7 ms·

Exim – remote attacker can execute programs with root privileges

142 points by eternalny1 7y ago

mkl 7y ago
From https://en.wikipedia.org/wiki/Exim https://en.wikipedia.org/wiki/Exim: Exim is a mail transfer agent (MTA) used on Unix-like operating systems. [...] In August 2019 [...] approximately 57% of the publicly reachable mail-servers on the Internet ran Exim. Yikes. edit: This might be a better summary of the vulnerability: https://www.tenable.com/blog/cve-2019-15846-unauthenticated-remote-command-execution-flaw-disclosed-for-exim https://www.tenable.com/blog/cve-2019-15846-unauthenticated-...
- techdevangelist 7y ago
  cPanel I believe still utilizes Exim which I suspect drives that number up.
  - syntheticnature 7y ago
    That is indeed correct.
  - ttul 7y ago
    This is the entire web hosting industry. The attack surface is massive and the industry has been so squeezed of costs that patching stuff will take a long time. This exploit will be alive for a long long time.
    - ianhawes 7y ago
      To its credit, cPanel updates nightly and the developers will push security patches out within hours. I don’t have a box to check but I would imagine a cPanel patch is already live.
saagarjha 7y ago
> Details: doc/doc-txt/cve-2019-15846 in the downloaded source tree I can’t find this file in the Git repository. Does anyone know where it is?
- bscphil 7y ago
  It's in doc/cve-2019-15846 in the latest release tarballs. https://ftp.exim.org/pub/exim/exim4/ https://ftp.exim.org/pub/exim/exim4/
- justicz 7y ago
  It's not on master: https://github.com/Exim/exim/tree/exim-4.92.2%2Bfixes/doc/doc-txt/cve-2019-15846 https://github.com/Exim/exim/tree/exim-4.92.2%2Bfixes/doc/do...
  - saagarjha 7y ago
    Thanks.
kazinator 7y ago
> Do not offer TLS for incomming connections (tls_advertise_hosts). This mitigation is not* recommended!* No kidding? Turning off TLS isn't an option at many installations. It's gotta work.
pontifier 7y ago
This kind of thing (among others) is why I've lost all faith in cryptocurrencies.
- larkeith 7y ago
  Exim is a mail transfer agent.
- kfrzcode 7y ago
  Well that's like saying the USPS is unreliable, so therefore banks are not to be trusted
  - beatgammit 7y ago
    Well, if Bernie Sanders gets his way, that could be somewhat reasonable.
  - pontifier 7y ago
    Heartbleed was the start of my fatalistic view of computer security. I just don't trust data to be secure AND persistent. Would any of the people downvoting me stake their life on keeping a short string of characters secure on a connected computer forever?
    - inimino 7y ago
      I wouldn't stake my life on any bank, either.
fulafel 7y ago
There have been many Exim bugs like this, why are people still running it? It's like the modern day sendmail. https://www.cvedetails.com/vendor/10919/Exim.html https://www.cvedetails.com/vendor/10919/Exim.html 12 RCE CVE entries since the CVE system started.
- cheez 7y ago
  What should people be using instead?
  - _delirium 7y ago
    I use Postfix, which I believe has a pretty good (though not spotless) security track record. The most recent CVE for it seems to have been in 2017, and that was local privilege escalation.
  - Nux 7y ago
    Notqmail ;)
  - rurban 7y ago
    People usually don't choose it. It's the usual hosting providers mail service of choice, because it's so easy to configure for thousands of domains and users. Not just cPanel, almost everybody.
  - fock 7y ago
    opensmptd (which seems a) to have a simple config and b) is a new implementation). Though you then still need Dovecot or co. for mailboxes (unless you prefer SSH for that). Disclaimer: just reading about opensmtp, I'm using postfix
    - tannhaeuser 7y ago
      Dovecot is an IMAP server while exim, sendmail, postfix, and opensmtp (I guess) are SMTP servers (aka MTAs). An SMTP server is for sending/forwarding mails to or through, and IMAP (or POP3 or new-fangled jmap, supposedly) is what your mail program uses to browse your received mails and mailboxes etc.
deleted 7y ago
[deleted]
beautifulfreak 7y ago
As stated in the initial bug report by Zerons, an unauthenticated remote attacker could send a malicious SNI ending in a backslash-null sequence during the initial TLS handshake, which causes a buffer overflow in the SMTP delivery process. This would allow an attacker to inject malicious code that Exim then arbitrarily executes as root. This vulnerability does not depend on the TLS library in use, so both GnuTLS and OpenSSL are affected. https://www.tenable.com/blog/cve-2019-15846-unauthenticated-remote-command-execution-flaw-disclosed-for-exim https://www.tenable.com/blog/cve-2019-15846-unauthenticated-...
- nineteen999 7y ago
  Why is exim running as root at that point? At least that is the question in my mind. Once it has bound to the port it should setuid() or seteuid() to a less privileged UID, unless I'm mistaken. Granted, there will still be the possibility of remote code execution as a non-root user, but at least you're not handing an attacker root privileges by default.
  - tryauuum 7y ago
    Exim can do a lot of things, including delivery of mail to users' directories. Root privileges are required to access those directories. Oh, also ".forward" files in users' home directories. I guess this is why Ubuntu ships exim binary with setuid bit on it
    - nineteen999 7y ago
      Ugh, the deliver program should be a seperate process then with some sort of privilege seperation scheme perhaps. Postfix also handles .forward files from memory, I wonder how it does it. Maybe the Exim people don't feel like its worthwhile to rearchitect it, given that there are MTA's with more secure designs/implementations out there already.
      - avian 7y ago
        Maybe Exim people are smarter than you give them credit for. Exim does use separate processes and privilege separation. SMTP daemon itself does not run as root (on default Debian it runs as "Debian-exim" user). Some processes do need to run as root for local delivery, as others have mentioned. How exactly this exploit works around that I don't know. PoC isn't public. Bugs happen, even with secure designs.
eternalny1 7y ago
"The mail server survey published on September 1 by E-Soft Inc, a company specializing in web server surveys, says that Exim is currently the most used MX server with 57.13% out of a total of 1,740,809 mail servers, representing 507,200 Exim servers being visible on the internet and accepting connections."
pjmlp 7y ago
Yet another buffer overflow CVE....
lelf 7y ago
C at its finest https://github.com/Exim/exim/commit/cdc7f9a9667ecf31d803fc8d1a31b466284360bd https://github.com/Exim/exim/commit/cdc7f9a9667ecf31d803fc8d...
- Avamander 7y ago
  I have to say that I've gotten code sent to me over Facebook Messenger that looks better-formatted than that thing.
- zx2c4 7y ago
  That commit is just a fixup of the prior which the author probably intended to rebase and squash together. The actual commit for this vuln is here: https://github.com/Exim/exim/commit/2600301ba6dbac5c9d640c87007a07ee6dcea1f4#diff-2df79c106af94fb3d05bc3f75d7f2abb https://github.com/Exim/exim/commit/2600301ba6dbac5c9d640c87...
- userbinator 7y ago
  *(++p) --- what did you think it would do without the parentheses...? isdigit(ch) && ch != '8' && ch != '9' --- why not the simpler ch >= '0' && ch <= '7' ? That code reminds me of FizzBuzz and the huge gap in competence it demonstrates, i.e. a surprisingly large number of "programmers" fail to write correct solutions to the simplest of problems. Perhaps "unescape a string" needs to be an interview question with as much attention as FizzBuzz, both because it has a practical application and can show a lot about someone's skill. Admittedly, I may be biased because I have done a lot of parsing and other compiler-ish work, but parsing text is really not an uncommon thing to do in a lot of applications.
  - deleted 7y ago
    [deleted]
- deleted 7y ago
  [deleted]
- camgunz 7y ago
  Yeah, pointer arithmetic with raw string handling is usually bad news bears. I wonder if it's possible to write a bot that grabs every "string.c" or "str.c" (etc.) from GitHub and looks for this stuff.
lelf 7y ago
Some mitigations mentioned in https://lists.exim.org/lurker/message/20190906.185037.1ff8bb42.en.html https://lists.exim.org/lurker/message/20190906.185037.1ff8bb...: > Add - as part of the mail ACL (the ACL referenced by the main config option "acl_smtp_mail"): deny condition = ${if eq{\\}{${substr{-1}{1}{$tls_in_sni}}}} deny condition = ${if eq{\\}{${substr{-1}{1}{$tls_in_peerdn}}}}
orf 7y ago
The fix: https://github.com/Exim/exim/commit/2600301ba6dbac5c9d640c87007a07ee6dcea1f4#diff-2df79c106af94fb3d05bc3f75d7f2abb https://github.com/Exim/exim/commit/2600301ba6dbac5c9d640c87...
mmcgaha 7y ago
When I read about email being too hard, I hear about configuration headaches, deliverability, and spam, but the real reason that I outsource email is because of security. The horrible history of MTA security drives me into a very conservative mail strategy. Short of DJB devoting his life to qmail, I don't know if this problem can be solved.
florz 7y ago
Just in case any Exim users are reading here, you might want to be aware that Exim also does not check TLS certificates reliably, so any authentication credentials (as well as message contents, of course) that you might be transmitting via TLS to a remote server, using Exim as the client, can be intercepted by a MitM if the remote host is specified as a DNS name: https://lists.exim.org/lurker/message/20181228.202226.22d1c497.en.html https://lists.exim.org/lurker/message/20181228.202226.22d1c4... I just tested version 4.92, which is still affected, and it doesn't seem like there is any interest in fixing this vulnerability.
- yborg 7y ago
  The release announcement itself directly states not to use TLS as a mitigation.

142 points by eternalny1 7y ago

mkl 7y ago

From https://en.wikipedia.org/wiki/Exim https://en.wikipedia.org/wiki/Exim: Exim is a mail transfer agent (MTA) used on Unix-like operating systems. [...] In August 2019 [...] approximately 57% of the publicly reachable mail-servers on the Internet ran Exim. Yikes. edit: This might be a better summary of the vulnerability: https://www.tenable.com/blog/cve-2019-15846-unauthenticated-remote-command-execution-flaw-disclosed-for-exim https://www.tenable.com/blog/cve-2019-15846-unauthenticated-...

techdevangelist 7y ago
cPanel I believe still utilizes Exim which I suspect drives that number up.
- syntheticnature 7y ago
  That is indeed correct.
- ttul 7y ago
  This is the entire web hosting industry. The attack surface is massive and the industry has been so squeezed of costs that patching stuff will take a long time. This exploit will be alive for a long long time.
  - ianhawes 7y ago
    To its credit, cPanel updates nightly and the developers will push security patches out within hours. I don’t have a box to check but I would imagine a cPanel patch is already live.

saagarjha 7y ago

> Details: doc/doc-txt/cve-2019-15846 in the downloaded source tree I can’t find this file in the Git repository. Does anyone know where it is?

bscphil 7y ago
It's in doc/cve-2019-15846 in the latest release tarballs. https://ftp.exim.org/pub/exim/exim4/ https://ftp.exim.org/pub/exim/exim4/
justicz 7y ago
It's not on master: https://github.com/Exim/exim/tree/exim-4.92.2%2Bfixes/doc/doc-txt/cve-2019-15846 https://github.com/Exim/exim/tree/exim-4.92.2%2Bfixes/doc/do...
- saagarjha 7y ago
  Thanks.

kazinator 7y ago

> Do not offer TLS for incomming connections (tls_advertise_hosts). This mitigation is not* recommended!* No kidding? Turning off TLS isn't an option at many installations. It's gotta work.

pontifier 7y ago

This kind of thing (among others) is why I've lost all faith in cryptocurrencies.

larkeith 7y ago
Exim is a mail transfer agent.
kfrzcode 7y ago
Well that's like saying the USPS is unreliable, so therefore banks are not to be trusted
- beatgammit 7y ago
  Well, if Bernie Sanders gets his way, that could be somewhat reasonable.
- pontifier 7y ago
  Heartbleed was the start of my fatalistic view of computer security. I just don't trust data to be secure AND persistent. Would any of the people downvoting me stake their life on keeping a short string of characters secure on a connected computer forever?
  - inimino 7y ago
    I wouldn't stake my life on any bank, either.

fulafel 7y ago

There have been many Exim bugs like this, why are people still running it? It's like the modern day sendmail. https://www.cvedetails.com/vendor/10919/Exim.html https://www.cvedetails.com/vendor/10919/Exim.html 12 RCE CVE entries since the CVE system started.

cheez 7y ago
What should people be using instead?
- _delirium 7y ago
  I use Postfix, which I believe has a pretty good (though not spotless) security track record. The most recent CVE for it seems to have been in 2017, and that was local privilege escalation.
- Nux 7y ago
  Notqmail ;)
- rurban 7y ago
  People usually don't choose it. It's the usual hosting providers mail service of choice, because it's so easy to configure for thousands of domains and users. Not just cPanel, almost everybody.
- fock 7y ago
  opensmptd (which seems a) to have a simple config and b) is a new implementation). Though you then still need Dovecot or co. for mailboxes (unless you prefer SSH for that). Disclaimer: just reading about opensmtp, I'm using postfix
  - tannhaeuser 7y ago
    Dovecot is an IMAP server while exim, sendmail, postfix, and opensmtp (I guess) are SMTP servers (aka MTAs). An SMTP server is for sending/forwarding mails to or through, and IMAP (or POP3 or new-fangled jmap, supposedly) is what your mail program uses to browse your received mails and mailboxes etc.

deleted 7y ago

[deleted]

beautifulfreak 7y ago

As stated in the initial bug report by Zerons, an unauthenticated remote attacker could send a malicious SNI ending in a backslash-null sequence during the initial TLS handshake, which causes a buffer overflow in the SMTP delivery process. This would allow an attacker to inject malicious code that Exim then arbitrarily executes as root. This vulnerability does not depend on the TLS library in use, so both GnuTLS and OpenSSL are affected. https://www.tenable.com/blog/cve-2019-15846-unauthenticated-remote-command-execution-flaw-disclosed-for-exim https://www.tenable.com/blog/cve-2019-15846-unauthenticated-...

nineteen999 7y ago
Why is exim running as root at that point? At least that is the question in my mind. Once it has bound to the port it should setuid() or seteuid() to a less privileged UID, unless I'm mistaken. Granted, there will still be the possibility of remote code execution as a non-root user, but at least you're not handing an attacker root privileges by default.
- tryauuum 7y ago
  Exim can do a lot of things, including delivery of mail to users' directories. Root privileges are required to access those directories. Oh, also ".forward" files in users' home directories. I guess this is why Ubuntu ships exim binary with setuid bit on it
  - nineteen999 7y ago
    Ugh, the deliver program should be a seperate process then with some sort of privilege seperation scheme perhaps. Postfix also handles .forward files from memory, I wonder how it does it. Maybe the Exim people don't feel like its worthwhile to rearchitect it, given that there are MTA's with more secure designs/implementations out there already.
    - avian 7y ago
      Maybe Exim people are smarter than you give them credit for. Exim does use separate processes and privilege separation. SMTP daemon itself does not run as root (on default Debian it runs as "Debian-exim" user). Some processes do need to run as root for local delivery, as others have mentioned. How exactly this exploit works around that I don't know. PoC isn't public. Bugs happen, even with secure designs.

eternalny1 7y ago

"The mail server survey published on September 1 by E-Soft Inc, a company specializing in web server surveys, says that Exim is currently the most used MX server with 57.13% out of a total of 1,740,809 mail servers, representing 507,200 Exim servers being visible on the internet and accepting connections."

pjmlp 7y ago

Yet another buffer overflow CVE....

lelf 7y ago

C at its finest https://github.com/Exim/exim/commit/cdc7f9a9667ecf31d803fc8d1a31b466284360bd https://github.com/Exim/exim/commit/cdc7f9a9667ecf31d803fc8d...

Avamander 7y ago
I have to say that I've gotten code sent to me over Facebook Messenger that looks better-formatted than that thing.
zx2c4 7y ago
That commit is just a fixup of the prior which the author probably intended to rebase and squash together. The actual commit for this vuln is here: https://github.com/Exim/exim/commit/2600301ba6dbac5c9d640c87007a07ee6dcea1f4#diff-2df79c106af94fb3d05bc3f75d7f2abb https://github.com/Exim/exim/commit/2600301ba6dbac5c9d640c87...
userbinator 7y ago
*(++p) --- what did you think it would do without the parentheses...? isdigit(ch) && ch != '8' && ch != '9' --- why not the simpler ch >= '0' && ch <= '7' ? That code reminds me of FizzBuzz and the huge gap in competence it demonstrates, i.e. a surprisingly large number of "programmers" fail to write correct solutions to the simplest of problems. Perhaps "unescape a string" needs to be an interview question with as much attention as FizzBuzz, both because it has a practical application and can show a lot about someone's skill. Admittedly, I may be biased because I have done a lot of parsing and other compiler-ish work, but parsing text is really not an uncommon thing to do in a lot of applications.
- deleted 7y ago
  [deleted]
deleted 7y ago
[deleted]
camgunz 7y ago
Yeah, pointer arithmetic with raw string handling is usually bad news bears. I wonder if it's possible to write a bot that grabs every "string.c" or "str.c" (etc.) from GitHub and looks for this stuff.

lelf 7y ago

Some mitigations mentioned in https://lists.exim.org/lurker/message/20190906.185037.1ff8bb42.en.html https://lists.exim.org/lurker/message/20190906.185037.1ff8bb...: > Add - as part of the mail ACL (the ACL referenced by the main config option "acl_smtp_mail"): deny condition = ${if eq{\\}{${substr{-1}{1}{$tls_in_sni}}}} deny condition = ${if eq{\\}{${substr{-1}{1}{$tls_in_peerdn}}}}

orf 7y ago

The fix: https://github.com/Exim/exim/commit/2600301ba6dbac5c9d640c87007a07ee6dcea1f4#diff-2df79c106af94fb3d05bc3f75d7f2abb https://github.com/Exim/exim/commit/2600301ba6dbac5c9d640c87...

mmcgaha 7y ago

When I read about email being too hard, I hear about configuration headaches, deliverability, and spam, but the real reason that I outsource email is because of security. The horrible history of MTA security drives me into a very conservative mail strategy. Short of DJB devoting his life to qmail, I don't know if this problem can be solved.

florz 7y ago

Just in case any Exim users are reading here, you might want to be aware that Exim also does not check TLS certificates reliably, so any authentication credentials (as well as message contents, of course) that you might be transmitting via TLS to a remote server, using Exim as the client, can be intercepted by a MitM if the remote host is specified as a DNS name: https://lists.exim.org/lurker/message/20181228.202226.22d1c497.en.html https://lists.exim.org/lurker/message/20181228.202226.22d1c4... I just tested version 4.92, which is still affected, and it doesn't seem like there is any interest in fixing this vulnerability.

yborg 7y ago
The release announcement itself directly states not to use TLS as a mitigation.