Debian: 'exim' remote format string attack

    Date12 Jun 2001
    CategoryDebian
    2520
    Posted ByLinuxSecurity Advisories
    Megyer Laszlo found a printf format bug in the exim mail transferagent. The code that checks the header syntax of an email logsan error without protecting itself against printf format attacks.
    
    ------------------------------------------------------------------------
    Debian Security Advisory DSA-058-1                   This email address is being protected from spambots. You need JavaScript enabled to view it. 
    http://www.debian.org/security/                         Wichert Akkerman
    June 10, 2001
    ------------------------------------------------------------------------
    
    
    Package        : exim
    Problem type   : remote printf format attack
    Debian-specific: no
    
    Megyer Laszlo found a printf format bug in the exim mail transfer
    agent. The code that checks the header syntax of an email logs
    an error without protecting itself against printf format attacks.
    
    This problem has been fixed in version 3.12-10.1. Since that code is
    not turned on by default a standard installation is not vulnerable,
    but we still recommend to upgrade your exim package.
    
    wget url
            will fetch the file for you
    dpkg -i file.deb
            will install the referenced file.
    
    
    Debian GNU/Linux 2.2 alias potato
    ---------------------------------
    
      Potato was released for alpha, arm, i386, m68k, powerpc and sparc.
    
      Source archives:
        
    http://security.debian.org/dists/stable/updates/main/source/exim_3.12-10.1.diff.gz
          MD5 checksum: 959d5e70c78dd0f8daf1bcb470d2851a
        
    http://security.debian.org/dists/stable/updates/main/source/exim_3.12-10.1.dsc
          MD5 checksum: c3ae78797cc1da77b074b91c80f21fc8
        
    http://security.debian.org/dists/stable/updates/main/source/exim_3.12.orig.tar.gz
          MD5 checksum: 336cd605cb121703af4f22a8c34bb333
    
      ARM architecture:
        
    http://security.debian.org/dists/stable/updates/main/binary-arm/exim_3.12-10.1_arm.deb
          MD5 checksum: 8553e97eef733ab850eba6926bead792
       http://security.debian.org/dists/stable/updates/main/binary-arm/eximon_3.12-10.1_arm.deb
          MD5 checksum: 2b56110866983b0bc4828bc0e4b0b7bd
    
      Alpha architecture:
        
    http://security.debian.org/dists/stable/updates/main/binary-alpha/exim_3.12-10.1_alpha.deb
          MD5 checksum: 5e304c46581e3a1e6278b6a677b8308d
        
    http://security.debian.org/dists/stable/updates/main/binary-alpha/eximon_3.12-10.1_alpha.deb
          MD5 checksum: b01e0f2d7986475eba02c280f5321cf2
    
      Intel IA-32 architecture:
        
    http://security.debian.org/dists/stable/updates/main/binary-i386/exim_3.12-10.1_i386.deb
          MD5 checksum: d7e4c6e286fae05abfce28841dc0530e
        
    http://security.debian.org/dists/stable/updates/main/binary-i386/eximon_3.12-10.1_i386.deb
          MD5 checksum: 9dc3b11692b7047fef58c5a8da7741d8
    
      Motorola 680x0 architecture:
        
    http://security.debian.org/dists/stable/updates/main/binary-m68k/exim_3.12-10.1_m68k.deb
          MD5 checksum: 56ccf16d58ce07217a12809fca325597
        
    http://security.debian.org/dists/stable/updates/main/binary-m68k/eximon_3.12-10.1_m68k.deb
          MD5 checksum: 8031e4a9a8a65a63fdc686e81af0b469
    
      PowerPC architecture:
        
    http://security.debian.org/dists/stable/updates/main/binary-powerpc/exim_3.12-10.1_powerpc.deb
          MD5 checksum: 925523b2d5cb6aa43d146aec7125d59c
        
    http://security.debian.org/dists/stable/updates/main/binary-powerpc/eximon_3.12-10.1_powerpc.deb
          MD5 checksum: 9fa51619d73061c7c221bb876bf65047
    
      Sun Sparc architecture:
        
    http://security.debian.org/dists/stable/updates/main/binary-sparc/exim_3.12-10.1_sparc.deb
          MD5 checksum: b13d02e8d2eb3542c8876f81051e29c7
         
    http://security.debian.org/dists/stable/updates/main/binary-sparc/eximon_3.12-10.1_sparc.deb
          MD5 checksum: ae8d1ac5b1b228deea25ba8a89c77d21
    
      These packages will be moved into the stable distribution on its next
      revision.
    
    For not yet released architectures please refer to the appropriate
    directory  ftp://ftp.debian.org/debian/dists/sid/binary-$arch/ .
    
    --
    ----------------------------------------------------------------------------
    apt-get: deb  http://security.debian.org/ stable/updates main
    dpkg-ftp:  ftp://security.debian.org/debian-security dists/stable/updates/main
    Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.
    
    
    
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"7","type":"x","order":"1","pct":58.33,"resources":[]},{"id":"88","title":"Should be more technical","votes":"3","type":"x","order":"2","pct":25,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"2","type":"x","order":"3","pct":16.67,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.