{"id":71318,"date":"2020-02-25T07:34:19","date_gmt":"2020-02-25T04:34:19","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimosti-v-opensmtpd-pozvolyayushhie-udalyonno-i-lokalno-poluchit-prava-root"},"modified":"2020-03-03T16:10:53","modified_gmt":"2020-03-03T13:10:53","slug":"uyazvimosti-v-opensmtpd-pozvolyayushhie-udalyonno-i-lokalno-poluchit-prava-root","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimosti-v-opensmtpd-pozvolyayushhie-udalyonno-i-lokalno-poluchit-prava-root","title":{"rendered":"Vulnerabilitatet n\u00eb OpenSMTPD q\u00eb lejojn\u00eb marrjen e t\u00eb drejtave root n\u00eb distanc\u00eb dhe lokalisht","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Kompania Qualys identifikoi<\/a><\/noindex> nj\u00eb tjet\u00ebr vulnerabilitet kritik t\u00eb larg\u00ebt (CVE-2020-8794) n\u00eb serverin e post\u00ebs OpenSMTPD<\/a><\/noindex>, i zhvilluar nga projekti OpenBSD. Ashtu si\u00e7 u identifikua n\u00eb fund t\u00eb janarit vulnerabiliteti<\/a><\/noindex>, problemi i ri lejon ekzekutimin n\u00eb distanc\u00eb t\u00eb komandave t\u00eb rast\u00ebsishme shell n\u00eb server me t\u00eb drejtat e p\u00ebrdoruesit root. Vulnerabiliteti \u00ebsht\u00eb eliminuar<\/a><\/noindex> n\u00eb versionin OpenSMTPD 6.6.4p1<\/a><\/noindex>. <\/p>\n

Problemi shkaktohet nga nj\u00eb gabim n\u00eb kodin q\u00eb merret me dor\u00ebzimin e post\u00ebs n\u00eb nj\u00eb server t\u00eb larg\u00ebt (jo n\u00eb kodin q\u00eb trajton lidhjet hyr\u00ebse). Sulmi \u00ebsht\u00eb i mundur si n\u00eb an\u00ebn e klientit, ashtu edhe n\u00eb an\u00ebn e serverit. N\u00eb an\u00ebn e klientit, sulmi \u00ebsht\u00eb i mundur n\u00eb konfigurimin default t\u00eb OpenSMTPD, ku OpenSMTPD pranon k\u00ebrkesat vet\u00ebm n\u00eb nd\u00ebrfaqen e rrjetit lokal (localhost) dhe d\u00ebrgon mesazhet n\u00eb serverat e jasht\u00ebm. P\u00ebr t\u00eb shfryt\u00ebzuar vulnerabilitetin, mjafton q\u00eb gjat\u00eb procesit t\u00eb dor\u00ebzimit t\u00eb nj\u00eb emaili OpenSMTPD t\u00eb vendos\u00eb nj\u00eb seanc\u00eb me serverin e post\u00ebs q\u00eb \u00ebsht\u00eb n\u00ebn kontrollin e sulmuesit, ose q\u00eb sulmuesi t\u00eb mund t\u00eb nd\u00ebrhyj\u00eb n\u00eb lidhjen e klientit (MITM ose redirektim gjat\u00eb sulmeve p\u00ebrmes DNS ose BGP).<\/p>\n

P\u00ebr t\u00eb sulmuar n\u00eb an\u00ebn e serverit, \u00ebsht\u00eb e nevojshme q\u00eb OpenSMTPD t\u00eb jet\u00eb konfiguruar t\u00eb pranoj\u00eb k\u00ebrkesat e rrjetit t\u00eb jasht\u00ebm nga serverat e tjer\u00eb t\u00eb post\u00ebs ose t\u00eb sh\u00ebrbej\u00eb sh\u00ebrbime t\u00eb jashtme q\u00eb lejojn\u00eb d\u00ebrgimin e k\u00ebrequests p\u00ebr nj\u00eb email t\u00eb rast\u00ebsish\u00ebm (p.sh., format e konfirmimit t\u00eb adres\u00ebs n\u00eb faqet e internetit). P\u00ebr shembull, nj\u00eb sulmues mund t\u00eb lidhet me serverin OpenSMTPD dhe t\u00eb d\u00ebrgoj\u00eb nj\u00eb email t\u00eb pavlefsh\u00ebm (p\u00ebr nj\u00eb p\u00ebrdorues q\u00eb nuk ekziston), i cili do t\u00eb shkaktoj\u00eb d\u00ebrgimin e nj\u00eb emaili p\u00ebrgjigje me kod gabimi (bounce) n\u00eb serverin e sulmuesit. Sulmuesi mund t\u00eb shfryt\u00ebzoj\u00eb vulnerabilitetin n\u00eb momentin kur OpenSMTPD lidhet p\u00ebr t\u00eb d\u00ebrguar nj\u00eb njoftim n\u00eb serverin e sulmuesit. Komandat shell t\u00eb futur gjat\u00eb sulmit vendosen n\u00eb nj\u00eb skedar q\u00eb ekzekutohet me t\u00eb drejtat root kur OpenSMTPD ri-fillon, prandaj sulmuesi duhet t\u00eb pres\u00eb rithemelimin e OpenSMTPD ose t\u00eb nxis\u00eb nj\u00eb d\u00ebshtim t\u00eb OpenSMTPD.<\/p>\n

Problemi ndodhet n\u00eb funksionin mta_io() n\u00eb kodin p\u00ebr analizimin e p\u00ebrgjigjes shum\u00eblinj\u00ebshe q\u00eb kthehet nga serveri i larg\u00ebt pas vendosjes s\u00eb lidhjes (p.sh., \u00ab250-ENHANCEDSTATUSCODES\u00bb dhe \u00ab250 HELP\u00bb). N\u00eb OpenSMTPD supozohet se shtylla e par\u00eb p\u00ebrmban nj\u00eb num\u00ebr tre shifror dhe tekst, t\u00eb ndara nga simboli \u00ab-\u00bb, dhe shtylla e dyt\u00eb nj\u00eb num\u00ebr tre shifror dhe tekst t\u00eb ndara nga nj\u00eb hap\u00ebsir\u00eb. N\u00ebse n\u00eb shtyll\u00ebn e dyt\u00eb pas numrit tre shifror nuk ndjek nj\u00eb hap\u00ebsir\u00eb dhe tekst, treguesi i p\u00ebrdorur p\u00ebr t\u00eb p\u00ebrcaktuar tekstin vendoset n\u00eb bajtin pas simbolit \u2018\u2019 dhe b\u00ebhet nj\u00eb p\u00ebrpjekje p\u00ebr t\u00eb kopjuar n\u00eb tamponin e t\u00eb dh\u00ebnave q\u00eb vijn\u00eb pas fundit t\u00eb shtyll\u00ebs.<\/p>\n

N\u00eb k\u00ebrkes\u00eb t\u00eb projektit OpenBSD, publikimi i detajeve rreth shfryt\u00ebzimit t\u00eb dob\u00ebsis\u00eb \u00ebsht\u00eb shtyr\u00eb deri m\u00eb 26 shkurt, p\u00ebr t'u dh\u00ebn\u00eb p\u00ebrdoruesve mund\u00ebsin\u00eb t\u00eb p\u00ebrdit\u00ebsojn\u00eb sistemet e tyre. Problemi ndodhet n\u00eb kodin q\u00eb nga dhjetori i vitit 2015, por shfryt\u00ebzimi p\u00ebr ekzekutimin e kodit me t\u00eb drejta root \u00ebsht\u00eb i mundsh\u00ebm q\u00eb nga maji i vitit 2018. K\u00ebrkuesit kan\u00eb p\u00ebrgatitur nj\u00eb prototip funksional t\u00eb shfryt\u00ebzuesit, i cili \u00ebsht\u00eb testuar me sukses n\u00eb nd\u00ebrtimet OpenSMTPD p\u00ebr OpenBSD 6.6, OpenBSD 5.9, Debian 10, Debian 11 (testing) dhe Fedora 31. <\/p>\n

N\u00eb OpenSMTPD gjithashtu u zbulua<\/a><\/noindex> ka nj\u00eb tjet\u00ebr dob\u00ebsi (CVE-2020-8793), e cila i lejon nj\u00eb p\u00ebrdoruesi lokal t\u00eb lexoj\u00eb shtyll\u00ebn e par\u00eb t\u00eb \u00e7do skedari n\u00eb sistem. P\u00ebr shembull, mund t\u00eb lexohet shtylla e par\u00eb e \/etc\/master.passwd, n\u00eb t\u00eb cil\u00ebn ndodhet hash-i i fjal\u00ebkalimit t\u00eb p\u00ebrdoruesit root. Dob\u00ebsia gjithashtu lejon leximin e t\u00eb gjith\u00eb p\u00ebrmbajtjes s\u00eb skedarit q\u00eb i p\u00ebrket nj\u00eb p\u00ebrdoruesi tjet\u00ebr, n\u00ebse ky skedar ndodhet n\u00eb t\u00eb nj\u00ebjt\u00ebn sistem datotekash me katalogun \/var\/spool\/smtpd\/. Problemi nuk \u00ebsht\u00eb i shfryt\u00ebzuesh\u00ebm n\u00eb shum\u00eb distribucione Linux, n\u00eb t\u00eb cilat vlera \/proc\/sys\/fs\/protected_hardlinks \u00ebsht\u00eb e vendosur n\u00eb 1. <\/p>\n

Problemi \u00ebsht\u00eb pasoj\u00eb e nj\u00eb eliminimi t\u00eb pap\u00ebrshtatsh\u00ebm problemi<\/a><\/noindex>, t\u00eb shprehur gjat\u00eb auditit t\u00eb kryer nga Qualys n\u00eb vitin 2015. Sulmuesi mund t\u00eb arrij\u00eb t\u00eb ekzekutoj\u00eb kodin e tij me t\u00eb drejtat e grupit «_smtpq», duke vendosur variablin «PATH=.» dhe duke vendosur n\u00eb katalogun aktual nj\u00eb skenar me emrin makemap (utilita smtpctl e ekzekuton makemap pa treguar qart\u00eb rrug\u00ebn). Pasi t\u00eb ket\u00eb qasje n\u00eb grupin «_smtpq», sulmuesi mund t\u00eb nxis\u00eb nj\u00eb gar\u00eb (t\u00eb krijoj\u00eb nj\u00eb skedar t\u00eb madh n\u00eb katalogun offline dhe t\u00eb d\u00ebrgoj\u00eb sinjalin SIGSTOP) dhe, deri sa t\u00eb p\u00ebrfundoj\u00eb p\u00ebrpunimi, t\u00eb z\u00ebvend\u00ebsoj\u00eb skedarin n\u00eb katalogun offline me nj\u00eb lidhje simbolike t\u00eb ashp\u00ebr, e cila tregon p\u00ebr skedarin e synuar, p\u00ebrmbajtjen e t\u00eb cilit duhet ta lexoj\u00eb.<\/p>\n

\u00cbsht\u00eb e r\u00ebnd\u00ebsishme t\u00eb theksohet se n\u00eb Fedora 31, vulnerabiliteti lejon menj\u00ebher\u00eb marrjen e privilegjeve t\u00eb grupit root, pasi procesi smtpctl \u00ebsht\u00eb i pajisur me flamurin setgid root, n\u00eb vend t\u00eb setgid smtpq. Duke fituar akses n\u00eb grupin root, mund t\u00eb rishkruhet p\u00ebrmbajtja e \/var\/lib\/sss\/mc\/passwd dhe t\u00eb merret plot\u00ebsisht akses root n\u00eb sistem.<\/p>\n

<\/a><\/noindex><\/p>\n

Burimi: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0435\u0449\u0451 \u043e\u0434\u043d\u0443 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u0443\u044e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-8794) \u0432 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 OpenSMTPD, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u043e\u043c \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c OpenBSD. \u041a\u0430\u043a \u0438 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u0430\u044f \u0432 \u043a\u043e\u043d\u0446\u0435 \u044f\u043d\u0432\u0430\u0440\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043d\u043e\u0432\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0434\u0430\u0451\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b shell \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f root. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0435 OpenSMTPD 6.6.4p1. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043e\u0448\u0438\u0431\u043a\u043e\u0439 \u0432 \u043a\u043e\u0434\u0435, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u044e\u0449\u0435\u043c \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0443 \u043f\u043e\u0447\u0442\u044b \u043d\u0430 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u044b\u0439 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-71318","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitetet n\u00eb OpenSMTPD, q\u00eb lejojn\u00eb marrjen e t\u00eb drejtave root n\u00eb distanc\u00eb dhe lokal | ProHoster","description":"Kompania Qualys zbuloi nj\u00eb tjet\u00ebr vulnerabilitet kritik t\u00eb distancuar (CVE-2020-8794) n\u00eb serverin e post\u00ebs.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimosti-v-opensmtpd-pozvolyayushhie-udalyonno-i-lokalno-poluchit-prava-root","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 OpenSMTPD, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0438 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 root | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0435\u0449\u0451 \u043e\u0434\u043d\u0443 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u0443\u044e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-8794) \u0432 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimosti-v-opensmtpd-pozvolyayushhie-udalyonno-i-lokalno-poluchit-prava-root","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-25T04:34:19+00:00","article:modified_time":"2020-03-03T13:10:53+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"71318","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:04:24","updated":"2022-09-28 08:07:40","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/71318","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=71318"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/71318\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=71318"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=71318"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=71318"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}