From: SecuriTeam <support@securiteam.com.>
To: [email protected]
Date: 16 Jan 2005 10:50:49 +0200
Subject: [UNIX] Exim dns_buld_reverse() Buffer Overflow Vulnerability
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-Id: <20050116091834.5BA595781@mail.tyumen.ru.>
X-Virus-Scanned: antivirus-gw at tyumen.ru
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Exim dns_buld_reverse() Buffer Overflow Vulnerability
------------------------------------------------------------------------
SUMMARY
<http://www.exim.org/>; Exim is "a mail transfer agent (MTA) for Unix
systems similar to Sendmail". Local exploitation of a buffer overflow
vulnerability in Exim 4.41 allows execution of arbitrary commands with
elevated privileges.
DETAILS
Vulnerable Systems:
* Exim version 4.42 and prior
Immune Systems:
* Exim version 4.43 or newer
The problem specifically exists in the dns_build_reverse() function. The
function fails to check the length of a string which it copies into a
fixed length buffer. This string is user controlled and passed into the
program from a command line option.
The following example demonstrates an input that will crash Exim:
/usr/bin/exim -bh ::%A`perl -e 'print pack('L',0xdeadbeef') x 256'`
Analysis:
Exploitation of this vulnerability will give an attacker access to the
mailer uid. (The exim mailer is setuid root, but drops privileges before
the vulnerable code is reached). Having the mailer uid may allow access to
sensitive information in email messages, or possibly further elevation.
Vendor response:
A patch for Exim release 4.43 which addresses this vulnerability is
available at:
<http://www.exim.org/mail-archives/exim-announce/2005/msg00000.html>;
http://www.exim.org/mail-archives/exim-announce/2005/msg00000.html
The patch will be incorporated into a future Exim release (4.50).
Disclosure Timeline:
09/30/2004 - Initial vendor notification
09/30/2004 - Initial vendor response
01/14/2005 - Public disclosure
ADDITIONAL INFORMATION
The information has been provided by
<mailto:idlabs-advisories@idefense.com.> iDEFENSE.
The original article can be found at:
<http://www.idefense.com/application/poi/display?id=183&type=vulnerabilities>; http://www.idefense.com/application/poi/display?id=183&type=vulnerabilities
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected]
In order to subscribe to the mailing list, simply forward this email to: [email protected]
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
