SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (E-mail Server)  >   Exim Vendors:   Exim.org
(Debian Issues Fix) Exim Buffer Overflows in 'accept.c' and 'verify.c' Let Remote Users Execute Arbitrary Code
SecurityTracker Alert ID:  1010089
SecurityTracker URL:  http://securitytracker.com/id/1010089
CVE Reference:   CVE-2004-0399, CVE-2004-0400   (Links to External Site)
Date:  May 7 2004
Impact:   Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 3.35, 4.32
Description:   Two buffer overflow vulnerabilities were reported in Exim. A remote user can execute arbitrary code on the target system.

Georgi Guninski reported that there is a flaw in 'accept.c' in exim 3.35 that can be triggered if the 'headers_check_syntax' option is configured in 'exim.conf'. A similar flaw in 'verify.c' in exim 4.32 can reportedly be triggered if the 'require verify = header_syntax' option is set [CVE: CVE-2004-0400]. Both of these flaws may be exploitable, but that was not confirmed, the report said.

It is also reported that version 3.35 contains a buffer overflow in 'verify.c' that can be exploited by a remote user if the 'exim.conf' file is configured with the 'sender_verify = true' option [CVE: CVE-2004-0399].

Some demonstration exploit scripts are provided in the original advisory.

The vendor is reportedly aware of the vulnerabilities.

The original advisory is available at:

http://www.guninski.com/exim1.html

Impact:   A remote user may be able to execute arbitary code on the target system with the privileges of the exim mail service.
Solution:   Debian has released a fix for the stable distribution (woody) in version 3.35-1woody3 and for the unstable distribution (sid) in version 3.36-11 for exim 3 and version 4.33-1 for exim 4.

Debian GNU/Linux 3.0 alias woody:

Source archives:

http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody3.dsc
Size/MD5 checksum: 661 e767f668a95b78cca9dba7fb4ce760bf
http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody3.diff.gz
Size/MD5 checksum: 79871 2ef6717425496214ecfafe7b6e82c29e
http://security.debian.org/pool/updates/main/e/exim/exim_3.35.orig.tar.gz
Size/MD5 checksum: 1271057 42d362e40a21bd7ffc298f92c8bd986a

Alpha architecture:

http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody3_alpha.deb
Size/MD5 checksum: 872738 8d33c534e9ae9f3c3059ab864718723f
http://security.debian.org/pool/updates/main/e/exim/eximon_3.35-1woody3_alpha.deb
Size/MD5 checksum: 52318 6dccca9aa1250e21090edcb1ced71a23

ARM architecture:

http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody3_arm.deb
Size/MD5 checksum: 785850 eade1411b6f3981666b20d928baddbd3
http://security.debian.org/pool/updates/main/e/exim/eximon_3.35-1woody3_arm.deb
Size/MD5 checksum: 43510 343209898cacb74b996f1f1c806c9eb0

Intel IA-32 architecture:

http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody3_i386.deb
Size/MD5 checksum: 759120 6c1bb45f104289d16c4953f3fa002647
http://security.debian.org/pool/updates/main/e/exim/eximon_3.35-1woody3_i386.deb
Size/MD5 checksum: 39204 85888c214b87beab7c1d463019f83c79

Intel IA-64 architecture:

http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody3_ia64.deb
Size/MD5 checksum: 972696 92253bac406c929d2d596d30280cc261
http://security.debian.org/pool/updates/main/e/exim/eximon_3.35-1woody3_ia64.deb
Size/MD5 checksum: 65160 0fc46a9b2944719485ac96ee542ca6fc

HP Precision architecture:

http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody3_hppa.deb
Size/MD5 checksum: 815190 51165bfd509b5d7152da7d5b4f0815f8
http://security.debian.org/pool/updates/main/e/exim/eximon_3.35-1woody3_hppa.deb
Size/MD5 checksum: 48290 33e32bc6f3cac414afb0551be17dabdf

Motorola 680x0 architecture:

http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody3_m68k.deb
Size/MD5 checksum: 737874 b968ffb89b0af430175d068ce6719082
http://security.debian.org/pool/updates/main/e/exim/eximon_3.35-1woody3_m68k.deb
Size/MD5 checksum: 37766 fa9af0e2665b06a6ce6d50d7c43c81ec

Big endian MIPS architecture:

http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody3_mips.deb
Size/MD5 checksum: 824330 bdef4c910b9724b47621e7e777705cda
http://security.debian.org/pool/updates/main/e/exim/eximon_3.35-1woody3_mips.deb
Size/MD5 checksum: 48870 c9910ec5e98cd5d64ef78bfc0cac26ed

Little endian MIPS architecture:

http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody3_mipsel.deb
Size/MD5 checksum: 824568 357c3ab0a559de31f3ad6a42feeb05c0
http://security.debian.org/pool/updates/main/e/exim/eximon_3.35-1woody3_mipsel.deb
Size/MD5 checksum: 48764 942b08935d4d7dcefea8e1c0442a5b38

PowerPC architecture:

http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody3_powerpc.deb
Size/MD5 checksum: 794118 0b290ba1b588e39031227a41e746e51e
http://security.debian.org/pool/updates/main/e/exim/eximon_3.35-1woody3_powerpc.deb
Size/MD5 checksum: 44784 68e851b7f9fd2b536e8e9d005eca793b

IBM S/390 architecture:

http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody3_s390.deb
Size/MD5 checksum: 779958 9c37ead04c624e77a916183d50708580
http://security.debian.org/pool/updates/main/e/exim/eximon_3.35-1woody3_s390.deb
Size/MD5 checksum: 43924 60acc08945291c505f5a97eb9642661e

Sun Sparc architecture:

http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody3_sparc.deb
Size/MD5 checksum: 785186 33bf446912335ff62209f46dc018e01f
http://security.debian.org/pool/updates/main/e/exim/eximon_3.35-1woody3_sparc.deb
Size/MD5 checksum: 42438 d15a79f0ca33c98ad58f8d5d16bcabf6

Vendor URL:  www.exim.org/ (Links to External Site)
Cause:   Boundary error
Underlying OS:  Linux (Debian)
Underlying OS Comments:  3.0

Message History:   This archive entry is a follow-up to the message listed below.
May 6 2004 Exim Buffer Overflows in 'accept.c' and 'verify.c' Let Remote Users Execute Arbitrary Code



 Source Message Contents

Subject:  [SECURITY] [DSA 501-1] New exim packages fix buffer overflows


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- --------------------------------------------------------------------------
Debian Security Advisory DSA 501-1                     security@debian.org
http://www.debian.org/security/                             Martin Schulze
May 7th, 2004                           http://www.debian.org/security/faq
- --------------------------------------------------------------------------

Package        : exim
Vulnerability  : buffer overflow
Problem-Type   : remote
Debian-specific: no
CVE ID         : CAN-2004-0399 CAN-2004-0400

Georgi Guninski discovered two stack-based buffer overflows.  They can
not be exploited with the default configuration from the Debian
system, though.  The Common Vulnerabilities and Exposures project
identifies the following problems that are fixed with this update:

CAN-2004-0399

    When "sender_verify = true" is configured in exim.conf a buffer
    overflow can happen during verification of the sender.  This
    problem is fixed in exim 4.

CAN-2004-0400

    When headers_check_syntax is configured in exim.conf a buffer
    overflow can happen during the header check.  This problem does
    also exist in exim 4.

For the stable distribution (woody) these problems have been fixed in
version 3.35-1woody3.

For the unstable distribution (sid) these problems have been fixed in
version 3.36-11 for exim 3 and in version 4.33-1 for exim 4.

We recommend that you upgrade your exim package.


Upgrade Instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 3.0 alias woody
- --------------------------------

  Source archives:

    http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody3.dsc
      Size/MD5 checksum:      661 e767f668a95b78cca9dba7fb4ce760bf
    http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody3.diff.gz
      Size/MD5 checksum:    79871 2ef6717425496214ecfafe7b6e82c29e
    http://security.debian.org/pool/updates/main/e/exim/exim_3.35.orig.tar.gz
      Size/MD5 checksum:  1271057 42d362e40a21bd7ffc298f92c8bd986a

  Alpha architecture:

    http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody3_alpha.deb
      Size/MD5 checksum:   872738 8d33c534e9ae9f3c3059ab864718723f
    http://security.debian.org/pool/updates/main/e/exim/eximon_3.35-1woody3_alpha.deb
      Size/MD5 checksum:    52318 6dccca9aa1250e21090edcb1ced71a23

  ARM architecture:

    http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody3_arm.deb
      Size/MD5 checksum:   785850 eade1411b6f3981666b20d928baddbd3
    http://security.debian.org/pool/updates/main/e/exim/eximon_3.35-1woody3_arm.deb
      Size/MD5 checksum:    43510 343209898cacb74b996f1f1c806c9eb0

  Intel IA-32 architecture:

    http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody3_i386.deb
      Size/MD5 checksum:   759120 6c1bb45f104289d16c4953f3fa002647
    http://security.debian.org/pool/updates/main/e/exim/eximon_3.35-1woody3_i386.deb
      Size/MD5 checksum:    39204 85888c214b87beab7c1d463019f83c79

  Intel IA-64 architecture:

    http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody3_ia64.deb
      Size/MD5 checksum:   972696 92253bac406c929d2d596d30280cc261
    http://security.debian.org/pool/updates/main/e/exim/eximon_3.35-1woody3_ia64.deb
      Size/MD5 checksum:    65160 0fc46a9b2944719485ac96ee542ca6fc

  HP Precision architecture:

    http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody3_hppa.deb
      Size/MD5 checksum:   815190 51165bfd509b5d7152da7d5b4f0815f8
    http://security.debian.org/pool/updates/main/e/exim/eximon_3.35-1woody3_hppa.deb
      Size/MD5 checksum:    48290 33e32bc6f3cac414afb0551be17dabdf

  Motorola 680x0 architecture:

    http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody3_m68k.deb
      Size/MD5 checksum:   737874 b968ffb89b0af430175d068ce6719082
    http://security.debian.org/pool/updates/main/e/exim/eximon_3.35-1woody3_m68k.deb
      Size/MD5 checksum:    37766 fa9af0e2665b06a6ce6d50d7c43c81ec

  Big endian MIPS architecture:

    http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody3_mips.deb
      Size/MD5 checksum:   824330 bdef4c910b9724b47621e7e777705cda
    http://security.debian.org/pool/updates/main/e/exim/eximon_3.35-1woody3_mips.deb
      Size/MD5 checksum:    48870 c9910ec5e98cd5d64ef78bfc0cac26ed

  Little endian MIPS architecture:

    http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody3_mipsel.deb
      Size/MD5 checksum:   824568 357c3ab0a559de31f3ad6a42feeb05c0
    http://security.debian.org/pool/updates/main/e/exim/eximon_3.35-1woody3_mipsel.deb
      Size/MD5 checksum:    48764 942b08935d4d7dcefea8e1c0442a5b38

  PowerPC architecture:

    http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody3_powerpc.deb
      Size/MD5 checksum:   794118 0b290ba1b588e39031227a41e746e51e
    http://security.debian.org/pool/updates/main/e/exim/eximon_3.35-1woody3_powerpc.deb
      Size/MD5 checksum:    44784 68e851b7f9fd2b536e8e9d005eca793b

  IBM S/390 architecture:

    http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody3_s390.deb
      Size/MD5 checksum:   779958 9c37ead04c624e77a916183d50708580
    http://security.debian.org/pool/updates/main/e/exim/eximon_3.35-1woody3_s390.deb
      Size/MD5 checksum:    43924 60acc08945291c505f5a97eb9642661e

  Sun Sparc architecture:

    http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody3_sparc.deb
      Size/MD5 checksum:   785186 33bf446912335ff62209f46dc018e01f
    http://security.debian.org/pool/updates/main/e/exim/eximon_3.35-1woody3_sparc.deb
      Size/MD5 checksum:    42438 d15a79f0ca33c98ad58f8d5d16bcabf6


  These files will probably be moved into the stable distribution on
  its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFAmySPW5ql+IAeqTIRAqq2AJ4gOvjgnNtO7OUqtrTTmMXZGoxRvwCeLmAP
LFMVywBxxvc3bDU6LR8YWyA=
=NRbE
-----END PGP SIGNATURE-----


-- 
To UNSUBSCRIBE, email to debian-security-announce-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC