ืงืจื™ื˜ื™ืฉ ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™ ืื™ืŸ ืขืงืกื™ื ืึทื– ืึทืœืึทื•ื– ืงืึธื“ ืฆื• ื–ื™ื™ืŸ ืขืงืกืึทืงื™ื•ื˜ืึทื“ ืื•ื™ืฃ ื“ื™ ืกืขืจื•ื•ืขืจ ืžื™ื˜ ื•ื•ืึธืจืฆืœ ืคึผืจื™ื•ื•ื™ืœืึทื“ื–ืฉืึทื–

ืื™ืŸ ืขืงืกื™ื ืคึผืึธืกื˜ ืกืขืจื•ื•ืขืจ ื™ื™ื“ืขื ืึทืคื™ื™ื“ ืงืจื™ื˜ื™ืฉ ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™ (CVE-2019-10149), ื•ื•ืึธืก ืงืขื ืขืŸ ืคื™ืจืŸ ืฆื• ื•ื•ื™ื™ึทื˜ ืงืึธื“ ื“ื•ืจื›ืคื™ืจื•ื ื’ ืื•ื™ืฃ ื“ื™ ืกืขืจื•ื•ืขืจ ืžื™ื˜ ื•ื•ืึธืจืฆืœ ืจืขื›ื˜ ื•ื•ืขืŸ ืคึผืจืึทืกืขืกื™ื ื’ ืึท ืกืคึผืขืฆื™ืขืœ ืงืจืึทืคื˜ืขื“ ื‘ืขื˜ืŸ. ื“ื™ ืžืขื’ืœืขื›ืงื™ื™ื˜ ืคื•ืŸ ืขืงืกืคึผืœื•ื™ื˜ื™ื™ืฉืึทืŸ ืคื•ืŸ ื“ืขื ืคึผืจืึธื‘ืœืขื ืื™ื– ื’ืขื•ื•ืขืŸ ื‘ืืžืขืจืงื˜ ืื™ืŸ ื•ื•ืขืจืกื™ืขืก ืคื•ืŸ 4.87 ืฆื• 4.91 ื™ื ืงืœื•ืกื™ื•ื• ืึธื“ืขืจ ื•ื•ืขืŸ ื‘ื ื™ืŸ ืžื™ื˜ ื“ื™ EXPERIMENTAL_EVENT ืึธืคึผืฆื™ืข.

ืื™ืŸ ื“ื™ ืคืขืœื™ืงื™ื™ึทื˜ ืงืึทื ืคื™ื’ื™ืขืจื™ื™ืฉืึทืŸ, ื“ื™ ื‘ืึทืคืึทืœืŸ ืงืขื ืขืŸ ื–ื™ื™ืŸ ื“ื•ืจื›ื’ืขืงืึธื›ื˜ ืึธืŸ ื•ืžื ื™ื™ื˜ื™ืง ืงืึทืžืคึผืœืึทืงื™ื™ืฉืึทื ื– ื“ื•ืจืš ืึท ื”ื™ื’ืข ื‘ืึทื ื™ืฆืขืจ, ื•ื•ื™ื™ึทืœ ื“ื™ "ื‘ืึทืฉื˜ืขื˜ื™ืงืŸ = ื‘ืึทืงื•ืžืขืจ" ืึทืงืœ ืื™ื– ื’ืขื•ื•ืขื ื“ื˜, ื•ื•ืึธืก ืคึผืขืจืคืึธืจืžื– ื ืึธืš ื˜ืฉืขืงืก ืคึฟืึทืจ ืคื•ื ื“ืจื•ื™ืกื ื“ื™ืง ื•ื•ืขื ื“ื˜. ื ื•ื•ื™ื™ึทื˜ ื‘ืึทืคืึทืœืŸ ืงืขื ืขืŸ ืคึผืึทืกื™ืจืŸ ื•ื•ืขืŸ ืกืขื˜ื˜ื™ื ื’ืก ื–ืขื ืขืŸ ื˜ืฉื™ื™ื ื“ื–ืฉื“, ืึทื–ืึท ื•ื•ื™ ืึทืงื˜ื™ื ื’ ื•ื•ื™ ืึท ืฆื•ื•ื™ื™ื˜ื™ืง ืžืงืก ืคึฟืึทืจ ืืŸ ืื ื“ืขืจ ืคืขืœื“, ืจื™ืžื•ื•ื•ื™ื ื’ ื“ื™ "ื•ื•ืขืจื™ืคื™ = ื‘ืึทืงื•ืžืขืจ" ืึทืงืœ, ืึธื“ืขืจ ื–ื™ื›ืขืจ ืขื ื“ืขืจื•ื ื’ืขืŸ ืฆื• local_part_suffix). ื ื•ื•ื™ื™ึทื˜ ื‘ืึทืคืึทืœืŸ ืื™ื– ืื•ื™ืš ืžืขื’ืœืขืš ืื•ื™ื‘ ื“ื™ ืึทื˜ืึทืงืขืจ ืื™ื– ื‘ื™ื›ื•ืœืช ืฆื• ื”ืึทืœื˜ืŸ ื“ื™ ืคึฟืึทืจื‘ื™ื ื“ื•ื ื’ ืฆื• ื“ื™ ืกืขืจื•ื•ืขืจ ืึธืคืŸ ืคึฟืึทืจ 7 ื˜ืขื’ (ืœืžืฉืœ, ืฉื™ืงืŸ ืื™ื™ืŸ ื‘ื™ื™ื˜ ืคึผืขืจ ืžื™ื ื•ื˜ ืฆื• ื‘ื™ื™ืคึผืึทืก ืึท ื˜ื™ื™ืžืึทื•ื˜). ืื™ืŸ ื“ืขืจ ื–ืขืœื‘ื™ืงืขืจ ืฆื™ื™ื˜, ืขืก ืื™ื– ืžืขื’ืœืขืš ืึทื– ืขืก ื–ืขื ืขืŸ ืกื™ืžืคึผืœืขืจ ื‘ืึทืคืึทืœืŸ ื•ื•ืขืงื˜ืึธืจืก ืคึฟืึทืจ ื•ื•ื™ื™ึทื˜ ืขืงืกืคึผืœื•ื™ื˜ื™ื™ืฉืึทืŸ ืคื•ืŸ ื“ืขื ืคึผืจืึธื‘ืœืขื.

ื“ื™ ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™ ืื™ื– ื’ืขืคึฟื™ืจื˜ ื“ื•ืจืš ืคืึทืœืฉ ื•ื•ืขืจืึทืคืึทืงื™ื™ืฉืึทืŸ ืคื•ืŸ ื“ื™ ืึทื“ืจืขืก ืคื•ืŸ ื“ื™ ื‘ืึทืงื•ืžืขืจ ืื™ืŸ ื“ื™ ื“ืขืœื™ื•ื•ืขืจ_ืžืขืกืกืึทื’ืข () ืคึฟื•ื ืงืฆื™ืข ื“ื™ืคื™ื™ื ื“ ืื™ืŸ ื“ื™ /src/deliver.c ื˜ืขืงืข. ื“ื•ืจืš ืžืึทื ื™ืคึผื™ืึทืœื™ื™ื˜ื™ื ื’ ื“ื™ ืึทื“ืจืขืก ืคืึธืจืžืึทื˜ื˜ื™ื ื’, ืึท ืึทื˜ืึทืงืขืจ ืงืขื ืขืŸ ื“ืขืจื’ืจื™ื™ื›ืŸ ื“ื™ ืกืึทื‘ืกื˜ื™ื˜ื•ืฉืึทืŸ ืคื•ืŸ ื–ื™ื™ืŸ ื“ืึทื˜ืŸ ืื™ืŸ ื“ื™ ืึทืจื’ื•ืžืขื ื˜ืŸ ืคื•ืŸ ืึท ื‘ืึทืคึฟืขืœ ื’ืขืจื•ืคึฟืŸ ื“ื•ืจืš ื“ื™ ืขืงืกืขืงื•ื• () ืคึฟื•ื ืงืฆื™ืข ืžื™ื˜ ื•ื•ืึธืจืฆืœ ืจืขื›ื˜. ืึธืคึผืขืจืึทืฆื™ืข ื˜ื•ื˜ ื ื™ืฉื˜ ื“ืึทืจืคืŸ ื“ื™ ื ื•ืฆืŸ ืคื•ืŸ ืงืึธืžืคึผืœืขืงืก ื˜ืขืงื ื™ืงืก ื’ืขื ื™ืฆื˜ ืคึฟืึทืจ ื‘ืึทืคืขืจ ืึธื•ื•ื•ืขืจืคืœืึธื•ื– ืึธื“ืขืจ ื–ื™ืงืึธืจืŸ ืงืึธืจื•ืคึผืฆื™ืข ืื™ื– ื’ืขื ื•ื’;

ื“ื™ ืคึผืจืึธื‘ืœืขื ืื™ื– ืฉื™ื™ึทื›ื•ืช ืฆื• ื“ื™ ื ื•ืฆืŸ ืคื•ืŸ ื“ื™ ืงืึทื ืกื˜ืจืึทืงืฉืึทืŸ ืคึฟืึทืจ ืึทื“ืจืขืก ืงืึทื ื•ื•ืขืจื–ืฉืึทืŸ:

ื“ืขืœื™ื•ื•ืขืจ_ืœืึธืงืึทืœืคึผืึทืจื˜ = ื™ืงืกืคึผืึทื ื“_ืกื˜ืจื™ื ื’ (
string_sprintf ("${ืœืึธืงืึทืœ_ื˜ื™ื™ืœ:%s}", ื ื™ื™ึท-> ืึทื“ืจืขืก));
ื“ืขืœื™ื•ื•ืขืจ_ื“ืึธืžื™ื™ืŸ = ื™ืงืกืคึผืึทื ื“_ืกื˜ืจื™ื ื’ (
string_sprintf ("${ ืคืขืœื“:% s}", ื ื™ื™ึท-> ืึทื“ืจืขืก));

ื“ื™ ื™ืงืกืคึผืึทื ื“_ืกื˜ืจื™ื ื’ () ืคึฟื•ื ืงืฆื™ืข ืื™ื– ืึทืŸ ืึธื•ื•ื•ืขืจืงืึทืžืคึผืœื™ืงื™ื™ื˜ื™ื“ ืงืึทืžื‘ืึทื ืขืจ, ืึทืจื™ื™ึทื ื’ืขืจืขื›ื ื˜ ื“ืขืจืงืขื ื•ื ื’ ืคื•ืŸ ื“ื™ ื‘ืึทืคึฟืขืœ "$ {ืจืึทืŸ{ ื‘ืึทืคึฟืขืœืŸ ืึทืจื’ื•ืžืขื ื˜ืŸ}", ื•ื•ืึธืก ืคื™ืจื˜ ืฆื• ื“ื™ ืงืึทื˜ืขืจ ืคื•ืŸ ืึท ืคื•ื ื“ืจื•ื™ืกื ื“ื™ืง ื”ืึทื ื“ืœืขืจ. ืื–ื•ื™, ืฆื• ื‘ืึทืคืึทืœืŸ ืื™ืŸ ืึท SMTP ืกืขืกื™ืข, ืึท ื”ื™ื’ืข ื‘ืึทื ื™ืฆืขืจ ื“ืึทืจืฃ ื‘ืœื•ื™ื– ืฉื™ืงืŸ ืึท ื‘ืึทืคึฟืขืœ ื•ื•ื™ 'RCPT TO "ื ื•ืฆืขืจื ืึทืžืข + ${ืœื•ื™ืคืŸ{...}}@localhost"', ื•ื•ื• ืœืึธืงืึทืœื”ืึธืกื˜ ืื™ื– ืื™ื™ื ืขืจ ืคื•ืŸ ื“ื™ ืžื—ื ื•ืช ืคื•ืŸ ื“ื™ ืœืึธืงืึทืœ_ื“ืึธืžืึทื™ื ืก ืจืฉื™ืžื”, ืื•ืŸ ื‘ืึทื ื™ืฆืขืจ ื ืึธืžืขืŸ ืื™ื– ื“ืขืจ ื ืึธืžืขืŸ ืคื•ืŸ ืึทืŸ ื™ื’ื–ื™ืกื˜ื™ื ื’ ื”ื™ื’ืข ื‘ืึทื ื™ืฆืขืจ.

ืื•ื™ื‘ ื“ืขืจ ืกืขืจื•ื•ืขืจ ืึทืจื‘ืขื˜ ื•ื•ื™ ืึท ืคึผืึธืกื˜ ืจืขืœืข, ืขืก ืื™ื– ื’ืขื ื•ื’ ืฆื• ืจื™ืžืึธื•ื˜ืœื™ ืฉื™ืงืŸ ื“ื™ ื‘ืึทืคึฟืขืœ 'RCPT TO "${run{...}}@relaydomain.com"', ื•ื•ื• relaydomain.com ืื™ื– ืื™ื™ื ืขืจ ืคื•ืŸ ื“ื™ ืžื—ื ื•ืช ืœื™ืกื˜ืขื“ ืื™ืŸ ื“ื™ relay_to_domains ืกืขื˜ื˜ื™ื ื’ืก ืึธืคึผื˜ื™ื™ืœื•ื ื’. ื–ื™ื ื˜ ืขืงืกื™ื ืื™ื– ื ื™ื˜ ืคืขืœื™ืงื™ื™ึทื˜ ืฆื• ืคืึทืœืŸ ืคึผืจื™ื•ื•ื™ืœืขื’ื™ืข ืžืึธื“ืข (deliver_drop_privilege = ืคืึทืœืฉ), ืงืึทืžืึทื ื“ื– ื“ื•ืจื›ื’ืขื’ืื ื’ืขืŸ ื“ื•ืจืš "${ืœื•ื™ืคืŸ{...}}" ื•ื•ืขื˜ ื–ื™ื™ืŸ ืขืงืกืึทืงื™ื•ื˜ืึทื“ ื•ื•ื™ ื•ื•ืึธืจืฆืœ.

ืขืก ืื™ื– ื ืึธื•ื˜ื•ื•ืขืจื“ื™ ืึทื– ื“ื™ ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™ ืื™ื– ื’ืขื•ื•ืขืŸ ื™ืœื™ืžืึทื ื™ื™ื˜ืึทื“ ืื™ืŸ ื“ื™ 4.92 ืžืขืœื“ื•ื ื’ ืคืจื™ื™ ืื™ืŸ ืคืขื‘ืจื•ืืจ, ืึธืŸ ืขืžืคืึทืกื™ื™ื–ื™ื ื’ ืึทื– ื“ื™ ืคืึทืจืจื™ื›ื˜ืŸ ืงืขืŸ ืคื™ืจืŸ ืฆื• ื–ื™ื›ืขืจื”ื™ื™ื˜ ืคึผืจืึธื‘ืœืขืžืก. ืขืก ืื™ื– ืงื™ื™ืŸ ืกื™ื‘ื” ืฆื• ื’ืœื•ื™ื‘ืŸ ืึทื– ืขืก ืื™ื– ื’ืขื•ื•ืขืŸ ืึท ื“ื™ืœื™ื‘ืจืึทื˜ ืงืึทื ืกื™ืœืžืึทื ื˜ ืคื•ืŸ ื“ื™ ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™ ื“ื•ืจืš ื“ื™ ืขืงืกื™ื ื“ืขื•ื•ืขืœืึธืคึผืขืจืก, ื–ื™ื ื˜ ื“ื™ ืคึผืจืึธื‘ืœืขื ืื™ื– ืคืึทืจืคืขืกื˜ื™ืงื˜ ื‘ืขืฉืึทืก ืคื™ืงืกื™ื– ื“ื•ืจื›ืคืึทืœ ื•ื•ืึธืก ืึทืงืขืจื– ื•ื•ืขืŸ ืคืึทืœืฉ ืึทื“ืจืขืกืขืก ื–ืขื ืขืŸ ื˜ืจืึทื ืกืžื™ื˜ื˜ืขื“, ืื•ืŸ ื“ื™ ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™ ืื™ื– ื™ื™ื“ืขื ืึทืคื™ื™ื“ ื“ื•ืจืš Qualys ื‘ืขืฉืึทืก ืึทืŸ ืงืึธื ื˜ืจืึธืœื™ืจืŸ ืคื•ืŸ ืขื ื“ืขืจื•ื ื’ืขืŸ ืื™ืŸ ืขืงืกื™ื.

ื ืคืึทืจืจื™ื›ื˜ืŸ ืคึฟืึทืจ ืคืจื™ื™ึทืขืจื“ื™ืง ื•ื•ืขืจืกื™ืขืก ื•ื•ืึธืก ืคืึธืจื–ืขืฆืŸ ืฆื• ื–ื™ื™ืŸ ื’ืขื•ื•ื™ื™ื ื˜ ืื™ืŸ ื“ื™ืกื˜ืจื™ื‘ื™ื•ืฉืึทื ื– ืื™ื– ื“ืขืจื•ื•ื™ื™ึทืœ ื‘ืœื•ื™ื– ื‘ื ื™ืžืฆื ื•ื•ื™ ืœืึทื˜ืข. ืงืขืจืขืงื˜ื™ื•ื• ืจื™ืœื™ืกื™ื– ืคึฟืึทืจ ืคืจื™ื™ึทืขืจื“ื™ืง ืฆื•ื•ื™ื™ื’ืŸ ืฆื• ืคืึทืจืจื™ื›ื˜ืŸ ื“ืขื ืคึผืจืึธื‘ืœืขื ื–ืขื ืขืŸ ืกืงืขื“ื–ืฉื•ืœื“ ืคึฟืึทืจ 11 ื™ื•ื ื™. ืคึผืขืงืœ ื“ืขืจื”ื™ื™ึทื ื˜ื™ืงื•ื ื’ืขืŸ ื–ืขื ืขืŸ ื’ืจื™ื™ื˜ ืคึฟืึทืจ ื“ืขื‘ื™ืึทืŸ, ื•ื‘ื•ื ื˜ื•, openSUSE. ืึทืจื˜ืฉ ืœื™ื ื•ืงืก ะธ ืคืขื“ืึธืจืึท ื–ื™ื™ ืฆื•ืฉื˜ืขืœืŸ ื•ื•ืขืจืกื™ืข 4.92, ืื™ืŸ ื•ื•ืึธืก ื“ื™ ืคึผืจืึธื‘ืœืขื ืงืขืŸ ื ื™ืฉื˜ ื“ืขืจืฉื™ื™ึทื ืขืŸ. RHEL ืื•ืŸ CentOS ืคึผืจืึธื‘ืœืขื ื ื™ื˜ ืกืึทืกืขืคึผื˜ืึทื‘ืึทืœ, ื–ื™ื ื˜ ืขืงืกื™ื ืื™ื– ื ื™ืฉื˜ ืึทืจื™ื™ึทื ื’ืขืจืขื›ื ื˜ ืื™ืŸ ื–ื™ื™ืขืจ ืจืขื’ื•ืœืขืจ ืคึผืขืงืœ ืจื™ืคึผืึทื–ืึทื˜ืึธืจื™.

ืžืงื•ืจ: opennet.ru

ืœื™ื™ื’ืŸ ืึท ื‘ืึทืžืขืจืงื•ื ื’