Use of externally-controlled format string in Exim - CVE-2011-1764
Published: April 24, 2018
Vulnerability identifier: #VU12130
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2011-1764
CWE-ID: CWE-134
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause DoS condition or execute arbitrary code on the target system.
The weakness exists in the dkim_exim_verify_finish function in src/dkim.c due to use of externally-controlled format string. A remote attacker can cause the service to crash or execute arbitrary code via format string specifiers in data used in DKIM logging, as demonstrated by an identity field containing a % (percent) character.
Successful exploitation of the vulnerability may result in system compromise.
The weakness exists in the dkim_exim_verify_finish function in src/dkim.c due to use of externally-controlled format string. A remote attacker can cause the service to crash or execute arbitrary code via format string specifiers in data used in DKIM logging, as demonstrated by an identity field containing a % (percent) character.
Successful exploitation of the vulnerability may result in system compromise.
Affected software
Exim
Debian Linux
Fedora
exim4 (Ubuntu package)
exim
Debian Linux
Fedora
exim4 (Ubuntu package)
exim
How to mitigate CVE-2011-1764
Update to version 4.76.
exim4 (Ubuntu package) - addressed in versions 4.71-3ubuntu1.2, 4.72-1ubuntu1.2, 4.74-1ubuntu1.1
exim - addressed in versions 4.72-2.el6, 4.72-4.el6
exim - addressed in versions 4.72-2.el6, 4.72-4.el6