Debian update for exim4

Published: 2015-09-26

Risk	High
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2010-4344 CVE-2010-4345
CWE-ID	CWE-122 CWE-78
Exploitation vector	Network
Public exploit	Vulnerability #1 is being exploited in the wild. Vulnerability #2 is being exploited in the wild.
Vulnerable software Subscribe	Debian Linux Operating systems & Components / Operating system
Vendor	Debian

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Heap-based buffer overflow

EUVDB-ID: #VU12128

Risk: High

CVSSv3.1: 9.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H/RL:O/RC:C]

CVE-ID: CVE-2010-4344

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists in the string_vformat function in string.c due to heap-based buffer overflow. A remote attacker can trigger memory corruption and execute arbitrary code via an SMTP session that includes two MAIL commands in conjunction with a large message containing specially crafted headers, leading to improper rejection logging.

Mitigation

Update the affected package to version: 4.69-9+lenny1, 4.70-1

Vulnerable software versions

Debian Linux: All versions

External links

http://lists.exim.org/lurker/message/20101207.215955.bb32d4f2.en.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

2) Privilege escalation

EUVDB-ID: #VU341

Risk: Low

CVSSv3.1: 6 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:H/RL:O/RC:C]

CVE-ID: CVE-2010-4345

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Exploit availability: Yes

Description

The vulnerability allows a local user to escalate privileges on vulnerable system.

The vulnerability exists due to design error in Exim, when allowing local users to load arbitrary configuration file via the "spool_directory" directive. A local user can specify an alternate configuration file with a directive that contains arbitrary commands and execute arbitrary commands on the system with root privileges.

Successful exploitation of this vulnerability will allow a local user to gain root privileges on the system.