Debian: exim Buffer overflow vulnerabilities

    Date10 May 2004
    CategoryDebian
    2137
    Posted ByLinuxSecurity Advisories
    Neither of these stack-based buffer overflows is exploitable with the default Debian configuration.
    
    Debian Security Advisory DSA 501-1                     This email address is being protected from spambots. You need JavaScript enabled to view it. 
    http://www.debian.org/security/                             Martin Schulze
    May 7th, 2004                            http://www.debian.org/security/faq
    - --------------------------------------------------------------------------
    
    Package        : exim
    Vulnerability  : buffer overflow
    Problem-Type   : remote
    Debian-specific: no
    CVE ID         : CAN-2004-0399 CAN-2004-0400
    
    Georgi Guninski discovered two stack-based buffer overflows.  They can
    not be exploited with the default configuration from the Debian
    system, though.  The Common Vulnerabilities and Exposures project
    identifies the following problems that are fixed with this update:
    
    CAN-2004-0399
    
        When "sender_verify = true" is configured in exim.conf a buffer
        overflow can happen during verification of the sender.  This
        problem is fixed in exim 4.
    
    CAN-2004-0400
    
        When headers_check_syntax is configured in exim.conf a buffer
        overflow can happen during the header check.  This problem does
        also exist in exim 4.
    
    For the stable distribution (woody) these problems have been fixed in
    version 3.35-1woody3.
    
    For the unstable distribution (sid) these problems have been fixed in
    version 3.36-11 for exim 3 and in version 4.33-1 for exim 4.
    
    We recommend that you upgrade your exim package.
    
    
    Upgrade Instructions
    - --------------------
    
    wget url
            will fetch the file for you
    dpkg -i file.deb
            will install the referenced file.
    
    If you are using the apt-get package manager, use the line for
    sources.list as given below:
    
    apt-get update
            will update the internal database
    apt-get upgrade
            will install corrected packages
    
    You may use an automated update by adding the resources from the
    footer to the proper configuration.
    
    
    Debian GNU/Linux 3.0 alias woody
    - --------------------------------
    
      Source archives:
    
         http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody3.dsc
          Size/MD5 checksum:      661 e767f668a95b78cca9dba7fb4ce760bf
         http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody3.diff.gz
          Size/MD5 checksum:    79871 2ef6717425496214ecfafe7b6e82c29e
         http://security.debian.org/pool/updates/main/e/exim/exim_3.35.orig.tar.gz
          Size/MD5 checksum:  1271057 42d362e40a21bd7ffc298f92c8bd986a
    
      Alpha architecture:
    
         http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody3_alpha.deb
          Size/MD5 checksum:   872738 8d33c534e9ae9f3c3059ab864718723f
         http://security.debian.org/pool/updates/main/e/exim/eximon_3.35-1woody3_alpha.deb
          Size/MD5 checksum:    52318 6dccca9aa1250e21090edcb1ced71a23
    
      ARM architecture:
    
         http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody3_arm.deb
          Size/MD5 checksum:   785850 eade1411b6f3981666b20d928baddbd3
         http://security.debian.org/pool/updates/main/e/exim/eximon_3.35-1woody3_arm.deb
          Size/MD5 checksum:    43510 343209898cacb74b996f1f1c806c9eb0
    
      Intel IA-32 architecture:
    
         http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody3_i386.deb
          Size/MD5 checksum:   759120 6c1bb45f104289d16c4953f3fa002647
         http://security.debian.org/pool/updates/main/e/exim/eximon_3.35-1woody3_i386.deb
          Size/MD5 checksum:    39204 85888c214b87beab7c1d463019f83c79
    
      Intel IA-64 architecture:
    
         http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody3_ia64.deb
          Size/MD5 checksum:   972696 92253bac406c929d2d596d30280cc261
         http://security.debian.org/pool/updates/main/e/exim/eximon_3.35-1woody3_ia64.deb
          Size/MD5 checksum:    65160 0fc46a9b2944719485ac96ee542ca6fc
    
      HP Precision architecture:
    
         http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody3_hppa.deb
          Size/MD5 checksum:   815190 51165bfd509b5d7152da7d5b4f0815f8
         http://security.debian.org/pool/updates/main/e/exim/eximon_3.35-1woody3_hppa.deb
          Size/MD5 checksum:    48290 33e32bc6f3cac414afb0551be17dabdf
    
      Motorola 680x0 architecture:
    
         http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody3_m68k.deb
          Size/MD5 checksum:   737874 b968ffb89b0af430175d068ce6719082
         http://security.debian.org/pool/updates/main/e/exim/eximon_3.35-1woody3_m68k.deb
          Size/MD5 checksum:    37766 fa9af0e2665b06a6ce6d50d7c43c81ec
    
      Big endian MIPS architecture:
    
         http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody3_mips.deb
          Size/MD5 checksum:   824330 bdef4c910b9724b47621e7e777705cda
         http://security.debian.org/pool/updates/main/e/exim/eximon_3.35-1woody3_mips.deb
          Size/MD5 checksum:    48870 c9910ec5e98cd5d64ef78bfc0cac26ed
    
      Little endian MIPS architecture:
    
         http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody3_mipsel.deb
          Size/MD5 checksum:   824568 357c3ab0a559de31f3ad6a42feeb05c0
         http://security.debian.org/pool/updates/main/e/exim/eximon_3.35-1woody3_mipsel.deb
          Size/MD5 checksum:    48764 942b08935d4d7dcefea8e1c0442a5b38
    
      PowerPC architecture:
    
         http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody3_powerpc.deb
          Size/MD5 checksum:   794118 0b290ba1b588e39031227a41e746e51e
         http://security.debian.org/pool/updates/main/e/exim/eximon_3.35-1woody3_powerpc.deb
          Size/MD5 checksum:    44784 68e851b7f9fd2b536e8e9d005eca793b
    
      IBM S/390 architecture:
    
         http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody3_s390.deb
          Size/MD5 checksum:   779958 9c37ead04c624e77a916183d50708580
         http://security.debian.org/pool/updates/main/e/exim/eximon_3.35-1woody3_s390.deb
          Size/MD5 checksum:    43924 60acc08945291c505f5a97eb9642661e
    
      Sun Sparc architecture:
    
         http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody3_sparc.deb
          Size/MD5 checksum:   785186 33bf446912335ff62209f46dc018e01f
         http://security.debian.org/pool/updates/main/e/exim/eximon_3.35-1woody3_sparc.deb
          Size/MD5 checksum:    42438 d15a79f0ca33c98ad58f8d5d16bcabf6
    
    
      These files will probably be moved into the stable distribution on
      its next update.
    
    - ---------------------------------------------------------------------------------
    For apt-get: deb  http://security.debian.org/ stable/updates main
    For dpkg-ftp:  ftp://security.debian.org/debian-security dists/stable/updates/main
    Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.
    Package info: `apt-cache show ' and  http://packages.debian.org/
    
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"7","type":"x","order":"1","pct":58.33,"resources":[]},{"id":"88","title":"Should be more technical","votes":"3","type":"x","order":"2","pct":25,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"2","type":"x","order":"3","pct":16.67,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.