Ukukhishwa kweseva ye-imeyili ye-Exim 4.94.2 kushicilelwe ngokususwa kobungozi obungu-21 (CVE-2020-28007-CVE-2020-28026, CVE-2021-27216), obuhlonzwe yi-Qualys futhi bethulwa ngaphansi kwegama lekhodi. 21Izinzipho. Izinkinga eziyi-10 zingasetshenziswa ukude (okuhlanganisa ukusebenzisa ikhodi enamalungelo ezimpande) ngokukhohlisa imiyalo ye-SMTP lapho usebenzisana neseva.
Zonke izinguqulo ze-Exim, umlando wazo olandelelwe ku-Git kusukela ngo-2004, uthintwa inkinga. Ama-prototypes asebenzayo wokuxhashazwa alungiselelwe ubungozi bendawo obu-4 kanye nezinkinga ezikude ezi-3. Ukuxhashazwa kobungozi basendaweni (CVE-2020-28007, CVE-2020-28008, CVE-2020-28015, CVE-2020-28012) kukuvumela ukuthi ukhuphule amalungelo akho kumsebenzisi oyimpande. Izinkinga ezimbili ezikude (CVE-2020-28020, CVE-2020-28018) zivumela ikhodi ukuthi isetshenziswe ngaphandle kokuqinisekisa njengomsebenzisi we-Exim (ungabe usuthola ukufinyelela kwezimpande ngokusebenzisa okukodwa kobungozi basendaweni).
Ukuba sengozini kwe-CVE-2020-28021 kuvumela ukwenziwa kwekhodi okukude ngokushesha ngamalungelo ezimpande, kodwa kudinga ukufinyelela okuqinisekisiwe (umsebenzisi kufanele asungule iseshini eqinisekisiwe, ngemva kwalokho angasebenzisa ubungozi ngokukhohlisa ipharamitha ye-AUTH kumyalo we-MAIL FROM). Inkinga ibangelwa ukuthi umhlaseli angakwazi ukuzuza ukushintsha kweyunithi yezinhlamvu kunhlokweni yefayela le-spool ngokubhala inani eliqinisekisiwe_lokuthumela ngaphandle kokubaleka ngokufanelekile izinhlamvu ezikhethekile (isibonelo, ngokudlulisela umyalo othi “MAIL FROM:<> AUTH=Raven+0AReyes”) .
Ukwengeza, kuyaphawulwa ukuthi okunye ukuba sengozini okukude, i-CVE-2020-28017, kuyasebenziseka ukuze kusetshenziswe ikhodi enamalungelo omsebenzisi “okukhiphayo” ngaphandle kokuqinisekisa, kodwa kudinga inkumbulo engaphezu kuka-25 GB. Ngokulimala okungu-13 okusele, ukuxhaphaza kungase kulungiswe, kodwa ukusebenza ngale ndlela akukakakwenziwa.
Abathuthukisi be-Exim bazisiwe ngezinkinga emuva ngo-Okthoba wonyaka odlule futhi bachitha izinyanga ezingaphezu kwezingu-6 belungisa ukulungisa. Bonke abalawuli bayanconywa ukuthi babuyekeze i-Exim ngokuphuthumayo kumaseva wabo wemeyili ibe yinguqulo engu-4.94.2. Zonke izinguqulo ze-Exim ngaphambi kokukhululwa kwe-4.94.2 zimenyezelwe njengeziphelelwe yisikhathi. Ukushicilelwa kwenguqulo entsha kwahlanganiswa nokusatshalaliswa okushicilelwe ngesikhathi esisodwa izibuyekezo zephakheji: Ubuntu, Arch Linux, FreeBSD, Debian, SUSE kanye neFedora. I-RHEL ne-CentOS azithintwa inkinga, njengoba i-Exim ingafakiwe kunqolobane yabo yephakheji evamile (i-EPEL ayikabi naso isibuyekezo).
Ubungozi obususiwe:
- I-CVE-2020-28017: Ukuchichima okuphelele emsebenzini we-receiver_add_recipient();
- I-CVE-2020-28020: Ukuchichima okuphelele emsebenzini we-receiver_msg();
- I-CVE-2020-28023: Ngaphandle kwemingcele ifundeka ku-smtp_setup_msg();
- I-CVE-2020-28021: Ukufakwa esikhundleni somugqa omusha kunhlokweni yefayela le-spool;
- I-CVE-2020-28022: Bhala futhi ufunde endaweni engaphandle kwebhafa eyabelwe kumsebenzi we-extract_option();
- I-CVE-2020-28026: Ukunqanyulwa kwentambo nokufaka esikhundleni kokuthi spool_read_header();
- I-CVE-2020-28019: Ukuphahlazeka lapho kusethwa kabusha isikhombi somsebenzi ngemva kokwenzeka kwephutha le-BDAT;
- I-CVE-2020-28024: Ukugeleza kwebhafa ngaphansi komsebenzi othi smtp_ungetc();
- I-CVE-2020-28018: Ukufinyelela kubhafa yokusebenzisa ngemva kwamahhala ku-tls-openssl.c
- I-CVE-2020-28025: Okungaphandle kwemingcele kufundwe kumsebenzi we-pdkim_finish_bodyhash().
Ukuba sengozini kwendawo:
- I-CVE-2020-28007: Ukuhlaselwa kwesixhumanisi esingokomfanekiso kuhla lwemibhalo ye-Exim;
- I-CVE-2020-28008: Ukuhlaselwa kwenkomba ye-Spool;
- I-CVE-2020-28014: Ukudalwa kwefayela ngokungafanele;
- I-CVE-2021-27216: Ukususwa kwefayela ngokunganaki;
- I-CVE-2020-28011: Ukuchichima kwebhafa ku-queue_run();
- I-CVE-2020-28010: Ngaphandle kwemingcele bhala ngokuyinhloko();
- I-CVE-2020-28013: Ukuchichima kwebhafa emsebenzini parse_fix_phrase();
- I-CVE-2020-28016: Ngaphandle kwemingcele bhala ku-parse_fix_phrase();
- I-CVE-2020-28015: Ukufakwa esikhundleni somugqa omusha kunhlokweni yefayela le-spool;
- I-CVE-2020-28012: Ifulegi le-close-on-exec elilahlekile lepayipi elinelungelo elingashiwongo;
- I-CVE-2020-28009: Ukuchichima okuphelele emsebenzini we-get_stdinput().
Source: opennet.ru