Executive Summary

Summary
Title Exim string_format() buffer overflow
Informations
Name VU#682457 First vendor Publication 2010-12-13
Vendor VU-CERT Last vendor Modification 2010-12-13
Severity (Vendor) N/A Revision M

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C)
Cvss Base Score 9.3 Attack Range Network
Cvss Impact Score 10 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Vulnerability Note VU#682457

Exim string_format() buffer overflow

Overview

The Exim mail server contains a buffer overflow that could allow a remote attacker to execute arbitrary code on an affected system.

I. Description

Exim is a message transfer agent (MTA) developed at the University of Cambridge for use on Unix systems connected to the Internet. The internal string handling functions of the Exim software contain a function called string_format(). The version of this function included with Exim versions prior to 4.70 contains a flaw that can result in a buffer overflow. An attacker can exploit this vulnerability by crafting message headers that are subsequently supplied to Exim logging functions.

Note: this vulnerability has been reported being exploited in the wild.

II. Impact

A remote, unauthenticated attacker may be able to execute arbitrary code with the privileges of the Exim server. A separate vulnerability in Exim could then allow the attacker to escalate privileges to root.

III. Solution

Apply an update


Users who obtain Exim from a third-party vendor, such as their operating system vendor, should see the vendor information portion of this document for a partial list of affected vendors.

This vulnerability is reportedly addressed in Exim version 4.70. Users of Exim from the original source distribution should upgrade to this version or later, as appropriate. Users who are unable to upgrade are encouraged to apply the following patch from the Exim developers:


Vendor Information

VendorStatusDate NotifiedDate Updated
Debian GNU/LinuxAffected2010-12-10
SUSE LinuxAffected2010-12-13
UbuntuAffected2010-12-13

References

http://www.exim.org/lurker/message/20101207.215955.bb32d4f2.en.html
http://www.exim.org/lurker/message/20101210.164935.385e04d0.en.html
http://bugs.exim.org/show_bug.cgi?id=787
http://git.exim.org/exim.git/commitdiff/24c929a2
http://lists.exim.org/lurker/message/20101209.172233.abcba158.en.html
https://bugzilla.redhat.com/show_bug.cgi?id=661756

Credit

This vulnerability was discovered as a result of its exploitation in the wild. Sergey Kononenko provided confirmation and public analysis.

This document was written by Chad R Dougherty.

Other Information

Date Public:2010-12-07
Date First Published:2010-12-13
Date Last Updated:2010-12-13
CERT Advisory: 
CVE-ID(s):CVE-2010-4344
NVD-ID(s):CVE-2010-4344
US-CERT Technical Alerts: 
Severity Metric:19.77
Document Revision:8

Original Source

Url : http://www.kb.cert.org/vuls/id/682457

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-119 Failure to Constrain Operations within the Bounds of a Memory Buffer

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:13170
 
Oval ID: oval:org.mitre.oval:def:13170
Title: USN-1032-1 -- exim4 vulnerability
Description: Sergey Kononenko and Eugene Bujak discovered that Exim did not correctly truncate string expansions. A remote attacker could send specially crafted email traffic to run arbitrary code as the Exim user, which could also lead to root privileges.
Family: unix Class: patch
Reference(s): USN-1032-1
CVE-2010-4344
 Version: 5
Platform(s): Ubuntu 8.04
Ubuntu 9.10
Ubuntu 6.06
 Product(s): exim4
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:22059
 
Oval ID: oval:org.mitre.oval:def:22059
Title: RHSA-2010:0970: exim security update (Critical)
Description: Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session that includes two MAIL commands in conjunction with a large message containing crafted headers, leading to improper rejection logging.
Family: unix Class: patch
Reference(s): RHSA-2010:0970-01
CVE-2010-4344
 Version: 4
Platform(s): Red Hat Enterprise Linux 5
 Product(s): exim
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23061
 
Oval ID: oval:org.mitre.oval:def:23061
Title: ELSA-2010:0970: exim security update (Critical)
Description: Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session that includes two MAIL commands in conjunction with a large message containing crafted headers, leading to improper rejection logging.
Family: unix Class: patch
Reference(s): ELSA-2010:0970-01
CVE-2010-4344
 Version: 6
Platform(s): Oracle Linux 5
 Product(s): exim
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 66

OpenVAS Exploits

Date Description
2012-07-30 Name : CentOS Update for exim CESA-2010:0970 centos4 x86_64
File : nvt/gb_CESA-2010_0970_exim_centos4_x86_64.nasl
2011-01-31 Name : CentOS Update for exim CESA-2010:0970 centos4 i386
File : nvt/gb_CESA-2010_0970_exim_centos4_i386.nasl
2011-01-04 Name : SuSE Update for exim SUSE-SA:2010:059
File : nvt/gb_suse_2010_059.nasl
2010-12-28 Name : RedHat Update for exim RHSA-2010:0970-01
File : nvt/gb_RHSA-2010_0970-01_exim.nasl
2010-12-28 Name : Ubuntu Update for exim4 vulnerability USN-1032-1
File : nvt/gb_ubuntu_USN_1032_1.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
69685 Exim string_format Function Remote Overflow

Exim is prone to a remote overflow condition. The string_format function fails to properly sanitize user-supplied input resulting in a heap buffer overflow. With a specially crafted request, a local attacker can potentially cause arbitrary code execution.

Nessus® Vulnerability Scanner

Date Description
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : suse_11_3_exim-101211.nasl - Type : ACT_GATHER_INFO
2014-01-28 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201401-32.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2010-0970.nasl - Type : ACT_GATHER_INFO
2012-08-01 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20101210_exim_on_SL4_x.nasl - Type : ACT_GATHER_INFO
2011-05-05 Name : The remote openSUSE host is missing a security update.
File : suse_11_1_exim-101211.nasl - Type : ACT_GATHER_INFO
2011-05-05 Name : The remote openSUSE host is missing a security update.
File : suse_11_2_exim-101211.nasl - Type : ACT_GATHER_INFO
2011-01-28 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2010-0970.nasl - Type : ACT_GATHER_INFO
2010-12-15 Name : The remote service has a buffer overflow.
File : exim_string_vformat.nasl - Type : ACT_ATTACK
2010-12-12 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2131.nasl - Type : ACT_GATHER_INFO
2010-12-12 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2010-0970.nasl - Type : ACT_GATHER_INFO
2010-12-12 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-1032-1.nasl - Type : ACT_GATHER_INFO