Hacker News new | ask | show | jobs
by Panino 2339 days ago
I tested this exploit against an unpatched OpenBSD 6.6 machine and it works with the default mbox delivery, but not with maildir delivery (as hinted by the syspatch message). So if you use maildir delivery like me, you weren't exposed to this security hole. This is the sound of the world's quietest sigh of relief. I have some questions:

Is Qualys getting paid for this excellent work, and if so, by who?

Is there a plan to do a serious audit of execle related code in OpenBSD?

As a longtime OpenBSD user, I gotta say that OpenSMTPD is the part of the system I'm least comfortable with from a security standpoint. Too many rewrites, mulligans, CVEs. Very little of the web howtos match the official documentation because there's so much churn, which by itself is a red flag. And even without a logic bug, I'm surprised execle was used at all here. It was unnecessary and naive. I'll be honest, I'm in the middle of transitioning from qmail to OpenSMTPD, and this bug is making me consider notqmail.

This RCE is trivial and super bad.
3 comments
cnst 2339 days ago
That's for pointing this out.

It is pretty ridiculous just how trivial and severe this is, indeed.

However, given the lower prevalence of OpenBSD, I'd be interested to know whether anyone has any data on whether this is being exploited in the wild.

link
boring_twenties 2339 days ago
No data, but it only listens on localhost by default.
link
cnst 2337 days ago
Do you think anyone who changes the default also changes the delivery to Maildir?

(So, at a minimum, it's a local user privilege escalation, of any user to root, in the default install?)

link
landr0id 2339 days ago
>Is Qualys getting paid for this excellent work, and if so, by who?

I can't say I have any info on this subject, but having a group of people do stellar newsworthy offensive security research around widely used products is a good way to market your company for free and help drive sales for your security products.

link
justinclift 2339 days ago
> for free

It's only free from external cost though. The time for the staff at Qualys is (probably) not free. ;)

link
jacobush 2339 days ago
Also just in - they eat and breathe. :) And the heat-death of the Universe is closer this Monday.
link
jmclnx 2338 days ago
> Is Qualys getting paid for this excellent > work, and if so, by who?

See:

https://en.wikipedia.org/wiki/Qualys

My guess is they use OpenBSD and this is part of 'give back'.

link