9.3 - GLSA-201401-32

Executive Summary

This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.

Summary
Title	Exim: Multiple vulnerabilities

Informations
Name	GLSA-201401-32	First vendor Publication	2014-01-27
Vendor	Gentoo	Last vendor Modification	2014-01-27
Severity (Vendor)	High	Revision	N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C)
Cvss Base Score	9.3	Attack Range	Network
Cvss Impact Score	10	Attack Complexity	Medium
Cvss Expoit Score	8.6	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Synopsis

Multiple vulnerabilities were found in Exim, the worst of which leading to remote execution of arbitrary code with root privileges.

Background

Exim is a highly configurable, drop-in replacement for sendmail.

Description

Multiple vulnerabilities have been discovered in Exim. Please review the CVE identifiers referenced below for details.

Impact

A remote attacker could possibly execute arbitrary code with the root privileges, or cause a Denial of Service condition.

Workaround

There is no known workaround at this time.

Resolution

All Exim users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=mail-mta/exim-4.80.1"

References

[ 1 ] CVE-2010-2023 : http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-2023
[ 2 ] CVE-2010-2024 : http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-2024
[ 3 ] CVE-2010-4344 : http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4344
[ 4 ] CVE-2010-4345 : http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4345
[ 5 ] CVE-2011-0017 : http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0017
[ 6 ] CVE-2011-1407 : http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1407
[ 7 ] CVE-2011-1764 : http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1764
[ 8 ] CVE-2012-5671 : http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-5671

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-201401-32.xml

Original Source

Url : http://security.gentoo.org/glsa/glsa-201401-32.xml

CWE : Common Weakness Enumeration

%	Id	Name
25 %	CWE-362	Race Condition
25 %	CWE-20	Improper Input Validation
12 %	CWE-787	Out-of-bounds Write (CWE/SANS Top 25)
12 %	CWE-134	Uncontrolled Format String (CWE/SANS Top 25)
12 %	CWE-119	Failure to Constrain Operations within the Bounds of a Memory Buffer
12 %	CWE-59	Improper Link Resolution Before File Access ('Link Following')

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:12038

Oval ID:	oval:org.mitre.oval:def:12038
Title:	DSA-2232-1 exim4 -- format string vulnerability
Description:	It was discovered that Exim, the default mail transport agent in Debian, uses DKIM data obtain from DNS directly in a format string, potentially allowing malicious mail senders to execute arbitrary code. The oldstable distribution is not affected by this problem because it does not contain DKIM support.
Family:	unix	Class:	patch
Reference(s):	DSA-2232-1 CVE-2011-1764	Version:	5
Platform(s):	Debian GNU/Linux 6.0 Debian GNU/kFreeBSD 6.0	Product(s):	exim4
Definition Synopsis:
Debian 6.0 is installed GNU/Linux or GNU/kFreeBSD kernel Debian GNU/Linux is installed AND Debian GNU/kFreeBSD is installed AND Installed architecture is all AND exim4 DPKG is earlier than 4.72-6+squeeze1

Definition Id: oval:org.mitre.oval:def:12692

Oval ID:	oval:org.mitre.oval:def:12692
Title:	DSA-2154-2 exim4 -- privilege escalation / regression
Description:	The updated packages from DSA-2154-1 introduced a regression which prevented unprivileged users from using "exim4 -bf" to test filter configurations. This update fixes this problem. Please also read the information provided in DSA-2154-1 if you have not done so already.
Family:	unix	Class:	patch
Reference(s):	DSA-2154-2 CVE-2010-4345 CVE-2011-0017	Version:	5
Platform(s):	Debian GNU/Linux 5.0	Product(s):	exim4
Definition Synopsis:
Debian GNU/Linux 5.0 is installed AND Installed architecture is all AND exim4 DPKG is earlier than 4.69-9+lenny4

Definition Id: oval:org.mitre.oval:def:12720

Oval ID:	oval:org.mitre.oval:def:12720
Title:	DSA-2131-1 exim4 -- arbitrary code execution
Description:	Several vulnerabilities have been found in exim4 that allow a remote attacker to execute arbitrary code as root user. Exploits for these issues have been seen in the wild. This update fixes a memory corruption issue that allows a remote attacker to execute arbitrary code as the Debian-exim user. A fix for an additional issue that allows the Debian-exim user to obtain root privileges is currently being checked for compatibility issues. It is not yet included in this upgrade but will released soon in an update to this advisory. For the stable distribution, this problem has been fixed in version 4.69-9+lenny1. This advisory only contains the packages for the alpha, amd64, hppa, i386, ia64, powerpc, and s390 architectures. The packages for the arm, armel, mips, mipsel, and sparc architectures will be released as soon as they are built. For the testing distribution and the unstable distribution, this problem has been fixed in version 4.70-1. We strongly recommend that you upgrade your exim4 packages.
Family:	unix	Class:	patch
Reference(s):	DSA-2131-1 CVE-2010-4344 CVE-2010-4345	Version:	5
Platform(s):	Debian GNU/Linux 5.0	Product(s):	exim4
Definition Synopsis:
Debian GNU/Linux 5.0 is installed Architecture section Architecture independet section Installed architecture is all AND Packages section xim4 DPKG is earlier than 4.69-9+lenny1 AND xim4-config DPKG is earlier than 4.69-9+lenny1 OR Architecture depended section Supported architectures section Installed architecture is s390 AND Installed architecture is amd64 AND Installed architecture is powerpc AND Installed architecture is i386 AND Installed architecture is ia64 AND Installed architecture is alpha AND Installed architecture is hppa AND Packages section xim4-base DPKG is earlier than 4.69-9+lenny1 AND xim4-dbg DPKG is earlier than 4.69-9+lenny1 AND xim4-dev DPKG is earlier than 4.69-9+lenny1 AND ximon4 DPKG is earlier than 4.69-9+lenny1 AND xim4-daemon-light DPKG is earlier than 4.69-9+lenny1 AND xim4-daemon-heavy-dbg DPKG is earlier than 4.69-9+lenny1 AND xim4-daemon-light-dbg DPKG is earlier than 4.69-9+lenny1 AND xim4-daemon-heavy DPKG is earlier than 4.69-9+lenny1

Definition Id: oval:org.mitre.oval:def:12805

Oval ID:	oval:org.mitre.oval:def:12805
Title:	DSA-2236-1 exim4 -- command injection
Description:	It was discovered that Exim, Debian's default mail transfer agent, is vulnerable to command injection attacks in its DKIM processing code, leading to arbitrary code execution. The default configuration supplied by Debian does not expose this vulnerability. The oldstable distribution is not affected by this problem.
Family:	unix	Class:	patch
Reference(s):	DSA-2236-1 CVE-2011-1407	Version:	5
Platform(s):	Debian GNU/Linux 6.0 Debian GNU/kFreeBSD 6.0	Product(s):	exim4
Definition Synopsis:
Debian 6.0 is installed GNU/Linux or GNU/kFreeBSD kernel Debian GNU/Linux is installed AND Debian GNU/kFreeBSD is installed AND Installed architecture is all AND exim4 DPKG is earlier than 4.72-6+squeeze2

Definition Id: oval:org.mitre.oval:def:12931

Oval ID:	oval:org.mitre.oval:def:12931
Title:	DSA-2154-1 exim4 -- privilege escalation
Description:	A design flaw in exim4 allowed the loal Debian-exim user to obtain root privileges by specifying an alternate configuration file using the -C option or by using the macro override facility. Unfortunately, fixing this vulnerability is not possible without some changes in exim4's behvaviour. If you use the -C or -D options or use the system filter facility, you should evaluate the changes carefully and adjust your configuration accordingly. The Debian default configuration is not affected by the changes. The detailed list of changes is described in the NEWS. Debian file in the packages. The relevant sections are also reproduced below. In addition to that, missing error handling for the setuid/setgid system calls allowed the Debian-exim user to cause root to append log data to arbitrary files.
Family:	unix	Class:	patch
Reference(s):	DSA-2154-1 CVE-2010-4345 CVE-2011-0017	Version:	5
Platform(s):	Debian GNU/Linux 5.0	Product(s):	exim4
Definition Synopsis:
Debian GNU/Linux 5.0 is installed AND Installed architecture is all AND exim4 DPKG is earlier than 4.69-9+lenny3

Definition Id: oval:org.mitre.oval:def:13170

Oval ID:	oval:org.mitre.oval:def:13170
Title:	USN-1032-1 -- exim4 vulnerability
Description:	Sergey Kononenko and Eugene Bujak discovered that Exim did not correctly truncate string expansions. A remote attacker could send specially crafted email traffic to run arbitrary code as the Exim user, which could also lead to root privileges.
Family:	unix	Class:	patch
Reference(s):	USN-1032-1 CVE-2010-4344	Version:	5
Platform(s):	Ubuntu 8.04 Ubuntu 9.10 Ubuntu 6.06	Product(s):	exim4
Definition Synopsis:
Release section Ubuntu 8.04 is installed AND Architecture section Architecture independet section Installed architecture is all AND Packages section exim4 DPKG is earlier than 4.69-2ubuntu0.2 AND exim4-config DPKG is earlier than 4.69-2ubuntu0.2 OR Architecture depended section Supported architectures section Installed architecture is amd64 AND Installed architecture is i386 AND Installed architecture is powerpc AND Installed architecture is sparc AND Installed architecture is lpia AND Packages section exim4-dbg DPKG is earlier than 4.69-2ubuntu0.2 AND eximon4 DPKG is earlier than 4.69-2ubuntu0.2 AND exim4-daemon-heavy-dbg DPKG is earlier than 4.69-2ubuntu0.2 AND exim4-base DPKG is earlier than 4.69-2ubuntu0.2 AND exim4-daemon-heavy DPKG is earlier than 4.69-2ubuntu0.2 AND exim4-dev DPKG is earlier than 4.69-2ubuntu0.2 AND exim4-daemon-light-dbg DPKG is earlier than 4.69-2ubuntu0.2 AND exim4-daemon-light DPKG is earlier than 4.69-2ubuntu0.2 OR Release section Ubuntu 9.10 is installed AND Architecture section Architecture independet section Installed architecture is all AND Packages section exim4 DPKG is earlier than 4.69-11ubuntu4.1 AND exim4-config DPKG is earlier than 4.69-11ubuntu4.1 OR Architecture depended section Supported architectures section Installed architecture is amd64 AND Installed architecture is sparc AND Installed architecture is powerpc AND Installed architecture is i386 AND Installed architecture is armel AND Installed architecture is lpia AND Packages section exim4-dev DPKG is earlier than 4.69-11ubuntu4.1 AND eximon4 DPKG is earlier than 4.69-11ubuntu4.1 AND exim4-daemon-heavy-dbg DPKG is earlier than 4.69-11ubuntu4.1 AND exim4-daemon-light DPKG is earlier than 4.69-11ubuntu4.1 AND exim4-daemon-heavy DPKG is earlier than 4.69-11ubuntu4.1 AND exim4-dbg DPKG is earlier than 4.69-11ubuntu4.1 AND exim4-daemon-light-dbg DPKG is earlier than 4.69-11ubuntu4.1 AND exim4-base DPKG is earlier than 4.69-11ubuntu4.1 OR Release section Ubuntu 6.06 is installed AND Architecture section Architecture independet section Installed architecture is all AND Packages section exim4 DPKG is earlier than 4.60-3ubuntu3.2 AND exim4-config DPKG is earlier than 4.60-3ubuntu3.2 OR Architecture depended section Supported architectures section Installed architecture is sparc AND Installed architecture is powerpc AND Installed architecture is amd64 AND Installed architecture is i386 AND Packages section exim4-daemon-heavy DPKG is earlier than 4.60-3ubuntu3.2 AND eximon4 DPKG is earlier than 4.60-3ubuntu3.2 AND exim4-base DPKG is earlier than 4.60-3ubuntu3.2 AND exim4-daemon-light DPKG is earlier than 4.60-3ubuntu3.2

Definition Id: oval:org.mitre.oval:def:13499

Oval ID:	oval:org.mitre.oval:def:13499
Title:	USN-1135-1 -- exim4 vulnerability
Description:	exim4: metapackage to ease Exim MTA installation an attacker could send crafted input to Exim and cause it to run programs as the Exim user.
Family:	unix	Class:	patch
Reference(s):	USN-1135-1 CVE-2011-1407	Version:	5
Platform(s):	Ubuntu 10.10 Ubuntu 10.04	Product(s):	exim4
Definition Synopsis:
Release section Ubuntu 10.10 is installed AND Installed architecture is all AND Packages section exim4-daemon-heavy DPKG is earlier than 4.72-1ubuntu1.3 AND exim4-daemon-custom DPKG is earlier than 4.72-1ubuntu1.3 AND exim4-daemon-light DPKG is earlier than 4.72-1ubuntu1.3 OR Release section Ubuntu 10.04 is installed AND Installed architecture is all AND Packages section exim4-daemon-heavy DPKG is earlier than 4.71-3ubuntu1.3 AND exim4-daemon-custom DPKG is earlier than 4.71-3ubuntu1.3 AND exim4-daemon-light DPKG is earlier than 4.71-3ubuntu1.3

Definition Id: oval:org.mitre.oval:def:13736

Oval ID:	oval:org.mitre.oval:def:13736
Title:	USN-1060-1 -- exim4 vulnerabilities
Description:	It was discovered that Exim contained a design flaw in the way it processed alternate configuration files. An attacker that obtained privileges of the "Debian-exim" user could use an alternate configuration file to obtain root privileges. It was discovered that Exim incorrectly handled certain return values when handling logging. A local attacker could use this flaw to obtain root privileges. Dan Rosenberg discovered that Exim incorrectly handled writable sticky-bit mail directories. If Exim were configured in this manner, a local user could use this flaw to cause a denial of service or possibly gain privileges. This issue only applied to Ubuntu 6.06 LTS, 8.04 LTS, 9.10, and 10.04 LTS. Dan Rosenberg discovered that Exim incorrectly handled MBX locking. If Exim were configured in this manner, a local user could use this flaw to cause a denial of service or possibly gain privileges. This issue only applied to Ubuntu 6.06 LTS, 8.04 LTS, 9.10, and 10.04 LTS
Family:	unix	Class:	patch
Reference(s):	USN-1060-1 CVE-2010-4345 CVE-2011-0017 CVE-2010-2023 CVE-2010-2024	Version:	5
Platform(s):	Ubuntu 8.04 Ubuntu 10.10 Ubuntu 10.04 Ubuntu 9.10 Ubuntu 6.06	Product(s):	exim4
Definition Synopsis:
Release section Ubuntu 8.04 is installed AND Architecture section Architecture independent section Installed architecture is all AND Packages section exim4 DPKG is earlier than 4.69-2ubuntu0.3 AND exim4-config DPKG is earlier than 4.69-2ubuntu0.3 OR Architecture depended section Supported architectures section Installed architecture is amd64 AND Installed architecture is i386 AND Installed architecture is powerpc AND Installed architecture is sparc AND Installed architecture is lpia AND Packages section exim4-dbg DPKG is earlier than 4.69-2ubuntu0.3 AND eximon4 DPKG is earlier than 4.69-2ubuntu0.3 AND exim4-daemon-heavy-dbg DPKG is earlier than 4.69-2ubuntu0.3 AND exim4-base DPKG is earlier than 4.69-2ubuntu0.3 AND exim4-daemon-heavy DPKG is earlier than 4.69-2ubuntu0.3 AND exim4-dev DPKG is earlier than 4.69-2ubuntu0.3 AND exim4-daemon-light-dbg DPKG is earlier than 4.69-2ubuntu0.3 AND exim4-daemon-light DPKG is earlier than 4.69-2ubuntu0.3 OR Release section Ubuntu 10.10 is installed AND Architecture section Architecture independent section Installed architecture is all AND Packages section exim4 DPKG is earlier than 4.72-1ubuntu1.1 AND exim4-config DPKG is earlier than 4.72-1ubuntu1.1 OR Architecture depended section Supported architectures section Installed architecture is powerpc AND Installed architecture is armel AND Installed architecture is amd64 AND Installed architecture is i386 AND Packages section exim4-dev DPKG is earlier than 4.72-1ubuntu1.1 AND eximon4 DPKG is earlier than 4.72-1ubuntu1.1 AND exim4-daemon-heavy-dbg DPKG is earlier than 4.72-1ubuntu1.1 AND exim4-daemon-light DPKG is earlier than 4.72-1ubuntu1.1 AND exim4-daemon-heavy DPKG is earlier than 4.72-1ubuntu1.1 AND exim4-dbg DPKG is earlier than 4.72-1ubuntu1.1 AND exim4-daemon-light-dbg DPKG is earlier than 4.72-1ubuntu1.1 AND exim4-base DPKG is earlier than 4.72-1ubuntu1.1 OR Release section Ubuntu 10.04 is installed AND Architecture section Architecture independent section Installed architecture is all AND Packages section exim4 DPKG is earlier than 4.71-3ubuntu1.1 AND exim4-config DPKG is earlier than 4.71-3ubuntu1.1 OR Architecture depended section Supported architectures section Installed architecture is amd64 AND Installed architecture is i386 AND Installed architecture is powerpc AND Installed architecture is sparc AND Installed architecture is armel AND Packages section exim4-dbg DPKG is earlier than 4.71-3ubuntu1.1 AND eximon4 DPKG is earlier than 4.71-3ubuntu1.1 AND exim4-daemon-heavy-dbg DPKG is earlier than 4.71-3ubuntu1.1 AND exim4-base DPKG is earlier than 4.71-3ubuntu1.1 AND exim4-daemon-heavy DPKG is earlier than 4.71-3ubuntu1.1 AND exim4-dev DPKG is earlier than 4.71-3ubuntu1.1 AND exim4-daemon-light-dbg DPKG is earlier than 4.71-3ubuntu1.1 AND exim4-daemon-light DPKG is earlier than 4.71-3ubuntu1.1 OR Release section Ubuntu 9.10 is installed AND Architecture section Architecture independent section Installed architecture is all AND Packages section exim4 DPKG is earlier than 4.69-11ubuntu4.2 AND exim4-config DPKG is earlier than 4.69-11ubuntu4.2 OR Architecture depended section Supported architectures section Installed architecture is amd64 AND Installed architecture is sparc AND Installed architecture is powerpc AND Installed architecture is i386 AND Installed architecture is armel AND Installed architecture is lpia AND Packages section exim4-dev DPKG is earlier than 4.69-11ubuntu4.2 AND eximon4 DPKG is earlier than 4.69-11ubuntu4.2 AND exim4-daemon-heavy-dbg DPKG is earlier than 4.69-11ubuntu4.2 AND exim4-daemon-light DPKG is earlier than 4.69-11ubuntu4.2 AND exim4-daemon-heavy DPKG is earlier than 4.69-11ubuntu4.2 AND exim4-dbg DPKG is earlier than 4.69-11ubuntu4.2 AND exim4-daemon-light-dbg DPKG is earlier than 4.69-11ubuntu4.2 AND exim4-base DPKG is earlier than 4.69-11ubuntu4.2 OR Release section Ubuntu 6.06 is installed AND Architecture section Architecture independent section Installed architecture is all AND Packages section exim4 DPKG is earlier than 4.60-3ubuntu3.3 AND exim4-config DPKG is earlier than 4.60-3ubuntu3.3 OR Architecture depended section Supported architectures section Installed architecture is sparc AND Installed architecture is powerpc AND Installed architecture is amd64 AND Installed architecture is i386 AND Packages section exim4-daemon-heavy DPKG is earlier than 4.60-3ubuntu3.3 AND eximon4 DPKG is earlier than 4.60-3ubuntu3.3 AND exim4-base DPKG is earlier than 4.60-3ubuntu3.3 AND exim4-daemon-light DPKG is earlier than 4.60-3ubuntu3.3

Definition Id: oval:org.mitre.oval:def:14030

Oval ID:	oval:org.mitre.oval:def:14030
Title:	USN-1130-1 -- exim4 vulnerability
Description:	exim4: Exim mail transfer agent Exim could be made to run arbitrary code under some conditions.
Family:	unix	Class:	patch
Reference(s):	USN-1130-1 CVE-2011-1764	Version:	5
Platform(s):	Ubuntu 10.10 Ubuntu 10.04	Product(s):	exim4
Definition Synopsis:
Release section Ubuntu 10.10 is installed AND Installed architecture is all AND Packages section exim4-daemon-heavy DPKG is earlier than 4.72-1ubuntu1.2 AND exim4-daemon-custom DPKG is earlier than 4.72-1ubuntu1.2 AND exim4-daemon-light DPKG is earlier than 4.72-1ubuntu1.2 OR Release section Ubuntu 10.04 is installed AND Installed architecture is all AND Packages section exim4-daemon-heavy DPKG is earlier than 4.71-3ubuntu1.2 AND exim4-daemon-custom DPKG is earlier than 4.71-3ubuntu1.2 AND exim4-daemon-light DPKG is earlier than 4.71-3ubuntu1.2

Definition Id: oval:org.mitre.oval:def:17931

Oval ID:	oval:org.mitre.oval:def:17931
Title:	USN-1618-1 -- exim4 vulnerability
Description:	Exim could be made to run programs if it received specially crafted network traffic.
Family:	unix	Class:	patch
Reference(s):	USN-1618-1 CVE-2012-5671	Version:	7
Platform(s):	Ubuntu 12.10 Ubuntu 12.04 Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.04	Product(s):	exim4
Definition Synopsis:
Release section Ubuntu 12.10 is installed Packages match section exim4-daemon-custom DPKG is earlier than 4.80-3ubuntu1.1 AND exim4-daemon-heavy DPKG is earlier than 4.80-3ubuntu1.1 AND exim4-daemon-light DPKG is earlier than 4.80-3ubuntu1.1 AND Release section Ubuntu 12.04 is installed Packages match section exim4-daemon-custom DPKG is earlier than 4.76-3ubuntu3.1 AND exim4-daemon-heavy DPKG is earlier than 4.76-3ubuntu3.1 AND exim4-daemon-light DPKG is earlier than 4.76-3ubuntu3.1 AND Release section Ubuntu 11.10 is installed Packages match section exim4-daemon-custom DPKG is earlier than 4.76-2ubuntu1.1 AND exim4-daemon-heavy DPKG is earlier than 4.76-2ubuntu1.1 AND exim4-daemon-light DPKG is earlier than 4.76-2ubuntu1.1 AND Release section Ubuntu 11.04 is installed Packages match section exim4-daemon-custom DPKG is earlier than 4.74-1ubuntu1.3 AND exim4-daemon-heavy DPKG is earlier than 4.74-1ubuntu1.3 AND exim4-daemon-light DPKG is earlier than 4.74-1ubuntu1.3 AND Release section Ubuntu 10.04 is installed Packages match section exim4-daemon-custom DPKG is earlier than 4.71-3ubuntu1.4 AND exim4-daemon-heavy DPKG is earlier than 4.71-3ubuntu1.4 AND exim4-daemon-light DPKG is earlier than 4.71-3ubuntu1.4

Definition Id: oval:org.mitre.oval:def:19926

Oval ID:	oval:org.mitre.oval:def:19926
Title:	DSA-2566-1 exim4 - heap overflow
Description:	It was discovered that Exim, a mail transport agent, is not properly handling the decoding of DNS records for DKIM. Specifically, crafted records can yield to a heap-based buffer overflow. An attacker can exploit this flaw to execute arbitrary code.
Family:	unix	Class:	patch
Reference(s):	DSA-2566-1 CVE-2012-5671	Version:	5
Platform(s):	Debian GNU/Linux 6.0 Debian GNU/kFreeBSD 6.0	Product(s):	exim4
Definition Synopsis:
Debian 6.0 is installed GNU/Linux or GNU/kFreeBSD kernel Debian GNU/Linux is installed AND Debian GNU/kFreeBSD is installed AND exim4 DPKG is earlier than 0:4.72-6+squeeze3

Definition Id: oval:org.mitre.oval:def:21735

Oval ID:	oval:org.mitre.oval:def:21735
Title:	RHSA-2011:0153: exim security update (Moderate)
Description:	Exim 4.72 and earlier allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with a directive that contains arbitrary commands, as demonstrated by the spool_directory directive.
Family:	unix	Class:	patch
Reference(s):	RHSA-2011:0153-01 CESA-2011:0153 CVE-2010-4345	Version:	4
Platform(s):	Red Hat Enterprise Linux 5 CentOS Linux 5	Product(s):	exim
Definition Synopsis:
Redhat 5 or Centos 5 release The operating system installed on the system is Red Hat Enterprise Linux 5 AND The operating system installed on the system is CentOS Linux 5.x Packages section exim-mon is earlier than 0:4.63-5.el5_6.2 AND exim is earlier than 0:4.63-5.el5_6.2 AND exim-sa is earlier than 0:4.63-5.el5_6.2

Definition Id: oval:org.mitre.oval:def:22059

Oval ID:	oval:org.mitre.oval:def:22059
Title:	RHSA-2010:0970: exim security update (Critical)
Description:	Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session that includes two MAIL commands in conjunction with a large message containing crafted headers, leading to improper rejection logging.
Family:	unix	Class:	patch
Reference(s):	RHSA-2010:0970-01 CVE-2010-4344	Version:	4
Platform(s):	Red Hat Enterprise Linux 5	Product(s):	exim
Definition Synopsis:
The operating system installed on the system is Red Hat Enterprise Linux 5 Packages section exim-mon is earlier than 0:4.63-5.el5_5.2 AND exim is earlier than 0:4.63-5.el5_5.2 AND exim-sa is earlier than 0:4.63-5.el5_5.2

Definition Id: oval:org.mitre.oval:def:22839

Oval ID:	oval:org.mitre.oval:def:22839
Title:	ELSA-2011:0153: exim security update (Moderate)
Description:	Exim 4.72 and earlier allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with a directive that contains arbitrary commands, as demonstrated by the spool_directory directive.
Family:	unix	Class:	patch
Reference(s):	ELSA-2011:0153-01 CVE-2010-4345	Version:	6
Platform(s):	Oracle Linux 5	Product(s):	exim
Definition Synopsis:
Oracle Linux 5.x rpm test exim-mon is earlier than 0:4.63-5.el5_6.2 AND exim is earlier than 0:4.63-5.el5_6.2 AND exim-sa is earlier than 0:4.63-5.el5_6.2

Definition Id: oval:org.mitre.oval:def:23061

Oval ID:	oval:org.mitre.oval:def:23061
Title:	ELSA-2010:0970: exim security update (Critical)
Description:	Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session that includes two MAIL commands in conjunction with a large message containing crafted headers, leading to improper rejection logging.
Family:	unix	Class:	patch
Reference(s):	ELSA-2010:0970-01 CVE-2010-4344	Version:	6
Platform(s):	Oracle Linux 5	Product(s):	exim
Definition Synopsis:
Oracle Linux 5.x rpm test exim-mon is earlier than 0:4.63-5.el5_5.2 AND exim is earlier than 0:4.63-5.el5_5.2 AND exim-sa is earlier than 0:4.63-5.el5_5.2

CPE : Common Platform Enumeration

Type	Description	Count
Application	Exim cpe:2.3:a:exim:exim:4.80:::::::* cpe:2.3:a:exim:exim:4.77:::::::* cpe:2.3:a:exim:exim:4.76:::::::* cpe:2.3:a:exim:exim:4.75:::::::* cpe:2.3:a:exim:exim:4.74:::::::* cpe:2.3:a:exim:exim:4.73:::::::* cpe:2.3:a:exim:exim:4.72:::::::* cpe:2.3:a:exim:exim:4.71:::::::* cpe:2.3:a:exim:exim:4.70:::::::* cpe:2.3:a:exim:exim:4.69:::::::* cpe:2.3:a:exim:exim:4.68:::::::* cpe:2.3:a:exim:exim:4.67:::::::* cpe:2.3:a:exim:exim:4.66:::::::* cpe:2.3:a:exim:exim:4.65:::::::* cpe:2.3:a:exim:exim:4.64:::::::* cpe:2.3:a:exim:exim:4.63:::::::* cpe:2.3:a:exim:exim:4.62:::::::* cpe:2.3:a:exim:exim:4.61:::::::* cpe:2.3:a:exim:exim:4.60:::::::* cpe:2.3:a:exim:exim:4.54:::::::* cpe:2.3:a:exim:exim:4.53:::::::* cpe:2.3:a:exim:exim:4.52:::::::* cpe:2.3:a:exim:exim:4.51:::::::* cpe:2.3:a:exim:exim:4.50:::::::* cpe:2.3:a:exim:exim:4.44:::::::* cpe:2.3:a:exim:exim:4.43:::::::* cpe:2.3:a:exim:exim:4.42:::::::* cpe:2.3:a:exim:exim:4.41:::::::* cpe:2.3:a:exim:exim:4.40:::::::* cpe:2.3:a:exim:exim:4.34:::::::* cpe:2.3:a:exim:exim:4.33:::::::* cpe:2.3:a:exim:exim:4.32:::::::* cpe:2.3:a:exim:exim:4.31:::::::* cpe:2.3:a:exim:exim:4.30:::::::* cpe:2.3:a:exim:exim:4.24:::::::* cpe:2.3:a:exim:exim:4.23:::::::* cpe:2.3:a:exim:exim:4.22:::::::* cpe:2.3:a:exim:exim:4.21:::::::* cpe:2.3:a:exim:exim:4.20:::::::* cpe:2.3:a:exim:exim:4.14:::::::* cpe:2.3:a:exim:exim:4.12:::::::* cpe:2.3:a:exim:exim:4.11:::::::* cpe:2.3:a:exim:exim:4.10:::::::* cpe:2.3:a:exim:exim:4.05:::::::* cpe:2.3:a:exim:exim:4.04:::::::* cpe:2.3:a:exim:exim:4.03:::::::* cpe:2.3:a:exim:exim:4.02:::::::* cpe:2.3:a:exim:exim:4.01:::::::* cpe:2.3:a:exim:exim:4.00:::::::* cpe:2.3:a:exim:exim:3.36:::::::* cpe:2.3:a:exim:exim:3.35:::::::* cpe:2.3:a:exim:exim:3.34:::::::* cpe:2.3:a:exim:exim:3.33:::::::* cpe:2.3:a:exim:exim:3.32:::::::* cpe:2.3:a:exim:exim:3.31:::::::* cpe:2.3:a:exim:exim:3.30:::::::* cpe:2.3:a:exim:exim:3.22:::::::* cpe:2.3:a:exim:exim:3.21:::::::* cpe:2.3:a:exim:exim:3.20:::::::* cpe:2.3:a:exim:exim:3.16:::::::* cpe:2.3:a:exim:exim:3.15:::::::* cpe:2.3:a:exim:exim:3.14:::::::* cpe:2.3:a:exim:exim:3.13:::::::* cpe:2.3:a:exim:exim:3.12:::::::* cpe:2.3:a:exim:exim:3.11:::::::* cpe:2.3:a:exim:exim:3.10:::::::* cpe:2.3:a:exim:exim:3.03:::::::* cpe:2.3:a:exim:exim:3.02:::::::* cpe:2.3:a:exim:exim:3.01:::::::* cpe:2.3:a:exim:exim:3.00:::::::* cpe:2.3:a:exim:exim:2.12:::::::* cpe:2.3:a:exim:exim:2.11:::::::* cpe:2.3:a:exim:exim:2.10:::::::* cpe:2.3:a:exim:exim:::::::: cpe:2.3:a:exim:exim:-:::::::*	75
Os	Canonical Ubuntu Linux cpe:2.3:o:canonical:ubuntu_linux:10.10:::::::* cpe:2.3:o:canonical:ubuntu_linux:10.04::::-::: cpe:2.3:o:canonical:ubuntu_linux:9.10:::::::* cpe:2.3:o:canonical:ubuntu_linux:8.04::::-::: cpe:2.3:o:canonical:ubuntu_linux:6.06:::::::*	5
Os	Debian Debian Linux cpe:2.3:o:debian:debian_linux:5.0:::::::*	1
Os	Opensuse cpe:2.3:o:opensuse:opensuse:11.3:::::::* cpe:2.3:o:opensuse:opensuse:11.2:::::::* cpe:2.3:o:opensuse:opensuse:11.1:::::::*	3

ExploitDB Exploits

id	Description
2010-12-16	Exim4 <= 4.69 string_format Function Heap Buffer Overflow

OpenVAS Exploits

Date	Description
2012-12-13	Name : SuSE Update for exim openSUSE-SU-2012:1404-1 (exim) File : nvt/gb_suse_2012_1404_1.nasl
2012-11-02	Name : Fedora Update for exim FEDORA-2012-17085 File : nvt/gb_fedora_2012_17085_exim_fc16.nasl
2012-11-02	Name : Fedora Update for exim FEDORA-2012-17044 File : nvt/gb_fedora_2012_17044_exim_fc17.nasl
2012-10-29	Name : Ubuntu Update for exim4 USN-1618-1 File : nvt/gb_ubuntu_USN_1618_1.nasl
2012-10-29	Name : Debian Security Advisory DSA 2566-1 (exim4) File : nvt/deb_2566_1.nasl
2012-10-29	Name : FreeBSD Ports: exim File : nvt/freebsd_exim4.nasl
2012-07-30	Name : CentOS Update for exim CESA-2011:0153 centos5 x86_64 File : nvt/gb_CESA-2011_0153_exim_centos5_x86_64.nasl
2012-07-30	Name : CentOS Update for exim CESA-2010:0970 centos4 x86_64 File : nvt/gb_CESA-2010_0970_exim_centos4_x86_64.nasl
2012-07-30	Name : CentOS Update for exim CESA-2011:0153 centos4 x86_64 File : nvt/gb_CESA-2011_0153_exim_centos4_x86_64.nasl
2011-08-09	Name : CentOS Update for exim CESA-2011:0153 centos5 i386 File : nvt/gb_CESA-2011_0153_exim_centos5_i386.nasl
2011-08-03	Name : Debian Security Advisory DSA 2236-1 (exim4) File : nvt/deb_2236_1.nasl
2011-08-03	Name : Debian Security Advisory DSA 2232-1 (exim4) File : nvt/deb_2232_1.nasl
2011-08-03	Name : FreeBSD Ports: exim File : nvt/freebsd_exim3.nasl
2011-06-03	Name : Ubuntu Update for exim4 USN-1135-1 File : nvt/gb_ubuntu_USN_1135_1.nasl
2011-05-23	Name : Fedora Update for exim FEDORA-2011-7059 File : nvt/gb_fedora_2011_7059_exim_fc13.nasl
2011-05-23	Name : Fedora Update for exim FEDORA-2011-7047 File : nvt/gb_fedora_2011_7047_exim_fc14.nasl
2011-05-17	Name : Ubuntu Update for exim4 USN-1130-1 File : nvt/gb_ubuntu_USN_1130_1.nasl
2011-04-19	Name : Fedora Update for exim FEDORA-2010-12375 File : nvt/gb_fedora_2010_12375_exim_fc14.nasl
2011-03-05	Name : exim -- local privilege escalation File : nvt/freebsd_exim2.nasl
2011-02-11	Name : Ubuntu Update for exim4 vulnerabilities USN-1060-1 File : nvt/gb_ubuntu_USN_1060_1.nasl
2011-01-31	Name : CentOS Update for exim CESA-2011:0153 centos4 i386 File : nvt/gb_CESA-2011_0153_exim_centos4_i386.nasl
2011-01-31	Name : CentOS Update for exim CESA-2010:0970 centos4 i386 File : nvt/gb_CESA-2010_0970_exim_centos4_i386.nasl
2011-01-24	Name : FreeBSD Ports: exim File : nvt/freebsd_exim1.nasl
2011-01-21	Name : RedHat Update for exim RHSA-2011:0153-01 File : nvt/gb_RHSA-2011_0153-01_exim.nasl
2011-01-04	Name : SuSE Update for exim SUSE-SA:2010:059 File : nvt/gb_suse_2010_059.nasl
2010-12-28	Name : Ubuntu Update for exim4 vulnerability USN-1032-1 File : nvt/gb_ubuntu_USN_1032_1.nasl
2010-12-28	Name : RedHat Update for exim RHSA-2010:0970-01 File : nvt/gb_RHSA-2010_0970-01_exim.nasl
2010-06-11	Name : Fedora Update for exim FEDORA-2010-9506 File : nvt/gb_fedora_2010_9506_exim_fc12.nasl
2010-06-11	Name : Fedora Update for exim FEDORA-2010-9524 File : nvt/gb_fedora_2010_9524_exim_fc13.nasl
2010-06-03	Name : Exim < 4.72 RC2 Multiple Vulnerabilities File : nvt/gb_exim_4_72.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
72642	Exim DKIM Identity Lookup Item Remote Code Execution
72156	Exim src/dkim.c dkim_exim_verify_finish() Function DKIM-Signature Header Form... Exim is prone to a format string condition. The dkim_exim_verify_finish() function fails to properly sanitize format string specifiers (e.g., %s and %x) in the DKIM-Signature header. With a specially crafted email, a remote attacker can potentially cause arbitrary code execution.
70696	Exim log.c open_log() Function Local Privilege Escalation Exim contains a flaw that may allow an attacker to gain access to unauthorized privileges. The issue is triggered when the 'open_log()' function in 'log.c' fails to properly check the return values of the 'setuid()' and 'setgid()' functions, allowing a local attacker to use symlink attacks to cause root to append log data to arbitrary files, resulting in the attacker gaining root privileges.
69860	Exim exim User Account Configuration File Directive Local Privilege Escalation Exim contains a flaw that may allow an attacker to gain access to unauthorized privileges. The issue is triggered when an attacker leverages the ability of an exim user account to specify an alternate configuration file with a directive that contains arbitrary commands, allowing a local attacker to gain root privileges.
69685	Exim string_format Function Remote Overflow Exim is prone to a remote overflow condition. The string_format function fails to properly sanitize user-supplied input resulting in a heap buffer overflow. With a specially crafted request, a local attacker can potentially cause arbitrary code execution.
65159	Exim transports/appendfile.c MBX Locking Race Condition Permission Modification
65158	Exim transports/appendfile.c Hardlink Handling Arbitrary File Overwrite

Snort® IPS/IDS

Date	Description
2014-01-10	Exim DKIM decoding buffer overflow attempt RuleID : 25333 - Revision : 7 - Type : PROTOCOL-DNS

Nessus® Vulnerability Scanner

Date	Description
2014-08-12	Name : The remote openSUSE host is missing a security update. File : openSUSE-2014-482.nasl - Type : ACT_GATHER_INFO
2014-06-13	Name : The remote openSUSE host is missing a security update. File : suse_11_4_exim-110524.nasl - Type : ACT_GATHER_INFO
2014-06-13	Name : The remote openSUSE host is missing a security update. File : suse_11_4_exim-110506.nasl - Type : ACT_GATHER_INFO
2014-06-13	Name : The remote openSUSE host is missing a security update. File : suse_11_3_exim-110524.nasl - Type : ACT_GATHER_INFO
2014-06-13	Name : The remote openSUSE host is missing a security update. File : suse_11_3_exim-110506.nasl - Type : ACT_GATHER_INFO
2014-06-13	Name : The remote openSUSE host is missing a security update. File : suse_11_3_exim-110207.nasl - Type : ACT_GATHER_INFO
2014-06-13	Name : The remote openSUSE host is missing a security update. File : suse_11_3_exim-101211.nasl - Type : ACT_GATHER_INFO
2014-06-13	Name : The remote openSUSE host is missing a security update. File : suse_11_3_exim-100720.nasl - Type : ACT_GATHER_INFO
2014-06-13	Name : The remote openSUSE host is missing a security update. File : openSUSE-2012-738.nasl - Type : ACT_GATHER_INFO
2014-04-18	Name : The remote web server contains an application that is affected by a buffer ov... File : atmail_webmail_6_6_2.nasl - Type : ACT_GATHER_INFO
2014-01-28	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201401-32.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2010-0970.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2011-0153.nasl - Type : ACT_GATHER_INFO
2012-11-09	Name : The remote Fedora host is missing a security update. File : fedora_2012-16899.nasl - Type : ACT_GATHER_INFO
2012-10-31	Name : The remote Fedora host is missing a security update. File : fedora_2012-17085.nasl - Type : ACT_GATHER_INFO
2012-10-30	Name : The remote Fedora host is missing a security update. File : fedora_2012-17044.nasl - Type : ACT_GATHER_INFO
2012-10-29	Name : The remote Debian host is missing a security-related update. File : debian_DSA-2566.nasl - Type : ACT_GATHER_INFO
2012-10-29	Name : The remote mail server is potentially affected by a buffer overflow vulnerabi... File : exim_4_80_1.nasl - Type : ACT_GATHER_INFO
2012-10-26	Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_b0f3ab1f1f3b11e28fe90022156e8794.nasl - Type : ACT_GATHER_INFO
2012-10-26	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-1618-1.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20110117_exim_on_SL4_x.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20101210_exim_on_SL4_x.nasl - Type : ACT_GATHER_INFO
2011-06-13	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-1135-1.nasl - Type : ACT_GATHER_INFO
2011-06-13	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-1130-1.nasl - Type : ACT_GATHER_INFO
2011-05-19	Name : The remote Fedora host is missing a security update. File : fedora_2011-7111.nasl - Type : ACT_GATHER_INFO
2011-05-18	Name : The remote Fedora host is missing a security update. File : fedora_2011-7047.nasl - Type : ACT_GATHER_INFO
2011-05-18	Name : The remote Fedora host is missing a security update. File : fedora_2011-7059.nasl - Type : ACT_GATHER_INFO
2011-05-16	Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_36594c547be711e098380022156e8794.nasl - Type : ACT_GATHER_INFO
2011-05-13	Name : The remote Debian host is missing a security-related update. File : debian_DSA-2236.nasl - Type : ACT_GATHER_INFO
2011-05-10	Name : The remote mail server is potentially affected by a format string vulnerability. File : exim_4_76.nasl - Type : ACT_ATTACK
2011-05-09	Name : The remote Debian host is missing a security-related update. File : debian_DSA-2232.nasl - Type : ACT_GATHER_INFO
2011-05-05	Name : The remote openSUSE host is missing a security update. File : suse_11_1_exim-101211.nasl - Type : ACT_GATHER_INFO
2011-05-05	Name : The remote openSUSE host is missing a security update. File : suse_11_2_exim-101211.nasl - Type : ACT_GATHER_INFO
2011-05-05	Name : The remote openSUSE host is missing a security update. File : suse_11_2_exim-110207.nasl - Type : ACT_GATHER_INFO
2011-04-13	Name : The remote Fedora host is missing a security update. File : fedora_2010-12375.nasl - Type : ACT_GATHER_INFO
2011-02-14	Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_44ccfab0356411e08e810022190034c0.nasl - Type : ACT_GATHER_INFO
2011-02-11	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-1060-1.nasl - Type : ACT_GATHER_INFO
2011-02-03	Name : The remote mail server is potentially affected by a local privilege escalatio... File : exim_4_74.nasl - Type : ACT_GATHER_INFO
2011-01-31	Name : The remote Debian host is missing a security-related update. File : debian_DSA-2154.nasl - Type : ACT_GATHER_INFO
2011-01-28	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2011-0153.nasl - Type : ACT_GATHER_INFO
2011-01-28	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2010-0970.nasl - Type : ACT_GATHER_INFO
2011-01-18	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2011-0153.nasl - Type : ACT_GATHER_INFO
2011-01-10	Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_e4fcf020044711e0becc0022156e8794.nasl - Type : ACT_GATHER_INFO
2010-12-15	Name : The remote service has a buffer overflow. File : exim_string_vformat.nasl - Type : ACT_ATTACK
2010-12-12	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2010-0970.nasl - Type : ACT_GATHER_INFO
2010-12-12	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-1032-1.nasl - Type : ACT_GATHER_INFO
2010-12-12	Name : The remote Debian host is missing a security-related update. File : debian_DSA-2131.nasl - Type : ACT_GATHER_INFO
2010-07-23	Name : The remote openSUSE host is missing a security update. File : suse_11_1_exim-100720.nasl - Type : ACT_GATHER_INFO
2010-07-23	Name : The remote openSUSE host is missing a security update. File : suse_11_2_exim-100720.nasl - Type : ACT_GATHER_INFO
2010-07-01	Name : The remote Fedora host is missing a security update. File : fedora_2010-9506.nasl - Type : ACT_GATHER_INFO
2010-07-01	Name : The remote Fedora host is missing a security update. File : fedora_2010-9524.nasl - Type : ACT_GATHER_INFO
2010-06-02	Name : The remote mail server is potentially affected by multiple vulnerabilities. File : exim_4_72.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.

Date	Informations
2014-02-17 11:38:06	Multiple Updates
2014-01-27 17:18:24	First insertion

Global Informations

Type	Count
CWE ID(s)	8
Oval ID(s)	15
CPE ID(s)	84
osvdb(s)	7
ExploitDB Exploit(s)	1
Openvas Exploit(s)	30
Snort® Rule(s)	1
Nessus® Exploit(s)	52

	Related
9.8	CVE-2010-4344
7.8	CVE-2010-4345
7.5	CVE-2011-1764
7.5	CVE-2011-1407
6.9	CVE-2011-0017
6.8	CVE-2012-5671
4.4	CVE-2010-2024
4.4	CVE-2010-2023
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 8 more Alert(s)