Exim CVE-2020-28018 漏洞分析

FROM ubuntu:18.04
RUN sed -i "s/archive.ubuntu.com/mirrors.ustc.edu.cn/g" /etc/apt/sources.listRUN sed -i "s/security.ubuntu.com/mirrors.ustc.edu.cn/g" /etc/apt/sources.listRUN apt update
RUN mkdir /root/exim4
COPY *.deb /root/exim4/COPY *.ddeb /root/exim4/
RUN dpkg -i /root/exim4/*.deb || apt --fix-broken install -yRUN dpkg -i /root/exim4/*.deb && dpkg -i /root/exim4/*.ddeb
RUN sed -i "s/127.0.0.1 ; ::1/0.0.0.0/g" /etc/exim4/update-exim4.conf.confRUN sed -i "1i\MAIN_TLS_ENABLE = yes" /etc/exim4/exim4.conf.templateCOPY exim.crt /etc/exim4/exim.crtCOPY exim.key /etc/exim4/exim.keyCOPY exim_start /exim_startRUN update-exim4.conf && chmod +x /exim_start
CMD ["/exim_start"]

#!/bin/sh -e
if [ -n "$EX4DEBUG" ]; then  echo "now debugging $0 $@"  set -xfi




    

DIR=/etc/exim4CERT=$DIR/exim.crtKEY=$DIR/exim.key
# This exim binary was built with GnuTLS which does not support dhparams# from a file. See /usr/share/doc/exim4-base/README.Debian.gz#DH=$DIR/exim.dhparam
if ! which openssl > /dev/null ;then    echo "$0: openssl is not installed, exiting" 1>&2    exit 1fi
# valid for three yearsDAYS=1095
if [ "$1" != "--force" ] && [ -f $CERT ] && [ -f $KEY ]; then  echo "[*] $CERT and $KEY exists!"  echo "    Use \"$0 --force\" to force generation!"  exit 0fi
if [ "$1" = "--force" ]; then  shiftfi     
#SSLEAY=/tmp/exim.ssleay.$$.cnfSSLEAY="$(tempfile -m600 -pexi)"
cat > $SSLEAY <RANDFILE = $HOME/.rnd[ req ]default_bits = 1024default_keyfile = exim.keydistinguished_name = req_distinguished_name[ req_distinguished_name ]countryName = Country Code (2 letters)countryName_default = UScountryName_min = 2countryName_max = 2stateOrProvinceName = State or Province Name (full name)localityName = Locality Name (eg, city)organizationName = Organization Name (eg, company; recommended)organizationName_max = 64organizationalUnitName = Organizational Unit Name (eg, section)organizationalUnitName_max = 64commonName = Server name (eg. ssl.domain.tld; required!!!)commonName_max = 64emailAddress = Email AddressemailAddress_max = 40EOM
echo "[*] Creating a self signed SSL certificate for Exim!"echo "    This may be sufficient to establish encrypted connections but for"echo "    secure identification you need to buy a real certificate!"echo "    "echo "    Please enter the hostname of your MTA at the Common Name (CN) prompt!"echo "    "
openssl req -config $SSLEAY -x509 -newkey rsa:1024 -keyout $KEY -out $CERT -days $DAYS -nodes#see README.Debian.gz*# openssl dhparam -check -text -5 512 -out $DHrm -f $SSLEAY
chown root:Debian-exim $KEY $CERT $DHchmod 640 $KEY $CERT $DH
echo "[*] Done generating self signed certificates for exim!"echo "    Refer to the documentation and example configuration files"echo "    over at /usr/share/doc/exim4-base/ for an idea on how to enable TLS"echo "    support in your mail transfer agent."

#!/bin/bash
/etc/init.d/exim4 start




    
/bin/bash

#!/bin/bashwget https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/exim4/4.90.1-1ubuntu1.5/exim4_4.90.1.orig.tar.xzwget https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/exim4/4.90.1-1ubuntu1.5/exim4_4.90.1-1ubuntu1.5.debian.tar.xzwget https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/exim4/4.90.1-1ubuntu1.5/exim4_4.90.1-1ubuntu1.5.dscdpkg-source --no-check -x exim4_4.90.1-1ubuntu1.5.dsc# /etc/apt/source.list 里面记得加上deb-srcapt-get build-dep exim4apt-get install --no-install-recommends devscripts cd exim4-4.90.1perl -i -pe 's/^\s*#\s*OPENSSL\s*:=\s*1/OPENSSL:=1/' debian/rulesdch -l +openssl 'rebuild with openssl'debian/rules binary

inttls_write(BOOL is_server, const uschar *buff, size_t len, BOOL more){int outbytes, error, left;SSL *ssl = is_server ? server_ssl : client_ssl;static gstring * corked = NULL;
DEBUG(D_tls) debug_printf("%s(%p, %lu%s)\n", __FUNCTION__,  buff, (unsigned long)len, more ? ", more" : "");
/* Lacking a CORK or MSG_MORE facility (such as GnuTLS has) we copy data when"more" is notified.  This hack is only ok if small amounts are involved AND onlyone stream does it, in one context (i.e. no store reset).  Currently it is usedfor the responses to the received SMTP MAIL , RCPT, DATA sequence, only. */
if (is_server && (more || corked))  {  corked = string_catn(corked, buff, len);  if (more)    return len;  buff = CUS corked->s;  len = corked->ptr;  corked = NULL;  }...}

intsmtp_setup_msg(void){......# MAIL FROM




    
    if (rc == OK || rc == DISCARD)      {      BOOL more = pipeline_response();
      if (!user_msg)        smtp_printf("%s%s%s", more, US"250 OK",                  #ifndef DISABLE_PRDR                    prdr_requested ? US", PRDR Requested" : US"",                      #else                    US"",                  #endif                    US"\r\n");      else        {      #ifndef DISABLE_PRDR        if (prdr_requested)           user_msg = string_sprintf("%s%s", user_msg, US", PRDR Requested");      #endif        smtp_user_msg(US"250", user_msg);        }......# RCPT TO    if (rc == OK)      {      BOOL more = pipeline_response();
      if (user_msg)        smtp_user_msg(US"250", user_msg);      else        smtp_printf("250 Accepted\r\n", more);      receive_add_recipient(recipient, -1);......

#define STRING_SPRINTF_BUFFER_SIZE (8192 * 4)
# exim 4.90uschar *string_sprintf(const char *format, ...){va_list ap;uschar buffer[STRING_SPRINTF_BUFFER_SIZE];va_start(ap, format);if (!string_vformat(buffer, sizeof(buffer), format, ap))  log_write(0, LOG_MAIN|LOG_PANIC_DIE,    "string_sprintf expansion was longer than " SIZE_T_FMT    "; format string was (%s)\nexpansion started '%.32s'",    sizeof(buffer), format, buffer);va_end(ap);return string_copy(buffer);}
uschar *string_copy(const uschar *s){int len = Ustrlen(s) + 1;uschar *ss = store_get(len);memcpy(ss, s, len);return ss;}
# exim 4.92
uschar *string_sprintf(const char *format, ...){#ifdef COMPILE_UTILITY




    
uschar buffer[STRING_SPRINTF_BUFFER_SIZE];gstring g = { .size = STRING_SPRINTF_BUFFER_SIZE, .ptr = 0, .s = buffer };gstring * gp = &g;#elsegstring * gp = string_get(STRING_SPRINTF_BUFFER_SIZE);#endifgstring * gp2;va_list ap;
va_start(ap, format);gp2 = string_vformat(gp, FALSE, format, ap);gp->s[gp->ptr] = '\0';va_end(ap);
if (!gp2)  log_write(0, LOG_MAIN|LOG_PANIC_DIE,    "string_sprintf expansion was longer than %d; format string was (%s)\n"    "expansion started '%.32s'",    gp->size, format, gp->s);
#ifdef COMPILE_UTILITYreturn string_copy(gp->s);#elsegstring_reset_unused(gp);return gp->s;#endif}

def _verify(self):        result = {}        self.normalize_url()        # To establish socket        socket.setdefaulttimeout(5)        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)        sock.connect((self.ip, self.port))        # To establish ssl        context = ssl._create_unverified_context()        # check server        header = sock.recv(1024)        while True:            if b"ESMTP Exim 4.9" not in header:                break            sock.send(b"EHLO hh\r\n")            data = sock.recv(1024)            if b"250-STARTTLS\r\n" not in data or b"250-PIPELINING" not in data:                break            sock.send(b"STARTTLS\r\n")            data = sock.recv(1024)            if b"220 TLS go ahead" not in data:                break            tls_s = context.wrap_socket(sock, server_hostname=self.ip)            # TLS mode            tls_s.send(b"EHLO hh\r\n")            data = tls_s.recv(1024)            if b"HELP\r\n" not in data: