SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (E-mail Server)  >   Exim Vendors:   Exim.org
(Conectiva Issues Fix) Re: Exim Mail Server May Allow Remote Users to Execute Arbitrary Code with Root-Level Privileges on the Server
SecurityTracker Alert ID:  1001747
SecurityTracker URL:  http://securitytracker.com/id/1001747
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Jun 14 2001
Impact:   Execution of arbitrary code via network, Root access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  

Description:   A vulnerability has been reported in the Exim mail server that may allow a remote user to execute arbitrary code on the server.

It is reported that when Exim is configured to check incoming mail headers for proper syntax, the vulnerability can be triggered. This is configured through the /etc/exim.conf headers_check_syntax option. By default, this option is not set.

The vulnerability reportedly exists in the accept.c module where the moan_smtp_batch() function is called.

A demonstration exploit transcript is provided in the Source Message.

Impact:   A remote user can execute arbitrary code on the server with root-level privileges.
Solution:   Conectiva has issued a fix. See the Source Message for upgrade instructions.
Vendor URL:  www.exim.org/ (Links to External Site)
Cause:   Input validation error
Underlying OS:  Linux (Conectiva)

Message History:   This archive entry is a follow-up to the message listed below.
Jun 6 2001 Exim Mail Server May Allow Remote Users to Execute Arbitrary Code with Root-Level Privileges on the Server



 Source Message Contents

Subject:  [CLA-2001:402] Conectiva Linux Security Announcement - exim


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- --------------------------------------------------------------------------
CONECTIVA LINUX SECURITY ANNOUNCEMENT 
- --------------------------------------------------------------------------

PACKAGE   : exim
SUMMARY   : Format string vulnerability in exim
DATE      : 2001-06-13 16:27:00
ID        : CLA-2001:402
RELEVANT
RELEASES  : 6.0

- -------------------------------------------------------------------------

DESCRIPTION
 "exim" is a popular mail server (MTA) that is included in many
 GNU/Linux distributions.
 Megyer Laszlo reported a format bug vulnerability in the exim package
 that could lead to a compromise if exim is run as root. This software
 is not installed by default on Conectiva Linux 6.0 and, even if
 installed, the default configuration is not vulnerable because it
 does not include the "headers_check_syntax" option in the
 /etc/exim.conf configuration file which is needed to trigger the bug.
 If, however, that option is enabled, and exim is also used to process
 batched SMTP input (via the -bS command-line option), then the
 service becomes vulnerable and a remote attack becomes possible.


SOLUTION
 All exim users are urged to upgrade their packages. Please note that
 this update will restart exim if the daemon is already running.
 
 
 REFERENCES
 http://www.securityfocus.com/bid/2828/


DIRECT DOWNLOAD LINKS TO THE UPDATED PACKAGES
ftp://atualizacoes.conectiva.com.br/6.0/SRPMS/exim-3.16-4U60_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/exim-3.16-4U60_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/exim-doc-3.16-4U60_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/exim-mon-3.16-4U60_1cl.i386.rpm


ADDITIONAL INSTRUCTIONS
 Users of Conectiva Linux version 6.0 or higher may use apt to perform 
 upgrades of RPM packages:
 - add the following line to /etc/apt/sources.list if it is not there yet
   (you may also use linuxconf to do this):

 rpm [cncbr] ftp://atualizacoes.conectiva.com.br 6.0/conectiva updates

(replace 6.0 with the correct version number if you are not running CL6.0)

 - run:                 apt-get update
 - after that, execute: apt-get upgrade

 Detailed instructions reagarding the use of apt and upgrade examples 
 can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en


- -------------------------------------------------------------------------
All packages are signed with Conectiva's GPG key. The key and instructions
on how to import it can be found at 
http://distro.conectiva.com.br/seguranca/chave/?idioma=en
Instructions on how to check the signatures of the RPM packages can be
found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en
- -------------------------------------------------------------------------
All our advisories and generic update instructions can be viewed at
http://distro.conectiva.com.br/atualizacoes/?idioma=en

- -------------------------------------------------------------------------
subscribe: conectiva-updates-subscribe@papaleguas.conectiva.com.br
unsubscribe: conectiva-updates-unsubscribe@papaleguas.conectiva.com.br
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.4 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQE7J77P42jd0JmAcZARAgfwAJ9gv11hSHXQ8NaO1GaRSffyE1kFAgCgxQcC
ndH70icT/qohz/W3nqWn2SA=
=0iK0
-----END PGP SIGNATURE-----


 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC