Attacking SSL VPN - Part 2: Breaking the Fortigate SSL VPN
2019-08-09Last month, we talked about Palo Alto Networks GlobalProtect RCE as an appetizer. Today, here comes the main dish!
Articles
Exim 任意代碼執行漏洞 (CVE-2018-6789)
2018-03-06今年我們向 Exim 回報了一個位於 base64 解碼函式的溢出漏洞，編號為 CVE-2018-6789。此漏洞從 Exim 專案開始時即存在，因此影響 Exim 的所有版本。根據我們的研究，攻擊者可利用此漏洞達成遠端任意代碼執行，並且不需任何認證，至少有 40 萬台 Exim 伺服器受此漏洞影響並存在被攻擊的風險。我們建議立即將 Exim 升級至 4.90.1 版以免遭受攻擊。
Exim Off-by-one RCE: Exploiting CVE-2018-6789 with Fully Mitigations Bypassing
2018-03-06We reported an overflow vulnerability in the base64 decode function of Exim on 5 February, 2018, identified as CVE-2018-6789. This bug exists since the first commit of exim, hence ALL versions are affected. According to our research, it can be leveraged to gain Pre-auth Remote Code Execution and at least 400k servers are at risk. Patched version 4.90.1 is already released and we suggest to upgrade exim immediately.
Exim RCE 資安通報 (CVE-2017-16943)
2017-12-112017/11/23 我們發現 Unix 的開源軟體 EXIM 含有 Use-After-Free 弱點（CVE-2017-16943）以及 Denial-of-Service 弱點（CVE-2017-16944），當 EXIM 版本是 4.88 或 4.89 並且有開啟 chunking 選項（BDAT 指令）時，攻擊者可傳送特定字串給 EXIM 觸發弱點，可能造成郵件伺服器被遠端攻擊者入侵或是郵件伺服器無法繼續提供服務。
Road to Exim RCE - Abusing Unsafe Memory Allocator in the Most Popular MTA
2017-12-11On 23 November, 2017, we reported two vulnerabilities to Exim. These bugs exist in the SMTP daemon and attackers do not need to be authenticated, including CVE-2017-16943 for a use-after-free (UAF) vulnerability, which leads to Remote Code Execution (RCE); and CVE-2017-16944 for a Denial-of-Service (DoS) vulnerability.