4 ms·

I tested this exploit against an unpatched OpenBSD 6.6 machine and it works with the default mbox delivery, but not with maildir delivery (as hinted by the sysp

by Panino 7y ago

I tested this exploit against an unpatched OpenBSD 6.6 machine and it works with the default mbox delivery, but not with maildir delivery (as hinted by the syspatch message). So if you use maildir delivery like me, you weren't exposed to this security hole. This is the sound of the world's quietest sigh of relief. I have some questions: Is Qualys getting paid for this excellent work, and if so, by who? Is there a plan to do a serious audit of execle related code in OpenBSD? As a longtime OpenBSD user, I gotta say that OpenSMTPD is the part of the system I'm least comfortable with from a security standpoint. Too many rewrites, mulligans, CVEs. Very little of the web howtos match the official documentation because there's so much churn, which by itself is a red flag. And even without a logic bug, I'm surprised execle was used at all here. It was unnecessary and naive. I'll be honest, I'm in the middle of transitioning from qmail to OpenSMTPD, and this bug is making me consider notqmail. This RCE is trivial and super bad.

cnst 7y ago
That's for pointing this out. It is pretty ridiculous just how trivial and severe this is, indeed. However, given the lower prevalence of OpenBSD, I'd be interested to know whether anyone has any data on whether this is being exploited in the wild.
- boring_twenties 7y ago
  No data, but it only listens on localhost by default.
  - cnst 7y ago
    Do you think anyone who changes the default also changes the delivery to Maildir? (So, at a minimum, it's a local user privilege escalation, of any user to root, in the default install?)
landr0id 7y ago
>Is Qualys getting paid for this excellent work, and if so, by who? I can't say I have any info on this subject, but having a group of people do stellar newsworthy offensive security research around widely used products is a good way to market your company for free and help drive sales for your security products.
- justinclift 7y ago
  > for free It's only free from external cost though. The time for the staff at Qualys is (probably) not free. ;)
  - jacobush 7y ago
    Also just in - they eat and breathe. :) And the heat-death of the Universe is closer this Monday.
jmclnx 7y ago
> Is Qualys getting paid for this excellent > work, and if so, by who? See: https://en.wikipedia.org/wiki/Qualys https://en.wikipedia.org/wiki/Qualys My guess is they use OpenBSD and this is part of 'give back'.

by Panino 7y ago

cnst 7y ago

That's for pointing this out. It is pretty ridiculous just how trivial and severe this is, indeed. However, given the lower prevalence of OpenBSD, I'd be interested to know whether anyone has any data on whether this is being exploited in the wild.

boring_twenties 7y ago
No data, but it only listens on localhost by default.
- cnst 7y ago
  Do you think anyone who changes the default also changes the delivery to Maildir? (So, at a minimum, it's a local user privilege escalation, of any user to root, in the default install?)

landr0id 7y ago

>Is Qualys getting paid for this excellent work, and if so, by who? I can't say I have any info on this subject, but having a group of people do stellar newsworthy offensive security research around widely used products is a good way to market your company for free and help drive sales for your security products.

justinclift 7y ago
> for free It's only free from external cost though. The time for the staff at Qualys is (probably) not free. ;)
- jacobush 7y ago
  Also just in - they eat and breathe. :) And the heat-death of the Universe is closer this Monday.

jmclnx 7y ago

> Is Qualys getting paid for this excellent > work, and if so, by who? See: https://en.wikipedia.org/wiki/Qualys https://en.wikipedia.org/wiki/Qualys My guess is they use OpenBSD and this is part of 'give back'.