{"id":35011,"date":"2019-10-31T22:01:50","date_gmt":"2019-10-31T19:01:50","guid":{"rendered":"https:\/\/prohoster.info\/blog\/kriticheskaya-uyazvimost-v-exim-pozvolyayushhaya-vypolnit-kod-na-servere-s-pravami-root\/"},"modified":"2019-10-31T22:01:50","modified_gmt":"2019-10-31T19:01:50","slug":"kriticheskaya-uyazvimost-v-exim-pozvolyayushhaya-vypolnit-kod-na-servere-s-pravami-root","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/kriticheskaya-uyazvimost-v-exim-pozvolyayushhaya-vypolnit-kod-na-servere-s-pravami-root","title":{"rendered":"Kritisk s\u00e5rbarhet i Exim som m\u00f6jligg\u00f6r kodexekvering p\u00e5 server med root-r\u00e4ttigheter","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

I e-postservern Exim uppt\u00e4cktes<\/a><\/noindex> kritisk s\u00e5rbarhet<\/a><\/noindex> (CVE-2019-10149<\/a><\/noindex>), vilket kan leda till fj\u00e4rrkodexekvering p\u00e5 servern med root-r\u00e4ttigheter vid behandling av speciellt formaterade f\u00f6rfr\u00e5gningar. Utnyttjande av problemet har noterats i versioner fr\u00e5n 4.87 till och med 4.91 eller i byggnader med alternativet EXPERIMENTAL_EVENT.<\/p>\n

I standardkonfigurationen kan en attack utf\u00f6ras utan st\u00f6rre komplikationer av en lokal anv\u00e4ndare, eftersom ACL \"verify = recipient\" anv\u00e4nds, vilket utf\u00f6r ytterligare kontroller f\u00f6r externa adresser. En avl\u00e4gsen attack \u00e4r m\u00f6jlig genom att \u00e4ndra inst\u00e4llningarna, till exempel genom att arbeta som sekund\u00e4r MX f\u00f6r en annan dom\u00e4n, ta bort ACL \"verify = recipient\" eller g\u00f6ra vissa \u00e4ndringar i local_part_suffix. En avl\u00e4gsen attack kan ocks\u00e5 utf\u00f6ras om en angripare kan h\u00e5lla anslutningen till servern \u00f6ppen i 7 dagar (till exempel genom att skicka ett byte per minut f\u00f6r att kringg\u00e5 avbrott p\u00e5 grund av timeout). Det utesluts inte att det kan finnas enklare vektorer f\u00f6r avl\u00e4gsen exploatering av problemet.<\/p>\n

S\u00e5rbarheten orsakas av felaktig kontroll av mottagaradressen i funktionen deliver_message(), definierad i filen \/src\/deliver.c. Genom att manipulera formatet p\u00e5 adressen kan angriparen f\u00e5 sina uppgifter att s\u00e4ttas in i argumenten f\u00f6r kommandot som anropas via funktionen execv() med root-r\u00e4ttigheter. F\u00f6r att utnyttja detta kr\u00e4vs inga komplicerade tekniker som anv\u00e4nds vid buffert\u00f6verskridningar eller minneskorruption, det r\u00e4cker med att bara s\u00e4tta in tecken. <\/p>\n

Problemet \u00e4r kopplat till anv\u00e4ndningen av konstruktionen f\u00f6r att omvandla adresser:<\/p>\n

deliver_localpart = expand_string(
\n string_sprintf(\"${local_part:%s}\", new->address));
\n deliver_domain = expand_string(
\n string_sprintf(\"${domain:%s}\", new->address));<\/p>\n

Funktionen expand_string() \u00e4r en \u00f6verkomplicerad kombination som bland annat k\u00e4nner igen kommandot \"${run{kommando argument}}\", <\/p>\n

Om servern fungerar som en postrelay \u00e4r det tillr\u00e4ckligt att skicka kommandot 'RCPT TO \"${run{...}}@relaydomain.com\"', d\u00e4r relaydomain.com \u00e4r en av v\u00e4rdarna som listas i inst\u00e4llningarna f\u00f6r relay_to_domains. Eftersom privilegiefall tillbaka inte anv\u00e4nds som standard i exim (deliver_drop_privilege = false), kommer kommandon som skickas via \"${run{...}}\" att utf\u00f6ras med root-beh\u00f6righet.<\/p>\n

Det \u00e4r v\u00e4rt att notera att s\u00e5rbarheten var har \u00e5tg\u00e4rdats<\/a><\/noindex> i version 4.92 som sl\u00e4pptes i februari utan att uppm\u00e4rksamma att \u00e5tg\u00e4rden kan leda till s\u00e4kerhetsproblem. Det finns ingen anledning att tro att det skett en avsiktlig t\u00e4ckning av s\u00e5rbarheten av Exims utvecklare, eftersom problemet \u00e5tg\u00e4rdades under \u00e5tg\u00e4rden<\/a><\/noindex> f\u00f6r en krasch som uppst\u00e5r vid \u00f6verf\u00f6ring av felaktiga adresser, och s\u00e5rbarheten uppt\u00e4cktes av Qualys under en revision av \u00e4ndringar i Exim. <\/p>\n

\u00c5tg\u00e4rden f\u00f6r tidigare versioner, som fortfarande anv\u00e4nds i distributioner, finns hittills endast i form av en patch<\/a><\/noindex>. Korrigerande versioner f\u00f6r tidigare grenar som \u00e5tg\u00e4rdar problemet planeras den 11 juni. Paketuppdateringar har f\u00f6rberetts f\u00f6r Debian<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, openSUSE<\/a><\/noindex>. Arch Linux<\/a><\/noindex> och Fedora<\/a><\/noindex> levererar version 4.92, d\u00e4r problemet inte yttrar sig. RHEL och CentOS \u00e4r inte p\u00e5verkade<\/a><\/noindex>, eftersom Exim inte ing\u00e5r i deras officiella paketrepository.<\/p>\n

<\/a><\/noindex><\/p>\n

K\u00e4lla: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 Exim \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2019-10149), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0437\u0430\u043f\u0440\u043e\u0441\u0430. \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043e\u0442\u043c\u0435\u0447\u0435\u043d\u0430 \u0432 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 \u0441 4.87 \u043f\u043e 4.91 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0438\u043b\u0438 \u043f\u0440\u0438 \u0441\u0431\u043e\u0440\u043a\u0435 \u0441 \u043e\u043f\u0446\u0438\u0435\u0439 EXPERIMENTAL_EVENT. \u0412 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0430\u0442\u0430\u043a\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0430 \u0431\u0435\u0437 \u043b\u0438\u0448\u043d\u0438\u0445 \u0443\u0441\u043b\u043e\u0436\u043d\u0435\u043d\u0438\u0439 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-35011","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kritisk s\u00e5rbarhet i Exim som m\u00f6jligg\u00f6r k\u00f6rning av kod p\u00e5 servern med root-beh\u00f6righeter | ProHoster","description":"I e-postservern Exim har en kritisk","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/kriticheskaya-uyazvimost-v-exim-pozvolyayushhaya-vypolnit-kod-na-servere-s-pravami-root","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Exim, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root | ProHoster","og:description":"\u0412 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 Exim \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/kriticheskaya-uyazvimost-v-exim-pozvolyayushhaya-vypolnit-kod-na-servere-s-pravami-root","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:01:50+00:00","article:modified_time":"2019-10-31T19:01:50+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"35011","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 21:28:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:11:30","updated":"2026-01-21 21:28:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/35011","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=35011"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/35011\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=35011"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=35011"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=35011"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}