Out-of-bounds read in Exim - CVE-2020-12783

Vulnerability identifier: #VU27959

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-12783

CWE-ID: CWE-125

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in the SPA authenticator within auths/spa.c and auths/auth-spa.c. A remote attacker can bypass SPA/NTLM authentication.

Exim
Amazon Linux AMI
Fedora
exim (Alpine package)
exim4 (Ubuntu package)
exim4 (Debian package)
exim

Install update from vendor's website.

Exim - update to 4.94
exim (Alpine package) - addressed in versions 4.93-r1, 4.94-r0
exim4 (Ubuntu package) - addressed in versions 4.86.2-2ubuntu2.6, 4.90.1-1ubuntu1.5, 4.92.1-1ubuntu3.1, 4.93-13ubuntu1.1
exim4 (Debian package) - addressed in versions 4.89-2+deb9u7, 4.92-8+deb10u4
exim - addressed in versions 4.92.3-2.el6, 4.93-3.el7, 4.93-3.el8, 4.93-8.fc31, 4.93-8.fc32

• https://bugs.exim.org/show_bug.cgi?id=2571
• https://git.exim.org/exim.git/commit/57aa14b216432be381b6295c312065b2fd034f86
• https://git.exim.org/exim.git/commit/a04174dc2a84ae1008c23b6a7109e7fa3fb7b8b0
• https://www.debian.org/security/2020/dsa-4687

• SPA authentication bypass in Exim
• Debian update for exim4
• Ubuntu update for Exim
• Amazon Linux AMI update for exim
• Out-of-bounds read in exim (Alpine package)
• Fedora 32 update for exim
• Fedora 31 update for exim
• Fedora EPEL 8 update for exim
• Fedora EPEL 7 update for exim
• Fedora EPEL 6 update for exim