National Cyber Awareness System

Vulnerability Summary for CVE-2010-4344

Overview

Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session that includes two MAIL commands in conjunction with a large message containing crafted headers, leading to improper rejection logging.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

US-CERT Vulnerability Note: VU#682457

Name: VU#682457

Hyperlink:http://www.kb.cert.org/vuls/id/682457

External Source: OSVDB

Name: 69685

Type: Patch Information; Exploit

Hyperlink:http://www.osvdb.org/69685

External Source: MLIST

Name: [exim-dev] 20101210 Re: Remote root vulnerability in Exim

Type: Patch Information

Hyperlink:http://lists.exim.org/lurker/message/20101210.164935.385e04d0.en.html

External Source: CONFIRM

Name: http://git.exim.org/exim.git/commit/24c929a27415c7cfc7126c47e4cad39acf3efa6b

Type: Patch Information

Hyperlink:http://git.exim.org/exim.git/commit/24c929a27415c7cfc7126c47e4cad39acf3efa6b

External Source: CONFIRM

Name: http://bugs.exim.org/show_bug.cgi?id=787

Type: Patch Information

Hyperlink:http://bugs.exim.org/show_bug.cgi?id=787

External Source: CONFIRM

Name: https://bugzilla.redhat.com/show_bug.cgi?id=661756

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=661756

External Source: VUPEN

Name: ADV-2010-3317

Hyperlink:http://www.vupen.com/english/advisories/2010/3317

External Source: VUPEN

Name: ADV-2010-3246

Type: Advisory

Hyperlink:http://www.vupen.com/english/advisories/2010/3246

External Source: VUPEN

Name: ADV-2010-3204

Type: Advisory

Hyperlink:http://www.vupen.com/english/advisories/2010/3204

External Source: VUPEN

Name: ADV-2010-3186

Type: Advisory

Hyperlink:http://www.vupen.com/english/advisories/2010/3186

External Source: VUPEN

Name: ADV-2010-3181

Type: Advisory

Hyperlink:http://www.vupen.com/english/advisories/2010/3181

External Source: VUPEN

Name: ADV-2010-3172

Type: Advisory

Hyperlink:http://www.vupen.com/english/advisories/2010/3172

External Source: VUPEN

Name: ADV-2010-3171

Type: Advisory

Hyperlink:http://www.vupen.com/english/advisories/2010/3171

External Source: UBUNTU

Name: USN-1032-1

Hyperlink:http://www.ubuntu.com/usn/USN-1032-1

External Source: MISC

Name: http://www.theregister.co.uk/2010/12/11/exim_code_execution_peril/

Hyperlink:http://www.theregister.co.uk/2010/12/11/exim_code_execution_peril/

External Source: SECTRACK

Name: 1024858

Hyperlink:http://www.securitytracker.com/id?1024858

External Source: BID

Name: 45308

Hyperlink:http://www.securityfocus.com/bid/45308

External Source: BUGTRAQ

Name: 20101213 Exim security issue in historical release

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/515172/100/0/threaded

External Source: REDHAT

Name: RHSA-2010:0970

Hyperlink:http://www.redhat.com/support/errata/RHSA-2010-0970.html

External Source: MISC

Name: http://www.metasploit.com/modules/exploit/unix/smtp/exim4_string_format

Hyperlink:http://www.metasploit.com/modules/exploit/unix/smtp/exim4_string_format

External Source: MLIST

Name: [exim-dev] 20101207 Remote root vulnerability in Exim

Hyperlink:http://www.exim.org/lurker/message/20101207.215955.bb32d4f2.en.html

External Source: DEBIAN

Name: DSA-2131

Hyperlink:http://www.debian.org/security/2010/dsa-2131

External Source: CONFIRM

Name: http://www.cpanel.net/2010/12/exim-remote-memory-corruption-vulnerability-notification-cve-2010-4344.html

Hyperlink:http://www.cpanel.net/2010/12/exim-remote-memory-corruption-vulnerability-notification-cve-2010-4344.html

External Source: SECUNIA

Name: 42589

Type: Advisory

Hyperlink:http://secunia.com/advisories/42589

External Source: SECUNIA

Name: 42587

Type: Advisory

Hyperlink:http://secunia.com/advisories/42587

External Source: SECUNIA

Name: 42586

Type: Advisory

Hyperlink:http://secunia.com/advisories/42586

External Source: SECUNIA

Name: 42576

Type: Advisory

Hyperlink:http://secunia.com/advisories/42576

External Source: SECUNIA

Name: 40019

Type: Advisory

Hyperlink:http://secunia.com/advisories/40019

External Source: MLIST

Name: [oss-security] 20101210 Exim remote root

Hyperlink:http://openwall.com/lists/oss-security/2010/12/10/1

External Source: SUSE

Name: SUSE-SA:2010:059

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00003.html

External Source: CONFIRM

Name: http://atmail.com/blog/2010/atmail-6204-now-available/

Hyperlink:http://atmail.com/blog/2010/atmail-6204-now-available/

External Source: CONFIRM

Name: ftp://ftp.exim.org/pub/exim/ChangeLogs/ChangeLog-4.70

Hyperlink:ftp://ftp.exim.org/pub/exim/ChangeLogs/ChangeLog-4.70