[UNIX] Exim dns_buld_reverse() Buffer Overflow Vulnerability

From: SecuriTeam (support_at_securiteam.com)
Date: 01/16/05

  • Next message: SecuriTeam: "[EXPL] Exim dns_buld_reverse() Exploit" 
    To: list@securiteam.com
Date: 16 Jan 2005 10:50:49 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Exim dns_buld_reverse() Buffer Overflow Vulnerability
    ------------------------------------------------------------------------

    SUMMARY

     <http://www.exim.org/> Exim is "a mail transfer agent (MTA) for Unix
    systems similar to Sendmail". Local exploitation of a buffer overflow
    vulnerability in Exim 4.41 allows execution of arbitrary commands with
    elevated privileges.

    DETAILS

    Vulnerable Systems:
     * Exim version 4.42 and prior

    Immune Systems:
     * Exim version 4.43 or newer

    The problem specifically exists in the dns_build_reverse() function. The
    function fails to check the length of a string which it copies into a
    fixed length buffer. This string is user controlled and passed into the
    program from a command line option.

    The following example demonstrates an input that will crash Exim:
    /usr/bin/exim -bh ::%A`perl -e 'print pack('L',0xdeadbeef') x 256'`

    Analysis:
    Exploitation of this vulnerability will give an attacker access to the
    mailer uid. (The exim mailer is setuid root, but drops privileges before
    the vulnerable code is reached). Having the mailer uid may allow access to
    sensitive information in email messages, or possibly further elevation.

    Vendor response:
    A patch for Exim release 4.43 which addresses this vulnerability is
    available at:
    <http://www.exim.org/mail-archives/exim-announce/2005/msg00000.html>
    http://www.exim.org/mail-archives/exim-announce/2005/msg00000.html

    The patch will be incorporated into a future Exim release (4.50).

    Disclosure Timeline:
    09/30/2004 - Initial vendor notification
    09/30/2004 - Initial vendor response
    01/14/2005 - Public disclosure

    ADDITIONAL INFORMATION

    The information has been provided by
    <mailto:idlabs-advisories@idefense.com> iDEFENSE.
    The original article can be found at:
    <http://www.idefense.com/application/poi/display?id=183&type=vulnerabilities> http://www.idefense.com/application/poi/display?id=183&type=vulnerabilities

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[EXPL] Exim dns_buld_reverse() Exploit"

    Relevant Pages

    • [UNIX] Multiple Vendor X Server CID-keyed Fonts scan_cidfont() Integer Overflow
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Multiple Vendor X Server CID-keyed Fonts 'scan_cidfont' Integer Overflow ... vulnerability in the 'scan_cidfont' function in the X.Org and XFree86 X ... 08/25/2005 Initial vendor response ...
      (Securiteam)
    • [NT] Multiple Integer Overflow Vulnerabilities In PuTTY SFTP
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Simon Tatham's PuTTY has been found to contain multiple remote integer ... It should be noted that this vulnerability may ... 02/19/2005 - Initial vendor response ...
      (Securiteam)
    • [NEWS] Mac OS X CF_CHARSET_PATH Buffer Overflow Vulnerability
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Mac OS X is "an operating system for the Apple family of microcomputers". ... Local exploitation of a buffer overflow vulnerability within the Core ... 02/04/2005 - Initial vendor response ...
      (Securiteam)
    • [UNIX] Exim auth_spa_server() Buffer Overflow Vulnerability
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Exim 4.41 allows execution of arbitrary commands with elevated privileges. ... user-controlled and passed to the program from a remote connection. ... Exploitation of this vulnerability will give an attacker remote access to ...
      (Securiteam)
    • [UNIX] IBM AIX pioout BSS Buffer Overflow Vulnerability
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... IBM AIX pioout BSS Buffer Overflow Vulnerability ... 12/03/2007 - Initial vendor response ... The information in this bulletin is provided "AS IS" without warranty of any kind. ...
      (Securiteam)
    • Quantcast