Experts discovered a new critical OpenSMTPD RCE flaw
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-7247 | Unauthenticated Root RCE in OpenSMTPD 6.6 (OpenBSD and Linux) OpenSMTPD 6.6 contains a critical, unauthenticated remote code execution flaw (CWE-78) caused by an incorrect return value from input validation in smtp_mailaddr in smtp_session.c. A remote attacker triggers it during a normal SMTP session by supplying shell metacharacters in the MAIL FROM field; when OpenSMTPD runs with its default (uncommented) configuration, the unsanitized address is passed to a shell during mail delivery, executing attacker-supplied commands. Because the affected delivery path runs with root privileges, the attacker gains arbitrary command execution as root on the mail server. Affected deployments include OpenBSD 6.6, where OpenSMTPD is the default mail daemon, plus Debian, Fedora, and Ubuntu systems shipping OpenSMTPD 6.6. Exploitation is confirmed: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2022-03-25), multiple public PoC exploits exist, and EPSS estimates a 99% probability of exploitation within 30 days. Do: Apply vendor updates per CISA's required action: upgrade OpenSMTPD to the patched release (6.6.4p1 or later per vendor advisories) or install the OpenBSD 6.6 errata patch, and pull updated packages from Debian, Fedora, or Ubuntu. Verify your running version and whether the default (uncommented) smtpd.conf is in use; until patched, restrict access to the SMTP service from untrusted networks. Hunt for signs of compromise, such as unexpected commands or processes executed as root by smtpd. | 9.8 | 99% | KEV PoC ×6 |
| large≈10,000–100,000 internet-exposed OpenSMTPD servers (exact count unknown) | |
| CVE-2020-8794 | OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mta_io in mta_session.c for multi-line replies. OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mta_io in mta_session.c for multi-line replies. Although this vulnerability affects the client side of OpenSMTPD, it is possible to attack a server because the server code launches the client code during bounce handling. NVD description · AI analysis pending | 9.8 | 89% | PoC ×4 |
| — |
Full article465 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
February 25, 2020
Experts discovered a new critical remote code execution vulnerability in the OpenSMTPD that could allow hacking email servers running BSD or Linux.
A new critical remote code execution vulnerability was discovered in the OpenSMTPD that could be exploited by attackers to take complete control over email servers running BSD or Linux operating systems.
OpenSMTPD is an open-source implementation of the server-side SMTP protocol as defined by RFC 5321, it includes also some additional standard extensions. It allows ordinary machines to exchange emails with other systems speaking the SMTP protocol.
OpenSMTPD is present in many Linux distros, including on FreeBSD, NetBSD, Debian, Fedora, and Alpine Linux.
The new vulnerability was discovered by researchers from Qualys Research Labs, it is a read issue tracked as CVE-2020-8794.
The vulnerability resides in a component of the OpenSMTPD’s client-side code that was introduced in December 2015.
“We discovered a vulnerability in OpenSMTPD, OpenBSD’s mail server. This vulnerability, an out-of-bounds read introduced in December 2015 (commit 80c6a60c, “when peer outputs a multi-line response …”), is exploitable remotely and leads to the execution of arbitrary shell commands: either as root, after May 2018 (commit a8e22235, “switch smtpd to new grammar”); or as any non-root user, before May 2018.” reads the advisory published by the experts.
Experts pointed out that the attackers in the wild started exploiting the issue a few hours its disclosure.
The vulnerability could be exploited by a local or remote attacker in two by sending specially crafted SMTP messages. The experts described two attack scenarios related to Client-side exploitation and Server-side exploitation. The first scenario sees the remote exploitation of the flaw on a server with a default configuration, while in the second scenario the attackers first connect to the OpenSMTPD server then send an email that creates a bounce.
Experts developed a working exploit that successfully tested against OpenBSD 6.6 (the current release), OpenBSD 5.9 (the first ), Debian 10 (stable), Debian 11 (testing), and Fedora 31.
“We tested our exploit against the recent changes in OpenSMTPD 6.6.3p1, and our results are: if the “mbox” method is used for local delivery (the default in OpenBSD -current), then arbitrary command execution as root is still possible; otherwise (if the “maildir” method is used, for example), arbitrary command execution as any non-root user is possible.” continues the advisory.
Qualys plans to reveal exploitation details and exploit code after the 26th of February to give OpenSMTPD users the time to address their systems.
Admins of BSD or Linux servers are advised to download OpenSMTPD 6.6.4p1 and apply the patch as soon as possible.
In January, the same team of experts from Qualys spotted another vulnerability in the OpenSMTPD, tracked as CVE-2020-7247.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, OpenSMTPD)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/98452/hacking/opensmtpd-rce-flaw.html