{"id":82266,"date":"2020-05-20T19:42:07","date_gmt":"2020-05-20T17:42:07","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/udalyonno-ekspluatiruemaya-uyazvimost-v-pochtovom-servere-qmail"},"modified":"2020-05-20T19:42:07","modified_gmt":"2020-05-20T17:42:07","slug":"udalyonno-ekspluatiruemaya-uyazvimost-v-pochtovom-servere-qmail","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/udalyonno-ekspluatiruemaya-uyazvimost-v-pochtovom-servere-qmail","title":{"rendered":"Vulnerabiliteti i shfryt\u00ebzuesh\u00ebm n\u00eb serverin e post\u00ebs qmail","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

K\u00ebrkuesit p\u00ebr siguri nga kompania Qualys t\u00eb shfaqur<\/a><\/noindex> mund\u00ebsia eksploatimi<\/a><\/noindex> vulnerabilitetet n\u00eb serverin e post\u00ebs qmail, i njohur<\/a><\/noindex> q\u00eb nga viti 2005 (CVE-2005-1513), por q\u00eb ka mbetur e pap\u00ebrmir\u00ebsuar, pasi autori i qmail pretendonte se krijimi i nj\u00eb eksploiti funksional q\u00eb mund t\u00eb p\u00ebrdorej p\u00ebr t\u00eb sulmuar sisteme n\u00eb konfigurimin standard ishte i pabesuesh\u00ebm. N\u00eb Qualys arrit\u00ebn t\u00eb p\u00ebrgatisin nj\u00eb eksploit q\u00eb hedh posht\u00eb k\u00ebt\u00eb supozim dhe lejon inicimin e ekzekutimit t\u00eb kodit n\u00eb server p\u00ebrmes d\u00ebrgimit t\u00eb nj\u00eb mesazhi t\u00eb formatuar posa\u00e7\u00ebrisht.<\/p>\n

Problemi i shkaktuar nga tejkalimi i numrave t\u00eb plot\u00eb n\u00eb funksionin stralloc_readyplus(), i cili mund t\u00eb ndodh\u00eb gjat\u00eb p\u00ebrpunimit t\u00eb nj\u00eb mesazhi tep\u00ebr t\u00eb madh. P\u00ebr t\u00eb shfryt\u00ebzuar k\u00ebt\u00eb, k\u00ebrkohej nj\u00eb sistem 64-bit me m\u00eb shum\u00eb se 4GB memorje virtuale. N\u00eb fillim t\u00eb analiz\u00ebs s\u00eb k\u00ebsaj dob\u00ebsie n\u00eb vitin 2005, Daniel Bernstein, pretendoi se supozimi n\u00eb kod q\u00eb madh\u00ebsia e mas\u00ebs s\u00eb alokuar gjithmon\u00eb do t\u00eb p\u00ebrputhej me nj\u00eb vler\u00eb 32-bit ishte i bazuar n\u00eb faktin se askush nuk ofronte gigabajt\u00eb memorje p\u00ebr \u00e7do proces. Gjat\u00eb 15 viteve t\u00eb fundit, sistemet 64-bit n\u00eb servera kan\u00eb z\u00ebvend\u00ebsuar ato 32-bit, me nj\u00eb rritje t\u00eb theksuar t\u00eb sasis\u00eb s\u00eb memorjes s\u00eb ofruar dhe kapacitetit t\u00eb rrjeteve. <\/p>\n

Paketet mb\u00ebshtet\u00ebse t\u00eb qmail mor\u00ebn parasysh v\u00ebrejtjen e Bernstein dhe kur u aktivizua procesi qmail-smtpd kufizuan memorjen e disponueshme (p.sh., n\u00eb Debian 10, vendoset nj\u00eb kufi prej 7MB). Por inxhinier\u00ebt e Qualys zbuluan se kjo ishte e pamjaftueshme dhe p\u00ebrve\u00e7 qmail-smtpd, nj\u00eb sulm n\u00eb distanc\u00eb mund t\u00eb kryhej edhe ndaj procesit qmail-local, i cili n\u00eb t\u00eb gjitha paketat e kontrolluara mbeti pa kufizime. Si prov\u00eb, u p\u00ebrgatit nj\u00eb prototip i eksploitit, i p\u00ebrshtatsh\u00ebm p\u00ebr sulm ndaj paket\u00ebs qmail t\u00eb ofruar n\u00eb Debian me konfigurimin e paracaktuar.
\nP\u00ebr t\u00eb organizuar ekzekutimin n\u00eb distanc\u00eb t\u00eb kodit gjat\u00eb sulmit k\u00ebrkohet q\u00eb n\u00eb server t\u00eb ket\u00eb 4GB hap\u00ebsir\u00eb t\u00eb lir\u00eb n\u00eb disk dhe 8GB RAM.
\nEksploiti lejon t\u00eb ekzekutoni \u00e7do komand\u00eb shell me t\u00eb drejtat e \u00e7do p\u00ebrdoruesi n\u00eb sistem, p\u00ebrve\u00e7 root dhe p\u00ebrdoruesve sistemor\u00eb q\u00eb nuk kan\u00eb nj\u00eb n\u00ebnkatalog n\u00eb katalogun \"\/home\" (procesi qmail-local ekzekutohet me t\u00eb drejtat e p\u00ebrdoruesit lokal, t\u00eb cilit i b\u00ebhet shp\u00ebrndarja).<\/p>\n

Sulmi realizohet
\nn\u00ebp\u00ebrmjet d\u00ebrgimit t\u00eb nj\u00eb mesazhi t\u00eb madh me post\u00eb, q\u00eb p\u00ebrfshin disa rreshta n\u00eb titull, me madh\u00ebsi rreth 4GB dhe 576MB. Trajtimi i nj\u00eb rreshti t\u00eb till\u00eb n\u00eb qmail-local \u00e7on n\u00eb mbivendosje t\u00eb numrave t\u00eb plot\u00eb gjat\u00eb p\u00ebrpjekjes p\u00ebr t\u00eb d\u00ebrguar mesazhin te p\u00ebrdoruesi lokal. Mbivendosja e numrave t\u00eb plot\u00eb pastaj \u00e7on n\u00eb mbivendosje t\u00eb tamponit gjat\u00eb kopjimit t\u00eb t\u00eb dh\u00ebnave dhe mund\u00ebsin\u00eb e shkrimit t\u00eb faqeve t\u00eb memories me kodin libc. P\u00ebrmes manipulimeve me p\u00ebrb\u00ebrjen e t\u00eb dh\u00ebnave t\u00eb transmetuara, \u00ebsht\u00eb e mundur gjithashtu t\u00eb rishkruhet adresa e funksionit \"open()\", duke e z\u00ebvend\u00ebsuar at\u00eb me adres\u00ebn e funksionit \"system()\". <\/p>\n

M\u00eb pas, gjat\u00eb thirrjes s\u00eb qmesearch() n\u00eb qmail-local, hapet skedari \".qmail-extension\" p\u00ebrmes funksionit open(), \u00e7ka \u00e7on n\u00eb ekzekutimin faktik t\u00eb funksionit
\nsystem(\".qmail-extension\"). Por duke qen\u00eb se nj\u00eb pjes\u00eb e skedarit \"extension\" krijohet bazuar n\u00eb adres\u00ebn e marr\u00ebsit (p\u00ebr shembull, \"localuser-extension@localdomain\"), sulmuesit mund t\u00eb organizojn\u00eb d\u00ebrgimin e komand\u00ebs p\u00ebr ekzekutim, duke treguar p\u00ebrdoruesin \"localuser-;command;@localdomain\" si marr\u00ebs t\u00eb mesazhit. <\/p>\n

Gjat\u00eb analiz\u00ebs s\u00eb kodit gjithashtu u identifikuan dy vulnerabilitete n\u00eb patch-in shtes\u00eb qmail-verify, i cili \u00ebsht\u00eb pjes\u00eb e paket\u00ebs p\u00ebr Debian. Vulnerabiliteti i par\u00eb (CVE-2020-3811<\/a><\/noindex>) lejon t\u00eb anashkaloni verifikimin e adres\u00ebs s\u00eb emailit, nd\u00ebrsa e dyta (CVE-2020-3812<\/a><\/noindex>) \u00e7on n\u00eb rrjedhjen e informacioneve lokale. N\u00eb ve\u00e7anti, vulnerabiliteti i par\u00eb lejon kalimin e verifikimit t\u00eb adres\u00ebs s\u00eb sakt\u00eb, q\u00eb p\u00ebrdoret n\u00eb eksploiti p\u00ebr d\u00ebrgimin e komand\u00ebs (verifikimi nuk funksionon p\u00ebr adresat pa domain, si \"localuser-;command;\"). Vulnerabiliteti i dyt\u00eb mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb kontrolluar pranin\u00eb e skedar\u00ebve dhe katalog\u00ebve n\u00eb sistem, p\u00ebrfshir\u00eb ato q\u00eb jan\u00eb t\u00eb disponueshme vet\u00ebm p\u00ebr root (qmail-verify ekzekutohet me t\u00eb drejtat e root), p\u00ebrmes qasjes direkte te procesori lokal.<\/p>\n

P\u00ebr t\u00eb kaluar k\u00ebt\u00eb problem, Bernstein rekomandoi ekzekutimin e proceseve qmail me caktimin e nj\u00eb kufiri t\u00eb p\u00ebrbashk\u00ebt p\u00ebr memorjen e disponueshme (\"softlimit -m12345678\"), dhe n\u00eb k\u00ebt\u00eb rast problemi bllokohet. Nj\u00eb m\u00ebnyr\u00eb alternative mbrojtjeje p\u00ebrmendet gjithashtu kufizimi i madh\u00ebsis\u00eb maksimale t\u00eb mesazhit t\u00eb p\u00ebrpunuar p\u00ebrmes skedarit \"control\/databytes\" (n\u00eb vend t\u00eb default-it, nuk krijohet kur konfigurimet jan\u00eb standarde, qmail mbetet i ndjesh\u00ebm). P\u00ebr m\u00eb tep\u00ebr, \"control\/databytes\" nuk mbron nga sulmet lokale nga p\u00ebrdoruesit e sistemit, pasi kufizimi merret parasysh vet\u00ebm n\u00eb qmail-smtpd.<\/p>\n

Problemi prek paket\u00ebn netqmail<\/a><\/noindex>, i p\u00ebrfshir\u00eb n\u00eb depozitat Debian. Ky paket\u00eb ka nj\u00eb set patch-e t\u00eb p\u00ebrgatitura q\u00eb eliminojn\u00eb si dob\u00ebsit\u00eb e vjetra t\u00eb vitit 2005 (n\u00ebp\u00ebrmjet shtimit n\u00eb kodin e funksionit alloc() kufij t\u00eb rrept\u00eb mbi kujtes\u00ebn), ashtu si dhe problemet e reja n\u00eb qmail-verify. Ve\u00e7mas \u00ebsht\u00eb p\u00ebrgatitur<\/a><\/noindex> versioni i p\u00ebrdit\u00ebsuar i patch-it qmail-verify. Zhvilluesit dega<\/a><\/noindex> notqmail<\/a><\/noindex> kan\u00eb p\u00ebrgatitur patch-et e tyre p\u00ebr bllokimin e problemeve t\u00eb vjetra, si dhe kan\u00eb nisur pun\u00ebn p\u00ebr t\u00eb eliminuar \u00e7do mbushje t\u00eb mundshme t\u00eb numrave n\u00eb kod.<\/p>\n

<\/a><\/noindex><\/p>\n

Burimi: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Qualys \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 qmail, \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e\u0439 \u0435\u0449\u0451 \u0441 2005 \u0433\u043e\u0434\u0430 (CVE-2005-1513), \u043d\u043e \u043e\u0441\u0442\u0430\u0432\u0430\u0432\u0448\u0435\u0439\u0441\u044f \u043d\u0435\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u043e\u0439, \u0442\u0430\u043a \u043a\u0430\u043a \u0430\u0432\u0442\u043e\u0440 qmail \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u043b \u043e \u043d\u0435\u0440\u0435\u0430\u043b\u0438\u0441\u0442\u0438\u0447\u043d\u043e\u0441\u0442\u0438 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0435\u0433\u043e \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043c\u043e\u0433 \u0431\u044b \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e. \u0412 Qualys \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u0438\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u043e\u0438\u0442 \u043e\u043f\u0440\u043e\u0432\u0435\u0440\u0433\u0430\u044e\u0449\u0438\u0439 \u0434\u0430\u043d\u043d\u043e\u0435 \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0438\u043d\u0438\u0446\u0438\u0438\u0440\u043e\u0432\u0430\u0442\u044c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-82266","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Dob\u00ebsia e shfryt\u00ebzueshme n\u00eb distanc\u00eb n\u00eb serverin e post\u00ebs qmail | ProHoster","description":"K\u00ebrkuesit e siguris\u00eb nga kompania Qualys treguan mund\u00ebsin\u00eb","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/udalyonno-ekspluatiruemaya-uyazvimost-v-pochtovom-servere-qmail","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 qmail | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Qualys \u043f\u043e\u043a\u0430\u0437\u0430\u043b\u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c","og:url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/udalyonno-ekspluatiruemaya-uyazvimost-v-pochtovom-servere-qmail","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-20T17:42:07+00:00","article:modified_time":"2020-05-20T17:42:07+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"82266","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 15:41:28","updated":"2022-09-27 18:41:59","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/82266","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=82266"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/82266\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=82266"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=82266"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=82266"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}