><\/noindex>).<\/p>\n

<\/a><\/noindex><\/p>\n

Vulnerabiliteti<\/h3>\n

Dob\u00ebsia ka zbritur gjat\u00eb p\u00ebrdorimit t\u00eb bibliotekave si GnuTLS ashtu edhe OpenSSL gjat\u00eb vendosjes s\u00eb nj\u00eb lidhjeje t\u00eb sigurt TLS.<\/p>\n

Sipas zhvilluesit Heiko Schlittermann, skedari i konfigurimit n\u00eb Exim p\u00ebr default nuk p\u00ebrdor TLS, megjithat\u00eb shum\u00eb distribucione gjat\u00eb instalimit krijojn\u00eb certifikatat e nevojshme dhe p\u00ebrfshijn\u00eb lidhjen e sigurt. Gjithashtu, versionet m\u00eb t\u00eb reja t\u00eb Exim vendosin opsionin tls_advertise_hosts=*<\/em> dhe gjenerojn\u00eb certifikatat e nevojshme.<\/p>\n

varet nga konfigurimi. Shumica e distribucioneve e aktivizojn\u00eb at\u00eb nga p\u00ebrmbajtja, por Exim ka nevoj\u00eb p\u00ebr nj\u00eb certifikat\u00eb + \u00e7el\u00ebs p\u00ebr t\u00eb punuar si nj\u00eb server TLS. Probabilisht, distribucionet krijojn\u00eb nj\u00eb certifikat\u00eb gjat\u00eb konfigurimit. Eximet m\u00eb t\u00eb reja kan\u00eb opsionin tls_advertise_hosts q\u00eb n\u00eb m\u00ebnyr\u00eb default \u00ebsht\u00eb «*» dhe krijojn\u00eb nj\u00eb certifikat\u00eb t\u00eb vet\u00eb-n\u00ebnshkruar, n\u00ebse asnj\u00eb nuk jepet.<\/p><\/blockquote>\n

Dob\u00ebsia n\u00eb vetvete p\u00ebrfshin p\u00ebrpunimin e gabuar t\u00eb SNI (Server Name Indication, teknologji e prezantuar n\u00eb vitin 2003 n\u00eb RFC 3546 p\u00ebr t\u00eb k\u00ebrkuar nj\u00eb certifikat\u00eb t\u00eb sakt\u00eb p\u00ebr emrin e domainit nga klienti, Shtrirja e standardit TLS SNI \/ Blogu i kompanis\u00eb WEBO Group \/ Habr<\/a><\/noindex>) gjat\u00eb dor\u00ebzimit TLS. Nj\u00eb sulmues mjafton t\u00eb d\u00ebrgoj\u00eb SNI, q\u00eb p\u00ebrfundon me nj\u00eb backslash («») dhe nj\u00eb karakter null (» «).<\/p>\n

K\u00ebrkuesit nga kompania Qualys zbuluan nj\u00eb gabim n\u00eb funksionin string_printing(tls_in.sni), i cili p\u00ebrfshin nj\u00eb ekranoj t\u00eb pap\u00ebrshtatsh\u00ebm t\u00eb «». Si pasoj\u00eb, regjistrohet nj\u00eb backslash n\u00eb m\u00ebnyr\u00eb t\u00eb paekranuar n\u00eb skedarin e titujve print spool. M\u00eb pas ky skedar me t\u00eb drejta privilegjuara lexohet nga funksioni spool_read_header(), q\u00eb \u00e7on n\u00eb nj\u00eb mbipopullim t\u00eb hekurudhave (heap overflow).<\/p>\n

\u00cbsht\u00eb e r\u00ebnd\u00ebsishme t\u00eb theksohet se deri m\u00eb tani zhvilluesit e Exim kan\u00eb krijuar nj\u00eb PoC t\u00eb dob\u00ebsis\u00eb me ekzekutimin e komandave n\u00eb nj\u00eb server t\u00eb ndjesh\u00ebm, por tani p\u00ebr tani ai nuk \u00ebsht\u00eb n\u00eb dispozicion publik. P\u00ebr shkak t\u00eb leht\u00ebsis\u00eb s\u00eb shfryt\u00ebzimit t\u00eb defektit, kjo \u00ebsht\u00eb vet\u00ebm nj\u00eb \u00e7\u00ebshtje kohe, p\u00ebrve\u00e7se nj\u00eb kohe relativisht t\u00eb shkurt\u00ebr.<\/strong><\/p>\n

Mund t\u00eb njiheni me hetimin m\u00eb t\u00eb detajuar nga kompania Qualys k\u00ebtu<\/a><\/noindex>.<\/p>\n

\"Kam<\/p>\n

P\u00ebrdorimi i SNI n\u00eb TLS<\/em><\/p>\n

Numri i server\u00ebve publikisht t\u00eb mundsh\u00ebm t\u00eb cenuesh\u00ebm<\/h3>\n

Sipas statistikave t\u00eb nj\u00eb ofruesi t\u00eb madh t\u00eb hostimit E-Soft Inc<\/strong> n\u00eb 1 Shtator, n\u00eb server\u00ebt e dh\u00ebn\u00eb me qira, versioni 4.92 p\u00ebrdoret n\u00eb m\u00eb shum\u00eb se 70% t\u00eb hosteve.<\/p>\n

Version
\nNumri i Server\u00ebve
\nP\u00ebrqindja<\/p>\n

4.92.1
\n6471
\n1.28%<\/p>\n

4.92<\/strong>
\n376436<\/strong>
\n74.22%<\/strong><\/p>\n

4.91
\n58179
\n11.47%<\/p>\n

4.9
\n5732
\n1.13%<\/p>\n

4.89
\n10700
\n2.11%<\/p>\n

4.87
\n14177
\n2.80%<\/p>\n

4.84
\n9937
\n1.96%<\/p>\n

Versionet e tjera
\n25568
\n5.04%<\/p>\n

Statistika e kompanis\u00eb E-Soft Inc<\/em><\/p>\n

N\u00ebse i drejtohemi motorit t\u00eb k\u00ebrkimit Shodan<\/strong><\/a><\/noindex>, nga 5,250,000 n\u00eb baz\u00ebn e server\u00ebve:<\/p>\n