Exim Internet Mailer Format String Vulnerability
BID:6314
Info
Exim Internet Mailer Format String Vulnerability
| Bugtraq ID: | 6314 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Dec 04 2002 12:00AM |
| Updated: | Dec 04 2002 12:00AM |
| Credit: | Discovery of this vulnerability is credited to Thomas Wana <[email protected]>. |
| Vulnerable: |
University of Cambridge Exim 4.10 University of Cambridge Exim 3.36 University of Cambridge Exim 3.35 |
| Not Vulnerable: | |
Discussion
Exim Internet Mailer Format String Vulnerability
A format string vulnerability has been discovered in Exim. The problem occurs in the daemon_go() function. By supplying malicious format strings via the command line, it is possible for an attacker to execute arbitrary code with root privileges.
It should be noted that the execution of the daemon_go() function is limited to the user defined as the 'exim-admin-user'. The 'exim-admin-user' must be defined at compile time.
A format string vulnerability has been discovered in Exim. The problem occurs in the daemon_go() function. By supplying malicious format strings via the command line, it is possible for an attacker to execute arbitrary code with root privileges.
It should be noted that the execution of the daemon_go() function is limited to the user defined as the 'exim-admin-user'. The 'exim-admin-user' must be defined at compile time.
Exploit / POC
Exim Internet Mailer Format String Vulnerability
An exploit has been written and publically released.
An exploit has been written and publically released.
Solution / Fix
Exim Internet Mailer Format String Vulnerability
Solution:
The vendor has released patches that address this issue. Users are advised to upgrade as soon as possible.
Gentoo Linux has released an advisory. Users who have installed net-mail/exim-4.05 and earlier are advised to update their systems by issuing the following commands:
emerge rsync
emerge exim
emerge clean
Patches available:
University of Cambridge Exim 3.36
University of Cambridge Exim 4.10
Solution:
The vendor has released patches that address this issue. Users are advised to upgrade as soon as possible.
Gentoo Linux has released an advisory. Users who have installed net-mail/exim-4.05 and earlier are advised to update their systems by issuing the following commands:
emerge rsync
emerge exim
emerge clean
Patches available:
University of Cambridge Exim 3.36
-
Exim exim336.patch
http://downloads.securityfocus.com/vulnerabilities/patches/exim336.pat ch
University of Cambridge Exim 4.10
-
Exim exim410.patch
http://downloads.securityfocus.com/vulnerabilities/patches/exim410.pat ch
References
Exim Internet Mailer Format String Vulnerability
References:
References:
- [Exim] Minor security problem in both Exim 3 and 4 (Exim)
- Exim homepage (Exim)
- Local root vulnerability found in exim 4.x (and 3.x) (Wana Thomas <[email protected]>)