{"id":37876,"date":"2019-10-31T22:20:17","date_gmt":"2019-10-31T19:20:17","guid":{"rendered":"https:\/\/prohoster.info\/blog\/raskryty-podrobnosti-kriticheskoj-uyazvimosti-v-exim\/"},"modified":"2019-10-31T22:20:17","modified_gmt":"2019-10-31T19:20:17","slug":"raskryty-podrobnosti-kriticheskoj-uyazvimosti-v-exim","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/raskryty-podrobnosti-kriticheskoj-uyazvimosti-v-exim","title":{"rendered":"Detaljer om en kritisk s\u00e5rbarhet i Exim har avsl\u00f6jats","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Publicerad<\/a><\/noindex> korrigerande utg\u00e5va Exim 4.92.2<\/a><\/noindex> med \u00e5tg\u00e4rd av kritisk s\u00e5rbarheten<\/a><\/noindex> (CVE-2019-15846<\/a><\/noindex>), som i standardkonfiguration kan leda till fj\u00e4rrutf\u00f6rande av kod av en angripare med root-r\u00e4ttigheter. Problemet uppst\u00e5r endast n\u00e4r TLS-st\u00f6d \u00e4r aktiverat och utnyttjas genom \u00f6verf\u00f6ring av ett specialdesignat klientcertifikat eller \u00e4ndrat v\u00e4rde i SNI. S\u00e5rbarhet uppt\u00e4cktes<\/a><\/noindex> fr\u00e5n f\u00f6retaget Qualys.<\/p>\n

Problemet \u00e4r n\u00e4rvarande<\/a><\/noindex> i hanteraren f\u00f6r att undvika specialtecken i str\u00e4ngen (string_interpret_escape()<\/a><\/noindex> fr\u00e5n string.c) och orsakas av att tecknet \u2019 i slutet av str\u00e4ngen tolkas f\u00f6re nolltecknet (\u2019) och maskerar det. Vid maskering behandlas sekvensen \u2019 och efterf\u00f6ljande nollkod f\u00f6r slutet av str\u00e4ngen som ett tecken och pekaren flyttas till data utanf\u00f6r str\u00e4ngen, som behandlas som dess forts\u00e4ttning. <\/p>\n

Koden som anropar string_interpret_escape() allokerar en buffer baserat p\u00e5 den faktiska storleken, och den angivna pekaren hamnar i ett omr\u00e5de utanf\u00f6r bufferten. F\u00f6ljaktligen uppst\u00e5r en situation d\u00e4r man f\u00f6rs\u00f6ker l\u00e4sa data fr\u00e5n ett omr\u00e5de utanf\u00f6r buffertens gr\u00e4nser n\u00e4r den inmatade str\u00e4ngen bearbetas, och ett f\u00f6rs\u00f6k att skriva den avkodade str\u00e4ngen kan leda till skrivning utanf\u00f6r bufferten.<\/p>\n

I standardkonfiguration kan s\u00e5rbarheten utnyttjas genom att \u00f6verf\u00f6ra specialdesignade data i SNI vid etablering av en s\u00e4ker anslutning till servern. Problemet kan ocks\u00e5 utnyttjas genom att \u00e4ndra v\u00e4rdena f\u00f6r peerdn i konfigurationer som \u00e4r inst\u00e4llda f\u00f6r autentisering med klientcertifikat, eller vid import av certifikat. Attacken via SNI och peerdn \u00e4r m\u00f6jlig fr\u00e5n versionen Exim 4.80<\/a><\/noindex>, d\u00e4r funktionen string_unprinting() till\u00e4mpades f\u00f6r att avkoda inneh\u00e5llet i peerdn och SNI.<\/p>\n

En prototyp f\u00f6r en SNI-baserad attack har f\u00f6rberetts, som fungerar p\u00e5 i386- och amd64-arkitekturer i Linux-system med Glibc. Exploiten anv\u00e4nder data\u00f6verlagring p\u00e5 heap-omr\u00e5det, vilket leder till att minnet d\u00e4r loggfilens namn lagras \u00f6verskrivs. Filnamnet ers\u00e4tts med \u2018\/..\/..\/..\/..\/..\/..\/..\/..\/etc\/passwd\u2019. Variabeln med avs\u00e4ndaradressen skrivs ocks\u00e5 \u00f6ver, vilket f\u00f6rst sparas i loggen, vilket g\u00f6r att man kan l\u00e4gga till en ny anv\u00e4ndare i systemet. <\/p>\n

Paketuppdateringar f\u00f6r att \u00e5tg\u00e4rda s\u00e5rbarheten har sl\u00e4ppts av distribut\u00f6rerna Debian<\/a><\/noindex>, Ubuntu<\/a><\/noindex>, Fedora<\/a><\/noindex>, SUSE\/openSUSE<\/a><\/noindex> och FreeBSD<\/a><\/noindex>. RHEL och CentOS problemet p\u00e5verkade<\/a><\/noindex>, eftersom Exim inte ing\u00e5r i deras standardpaketrepository (i EPEL<\/a><\/noindex> uppdatering redan<\/a><\/noindex> har formulerats<\/a><\/noindex>, men \u00e4nnu inte placerat<\/a><\/noindex> i det offentliga repositoryt). I Exim-koden \u00e5tg\u00e4rdas problemet med en enradig patchen<\/a><\/noindex>, som inaktiverar effekt av bak\u00e5tsnedstreck om det finns i slutet av raden.<\/p>\n

Som en tillf\u00e4llig l\u00f6sning f\u00f6r att blockera s\u00e5rbarheten kan man inaktivera TLS-st\u00f6det eller l\u00e4gga till i
\nACL-avsnittet \u2018acl_smtp_mail\u2019:\n<\/p>\n

neka villkor = ${if eq{\\}{${substr{-1}{1}{$tls_in_sni}}}}
\n neka villkor = ${if eq{\\}{${substr{-1}{1}{$tls_in_peerdn}}}}<\/p>\n

<\/a><\/noindex><\/p>\n

K\u00e4lla: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0439 \u0432\u044b\u043f\u0443\u0441\u043a Exim 4.92.2 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2019-15846), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u0440\u0438 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 TLS \u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u043e\u0433\u043e \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 \u0438\u043b\u0438 \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0432 SNI. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Qualys. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0435 \u044d\u043a\u0440\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u043f\u0435\u0446\u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-37876","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Detaljer om den kritiska s\u00e5rbarheten i Exim | ProHoster","description":"En korrigerande version av Exim har publicerats.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/raskryty-podrobnosti-kriticheskoj-uyazvimosti-v-exim","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Exim | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0439 \u0432\u044b\u043f\u0443\u0441\u043a Exim.","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/raskryty-podrobnosti-kriticheskoj-uyazvimosti-v-exim","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:20:17+00:00","article:modified_time":"2019-10-31T19:20:17+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37876","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 19:36:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:19:22","updated":"2026-01-23 19:36:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/37876","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=37876"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/37876\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=37876"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=37876"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=37876"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}