Security researchers have discovered a new critical vulnerability in the OpenSMTPD email server. An attacker could exploit it remotely to run shell commands as root on the underlying operating system.
OpenSMTPD is present on many Unix-based systems, including FreeBSD, NetBSD, macOS, Linux (Alpine, Arch, Debian, Fedora, CentOS).
Bug present since late 2015
Tracked as CVE-2020-8794, the remote code execution bug is present in OpenSMTPD’s default installation. Proof-of-concept (PoC) exploit code has been created and will be released on February 26.
Researchers at Qualys published a technical report, noting that the issue is an out-of-bounds read introduced in December 2015 with commit 80c6a60c.
They explain that leveraging it for code execution with root privileges is possible only on OpenSMTPD versions released after May 2018, commit a8e22235. On previous releases, shell commands can run as non-root.
PoC ready, to be released
There are two exploitation scenarios possible. On the client-side, the glitch can be exploited remotely if OpenSMTPD with a default configuration. By default, the installation accepts messages from local users and delivers them to remote servers.
“If such a remote server is controlled by an attacker” (either because it is malicious or compromised, or because of a man-in-the-middle, DNS, or BGP attack — SMTP is not TLS-encrypted by default), then the attacker can execute arbitrary shell commands on the vulnerable OpenSMTPD installation” – Qualys
Server-side exploitation is possible when the attacker connects to the OpenSMTPD server and sends an email that creates a bounce.
When OpenSMTPD connects back to deliver the bounce, the attacker can take advantage of the client-side vulnerability.
“Last, for their shell commands to be executed, the attacker must (to the best of our knowledge) crash OpenSMTPD and wait until it is restarted (either manually by an administrator, or automatically by a system update or reboot)” – Qualys
The PoC created by Qualys has been tested successfully on the current OpenBSD 6.6, OpenBSD 5.9, Debian 10, Debian 11 and Fedora 31. Given that it will become public tomorrow, system administrators are urged to apply the latest patches.
The fix is delivered in OpenSMTPD 6.6.4p1, available here, which the //www.mail-archive.com/
On OpenBSD, binary patches are available by running the ‘syspatch’ command and confirming that OpenSMTPD restarted:
$ doas syspatch