Critical RCE flaw in OpenSMTPD, patch available
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-7247 | Unauthenticated Root RCE in OpenSMTPD 6.6 (OpenBSD and Linux) OpenSMTPD 6.6 contains a critical, unauthenticated remote code execution flaw (CWE-78) caused by an incorrect return value from input validation in smtp_mailaddr in smtp_session.c. A remote attacker triggers it during a normal SMTP session by supplying shell metacharacters in the MAIL FROM field; when OpenSMTPD runs with its default (uncommented) configuration, the unsanitized address is passed to a shell during mail delivery, executing attacker-supplied commands. Because the affected delivery path runs with root privileges, the attacker gains arbitrary command execution as root on the mail server. Affected deployments include OpenBSD 6.6, where OpenSMTPD is the default mail daemon, plus Debian, Fedora, and Ubuntu systems shipping OpenSMTPD 6.6. Exploitation is confirmed: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2022-03-25), multiple public PoC exploits exist, and EPSS estimates a 99% probability of exploitation within 30 days. Do: Apply vendor updates per CISA's required action: upgrade OpenSMTPD to the patched release (6.6.4p1 or later per vendor advisories) or install the OpenBSD 6.6 errata patch, and pull updated packages from Debian, Fedora, or Ubuntu. Verify your running version and whether the default (uncommented) smtpd.conf is in use; until patched, restrict access to the SMTP service from untrusted networks. Hunt for signs of compromise, such as unexpected commands or processes executed as root by smtpd. | 9.8 | 99% | KEV PoC ×6 |
| large≈10,000–100,000 internet-exposed OpenSMTPD servers (exact count unknown) |
Full article363 words · extracted from helpnetsecurity.com · click to collapse
Qualys researchers have discovered a critical vulnerability (CVE-2020-7247) in OpenBSD’s OpenSMTPD mail server, which can allow attackers to execute arbitrary shell commands on the underlying system as root.
“We developed a simple proof of concept and successfully tested it against OpenBSD 6.6 (the current release) and Debian testing (Bullseye); other versions and distributions may be exploitable,” they noted in the accompanying security advisory.
What is OpenSMTPD?
OpenSMTPD is an open source implementation of the Simple Mail Transfer Protocol. It is developed as part of the OpenBSD project.
Its portable version can run on many other operating systems, such as FreeBSD, NetBSD, DragonFlyBSD, Mac OS X, and various Linux distributions. OpenSMTPD has also been incorporated in some of them.
About CVE-2020-7247
CVE-2020-7247 has been found in OpenSMTPD’s smtp_mailaddr() function, which is responsible for validating sender and recipient mail addresses.
The vulnerability can be exploited by sending to a vulnerable server a specially crafted SMTP message.
Qualys researchers were able to overcome certain exploitation limitations by using a technique from the Morris Worm, one of the first computer worms distributed via the Internet, to make sure the body of the email they sent is executed as a shell script.
“This vulnerability is exploitable since May 2018 and allows an attacker to execute arbitrary shell commands as root: either locally, in OpenSMTPD’s default configuration (which listens on the loopback interface and only accepts mail from localhost); or locally and remotely, in OpenSMTPD’s ‘uncommented’ default configuration (which listens on all interfaces and accepts external mail),” the researchers explained.
Patch available
The flaw has been responsibly disclosed to OpenSMTPD developers, who have released a patch for OpenBSD. A portable versions of the implementation (OpenSMTPD 6.6.2p1) has also been made available.
They did not say which versions of OpenSMTPD are affected, but promised to provide more details about the flaw “when things settle down”.
Hopefully the fix will be propagated into affected OS distributions soon, as the bug is being already debated online and Qualys’s advisory is pretty on point.
UPDATE (February 4, 2020, 1:10 a.m. PT):
More information about which OS distributions are affected, which are not, and links to patches are available here.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2020/01/29/cve-2020-7247/