Debian: exim buffer overflow vulnerability

    Date08 Sep 2003
    CategoryDebian
    2267
    Posted ByLinuxSecurity Advisories
    A buffer overflow exists in exim.
    
    - --------------------------------------------------------------------------
    Debian Security Advisory DSA 376-2                     This email address is being protected from spambots. You need JavaScript enabled to view it. 
    http://www.debian.org/security/                             Matt Zimmerman
    September 7th, 2003                      http://www.debian.org/security/faq
    - --------------------------------------------------------------------------
    
    Package        : exim exim-tls
    Vulnerability  : buffer overflow
    Problem-Type   : remote
    Debian-specific: no
    CVE Ids        : CAN-2003-0743
    
    A buffer overflow exists in exim, which is the standard mail transport
    agent in Debian.  By supplying a specially crafted HELO or EHLO
    command, an attacker could cause a constant string to be written past
    the end of a buffer allocated on the heap.  This vulnerability is not
    believed at this time to be exploitable to execute arbitrary code.
    
    The exim package included in the previous advisory contained some
    documentation files which were installed with incorrect permissions.
    This problem is fixed in exim 3.35-1woody2.
    
    For the stable distribution (woody) this problem has been fixed in
    exim version 3.35-1woody2 and exim-tls version 3.35-3woody1.
    
    For the unstable distribution (sid) this problem has been fixed in
    exim version 3.36-8.  The unstable distribution does not contain an
    exim-tls package.
    
    We recommend that you update your exim or exim-tls package.
    
    Upgrade Instructions
    - --------------------
    
    wget url
            will fetch the file for you
    dpkg -i file.deb
            will install the referenced file.
    
    If you are using the apt-get package manager, use the line for
    sources.list as given below:
    
    apt-get update
            will update the internal database
    apt-get upgrade
            will install corrected packages
    
    You may use an automated update by adding the resources from the
    footer to the proper configuration.
    
    Debian GNU/Linux 3.0 alias woody
    - --------------------------------
    
      Source archives:
    
         http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody2.dsc
          Size/MD5 checksum:      661 26b678a3008cfc4137828ed87854a68b
         http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody2.diff.gz
          Size/MD5 checksum:    79356 4fbc522328ef3457849392aa962ee158
         http://security.debian.org/pool/updates/main/e/exim/exim_3.35.orig.tar.gz
          Size/MD5 checksum:  1271057 42d362e40a21bd7ffc298f92c8bd986a
         http://security.debian.org/pool/updates/main/e/exim-tls/exim-tls_3.35-3woody1.dsc
          Size/MD5 checksum:      677 efc414eda2eaf3b739c0ff1d0ce1ce08
         http://security.debian.org/pool/updates/main/e/exim-tls/exim-tls_3.35-3woody1.diff.gz
          Size/MD5 checksum:    79663 3b0ffcb9a0c4662ba908f622e6bc6923
         http://security.debian.org/pool/updates/main/e/exim-tls/exim-tls_3.35.orig.tar.gz
          Size/MD5 checksum:  1271057 42d362e40a21bd7ffc298f92c8bd986a
    
      Alpha architecture:
    
         http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody2_alpha.deb
          Size/MD5 checksum:   872552 63ce5094ddee06b513ff435e0ee0f1a1
         http://security.debian.org/pool/updates/main/e/exim/eximon_3.35-1woody2_alpha.deb
          Size/MD5 checksum:    52316 35227547daebb787fa6ad8a4c7b7de4d
         http://security.debian.org/pool/updates/main/e/exim-tls/exim-tls_3.35-3woody1_alpha.deb
          Size/MD5 checksum:   873212 19bba89ff92748d38fc68a667474ed35
    
      ARM architecture:
    
         http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody2_arm.deb
          Size/MD5 checksum:   785618 c1892595d4ac8b0dd3e7ce9b26a088bf
         http://security.debian.org/pool/updates/main/e/exim/eximon_3.35-1woody2_arm.deb
          Size/MD5 checksum:    43510 ee93deb829c75498646888e96efe79dc
         http://security.debian.org/pool/updates/main/e/exim-tls/exim-tls_3.35-3woody1_arm.deb
          Size/MD5 checksum:   783822 4a14319839d9f01dd2be37e047fd6d66
    
      Intel IA-32 architecture:
    
         http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody2_i386.deb
          Size/MD5 checksum:   758888 1a754baf670f98a0588cdf0f25faf52f
         http://security.debian.org/pool/updates/main/e/exim/eximon_3.35-1woody2_i386.deb
          Size/MD5 checksum:    39204 0a1f04494167f1c9a8d2f4a1fc7409c6
         http://security.debian.org/pool/updates/main/e/exim-tls/exim-tls_3.35-3woody1_i386.deb
          Size/MD5 checksum:   759152 ad293a317eb4ee7bccffff05a425156e
    
      Intel IA-64 architecture:
    
         http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody2_ia64.deb
          Size/MD5 checksum:   972522 c092722374ddcaf685ffa76dc5d8b9a1
         http://security.debian.org/pool/updates/main/e/exim/eximon_3.35-1woody2_ia64.deb
          Size/MD5 checksum:    65168 28329a2b344088598566c6b6a6e8a10a
         http://security.debian.org/pool/updates/main/e/exim-tls/exim-tls_3.35-3woody1_ia64.deb
          Size/MD5 checksum:   973764 ee164461e235691d1ebbd5499535bb23
    
      HP Precision architecture:
    
         http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody2_hppa.deb
          Size/MD5 checksum:   814974 5aeed1d898554bde0ddeb65e05172229
         http://security.debian.org/pool/updates/main/e/exim/eximon_3.35-1woody2_hppa.deb
          Size/MD5 checksum:    48282 4df870c3013b57437157b4796285ca08
         http://security.debian.org/pool/updates/main/e/exim-tls/exim-tls_3.35-3woody1_hppa.deb
          Size/MD5 checksum:   813986 5b98643ddca3a563c0f35702533abec7
    
      Motorola 680x0 architecture:
    
         http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody2_m68k.deb
          Size/MD5 checksum:   737684 f03d8c7db3d1829563359cb4801834c4
         http://security.debian.org/pool/updates/main/e/exim/eximon_3.35-1woody2_m68k.deb
          Size/MD5 checksum:    37766 8c717d391f22e15369bedb58c84b0b2b
         http://security.debian.org/pool/updates/main/e/exim-tls/exim-tls_3.35-3woody1_m68k.deb
          Size/MD5 checksum:   736502 387d9a32b505ec7f3e8cedad5390095a
    
      Big endian MIPS architecture:
    
         http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody2_mips.deb
          Size/MD5 checksum:   824182 057be740675f12ddede719b5e153c856
         http://security.debian.org/pool/updates/main/e/exim/eximon_3.35-1woody2_mips.deb
          Size/MD5 checksum:    48878 9ad962d4376d745d01647d3ff8d84455
         http://security.debian.org/pool/updates/main/e/exim-tls/exim-tls_3.35-3woody1_mips.deb
          Size/MD5 checksum:   824072 068d46cc7be1f70e369795eed39a5e2c
    
      Little endian MIPS architecture:
    
         http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody2_mipsel.deb
          Size/MD5 checksum:   824412 a3bdb11188295320929fafe50062d6f5
         http://security.debian.org/pool/updates/main/e/exim/eximon_3.35-1woody2_mipsel.deb
          Size/MD5 checksum:    48772 e071d683f83aab5ac7712f4409a92d2e
         http://security.debian.org/pool/updates/main/e/exim-tls/exim-tls_3.35-3woody1_mipsel.deb
          Size/MD5 checksum:   824764 dc94f41f414b487a5fb242abf1691c71
    
      PowerPC architecture:
    
         http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody2_powerpc.deb
          Size/MD5 checksum:   793784 5f8b069857c23ad7d8ce8840ac38748f
         http://security.debian.org/pool/updates/main/e/exim/eximon_3.35-1woody2_powerpc.deb
          Size/MD5 checksum:    44786 9a7d8556f44fb9995f1928e5625161fa
         http://security.debian.org/pool/updates/main/e/exim-tls/exim-tls_3.35-3woody1_powerpc.deb
          Size/MD5 checksum:   792296 a8e7e8d5c05ad550d02ebed47ec98ee8
    
      IBM S/390 architecture:
    
         http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody2_s390.deb
          Size/MD5 checksum:   779680 a4196fb3142aa9baaa6ac7b18a7ff812
         http://security.debian.org/pool/updates/main/e/exim/eximon_3.35-1woody2_s390.deb
          Size/MD5 checksum:    43926 954cd43dcfec0f95922e5b354cad94d5
         http://security.debian.org/pool/updates/main/e/exim-tls/exim-tls_3.35-3woody1_s390.deb
          Size/MD5 checksum:   778952 a1f2ada573819be4637929c3763a6193
    
      Sun Sparc architecture:
    
         http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody2_sparc.deb
          Size/MD5 checksum:   784988 e19c2e5ef5c5d8d52ec9e977eefd9380
         http://security.debian.org/pool/updates/main/e/exim/eximon_3.35-1woody2_sparc.deb
          Size/MD5 checksum:    42434 6e0dcc3ae42401f938ea132a7fbe75e5
         http://security.debian.org/pool/updates/main/e/exim-tls/exim-tls_3.35-3woody1_sparc.deb
          Size/MD5 checksum:   782482 4ae58125f8e4daea23660df37e867c14
    
      These files will probably be moved into the stable distribution on
      its next revision.
    
    - ---------------------------------------------------------------------------------
    For apt-get: deb  http://security.debian.org/ stable/updates main
    For dpkg-ftp:  ftp://security.debian.org/debian-security dists/stable/updates/main
    Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.
    Package info: `apt-cache show ' and  http://packages.debian.org/
    
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"25","type":"x","order":"1","pct":54.35,"resources":[]},{"id":"88","title":"Should be more technical","votes":"5","type":"x","order":"2","pct":10.87,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"16","type":"x","order":"3","pct":34.78,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.