Exim HELO or EHLO command heap overflow
| exim-helo-heap-overflow (13067) |  High Risk |
Description:
Exim vulnerable to a heap overflow. A remote attacker can establish an SMTP connection to the Exim daemon and issue the HELO or EHLO command to overflow a buffer and possibly execute arbitrary commands on the system.
Platforms Affected:
- Cambridge University, Exim 3.0
- Cambridge University, Exim 3.11
- Cambridge University, Exim 3.12
- Cambridge University, Exim 3.13
- Cambridge University, Exim 3.14
- Cambridge University, Exim 3.15
- Cambridge University, Exim 3.16
- Cambridge University, Exim 3.17
- Cambridge University, Exim 3.18
- Cambridge University, Exim 3.19
- Cambridge University, Exim 3.20
- Cambridge University, Exim 3.21
- Cambridge University, Exim 3.22
- Cambridge University, Exim 3.3
- Cambridge University, Exim 3.3 1
- Cambridge University, Exim 3.3 2
- Cambridge University, Exim 3.30
- Cambridge University, Exim 3.31
- Cambridge University, Exim 3.32
- Cambridge University, Exim 3.33
- Cambridge University, Exim 3.34
- Cambridge University, Exim 3.35
- Cambridge University, Exim 3.36
- Cambridge University, Exim 4.10
- Cambridge University, Exim 4.20
- Conectiva, Linux 7.0
- Conectiva, Linux 8.0
- Conectiva, Linux 9.0
- Debian, Debian Linux 3.0
- Gentoo, Linux
Remedy:
Upgrade to the latest version of Exim (4.21 or later), available at the Exim home page. See References.
For Debian GNU/Linux 3.0 (woody):
Upgrade to the latest exim package (3.35-3woody1 or later), as listed in DSA-376-2. See References.
For Conectiva Linux:
Upgrade to the latest exim package, as listed below. Refer to Conectiva Linux Security Advisory CLSA-2003:735 for more information. See References.
Conectiva Linux 7.0: 3.22-9U70_2cl or later
Conectiva Linux 8.0: 3.33-4U80_1cl or later
Conectiva Linux 9.0: 3.36-28816U90_1cl or later
For Gentoo Linux:
Upgrade to the latest version of exim (4.21 or later), as listed in Gentoo Linux Security Announcement 200309-09. See References.
For other distributions:
Contact your vendor for upgrade or patch information.
Consequences:
Gain Access
References:
- BugTraq Mailing List, Mon Sep 01 2003 - 01:00:34 CDT, exim remote heap overflow, probably not exploitable at http://archives.neohapsis.com/archives/bugtraq/2003-09/0003.html.
- Conectiva Linux Security Advisory CLSA-2003:735, exim at http://distro.conectiva.com/atualizacoes/index.php?id=a&anuncio=000735.
- The Exim Home Page, Current Versions at http://www.exim.org/.
- BID-8518: Exim EHLO/HELO Remote Heap Corruption Vulnerability
- CVE-2003-0698: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2003-0743. Reason: This candidate is a duplicate of CVE-2003-0743. Notes: All CVE users should reference CVE-2003-0743 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
- CVE-2003-0743: Heap-based buffer overflow in smtp_in.c for Exim 3 (exim3) before 3.36 and Exim 4 (exim4) before 4.21 may allow remote attackers to execute arbitrary code via an invalid (1) HELO or (2) EHLO argument with a large number of spaces followed by a NULL character and a newline, which is not properly trimmed before the (no argument given) string is appended to the buffer.
- DSA-376: exim -- buffer overflow
Reported:
Sep 01, 2003
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net