CERTFR-2019-ALE-009
Vulnerability from certfr_alerte
Le CERT-FR a connaissance de cas d'exploitation de la vulnérabilité CVE-2019-10149 qui affecte Exim et permet une exécution de commande arbitraire à distance.
Cette vulnérabilité est triviale à exploiter, d'autant plus que du code d'attaque est disponible publiquement sur internet.
Le CERT-FR recommande donc fortement l'application du correctif sorti le 05 juin 2019, et ce dans les plus brefs délais.
La commande suivante peut servir à détecter des tentatives d'exploitation en cherchant dans les journaux d'activités. Elle a été testée sur un système Debian avec une configuration par défaut.
[pastacode lang="bash" manual="grep%20'%24%7Brun'%20%2Fvar%2Flog%2Fexim4%2Fmainlog" message="" highlight="" provider="manual"/]
Exemples de sortie:
[pastacode lang="bash" manual="2019-06-11%2014%3A01%3A29%201hal5N-0001Hx-3T%20**%20%24%7Brun%3C%5BCOMMANDE%20EXECUTEE%5D%3E%7D%40localhost%3A%20Too%20many%20%22Received%22%20headers%20-%20suspected%20mail%20loop%0A2019-06-11%2014%3A02%3A14%201hal66-0001I7-MN%20**%20%24%7Brun%3C%5BCOMMANDE%20EXECUTEE%5D%3E%7D%40localhost%3A%20Too%20many%20%22Received%22%20headers%20-%20suspected%20mail%20loop%0A2019-06-11%2014%3A03%3A11%201hal70-0001IH-VN%20**%20%24%7Brun%3C%5BCOMMANDE%20EXECUTEE%5D%3E%7D%40localhost%3A%20Too%20many%20%22Received%22%20headers%20-%20suspected%20mail%20loop%0A2019-06-11%2014%3A07%3A44%201halBQ-0001Ij-2D%20**%20%24%7Brun%3C%5BCOMMANDE%20EXECUTEE%5D%3E%7D%40localhost%3A%20Too%20many%20%22Received%22%20headers%20-%20suspected%20mail%20loop" message="" highlight="" provider="manual"/]
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
None| Title | Publication Time | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Exim versions ant\u00e9rieures \u00e0 4.92",
"product": {
"name": "N/A",
"vendor": {
"name": "Exim",
"scada": false
}
}
}
],
"affected_systems_content": null,
"closed_at": "2019-07-23",
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2019-10149",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-10149"
}
],
"initial_release_date": "2019-06-11T00:00:00",
"last_revision_date": "2019-07-23T00:00:00",
"links": [
{
"title": "Avis CERT-FR CERTFR-2019-AVI-252 du 06 juin 2019",
"url": "https://cert.ssi.gouv.fr/avis/CERTFR-2019-AVI-252/"
}
],
"reference": "CERTFR-2019-ALE-009",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2019-06-11T00:00:00.000000"
},
{
"description": "Ajout de la commande de recherche dans les journaux.",
"revision_date": "2019-06-12T00:00:00.000000"
},
{
"description": "Cl\u00f4ture de l\u0027alerte.",
"revision_date": "2019-07-23T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de commande arbitraire \u00e0 distance"
}
],
"summary": "Le CERT-FR a connaissance de cas d\u0027exploitation de la\nvuln\u00e9rabilit\u00e9\u00a0CVE-2019-10149 qui affecte Exim et permet une ex\u00e9cution de\ncommande arbitraire \u00e0 distance.\n\nCette vuln\u00e9rabilit\u00e9 est triviale \u00e0 exploiter, d\u0027autant plus que du code\nd\u0027attaque est disponible publiquement sur internet.\n\nLe CERT-FR recommande donc fortement l\u0027application du correctif sorti le\n05 juin 2019, et ce dans les plus brefs d\u00e9lais.\n\nLa commande suivante peut servir \u00e0 d\u00e9tecter des tentatives\nd\u0027exploitation en cherchant dans les journaux d\u0027activit\u00e9s. Elle a \u00e9t\u00e9\ntest\u00e9e sur un syst\u00e8me Debian avec une configuration par d\u00e9faut.\n\n\\[pastacode lang=\"bash\"\nmanual=\"grep%20\u0027%24%7Brun\u0027%20%2Fvar%2Flog%2Fexim4%2Fmainlog\" message=\"\"\nhighlight=\"\" provider=\"manual\"/\\]\n\nExemples de sortie:\n\n\\[pastacode lang=\"bash\"\nmanual=\"2019-06-11%2014%3A01%3A29%201hal5N-0001Hx-3T%20\\*\\*%20%24%7Brun%3C%5BCOMMANDE%20EXECUTEE%5D%3E%7D%40localhost%3A%20Too%20many%20%22Received%22%20headers%20-%20suspected%20mail%20loop%0A2019-06-11%2014%3A02%3A14%201hal66-0001I7-MN%20\\*\\*%20%24%7Brun%3C%5BCOMMANDE%20EXECUTEE%5D%3E%7D%40localhost%3A%20Too%20many%20%22Received%22%20headers%20-%20suspected%20mail%20loop%0A2019-06-11%2014%3A03%3A11%201hal70-0001IH-VN%20\\*\\*%20%24%7Brun%3C%5BCOMMANDE%20EXECUTEE%5D%3E%7D%40localhost%3A%20Too%20many%20%22Received%22%20headers%20-%20suspected%20mail%20loop%0A2019-06-11%2014%3A07%3A44%201halBQ-0001Ij-2D%20\\*\\*%20%24%7Brun%3C%5BCOMMANDE%20EXECUTEE%5D%3E%7D%40localhost%3A%20Too%20many%20%22Received%22%20headers%20-%20suspected%20mail%20loop\"\nmessage=\"\" highlight=\"\" provider=\"manual\"/\\]\n",
"title": "Vuln\u00e9rabilit\u00e9 dans Exim",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Exim CVE-2019-10149 du 05 juin 2019",
"url": "https://www.exim.org/static/doc/security/CVE-2019-10149.txt"
}
]
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.