Linux Security
    Linux Security
    Linux Security

    Debian: 'exim' remote format string attack

    Date
    2949
    Posted By
    Megyer Laszlo found a printf format bug in the exim mail transferagent. The code that checks the header syntax of an email logsan error without protecting itself against printf format attacks.
    
    ------------------------------------------------------------------------
    Debian Security Advisory DSA-058-1                   This email address is being protected from spambots. You need JavaScript enabled to view it. 
    https://www.debian.org/security/                         Wichert Akkerman
    June 10, 2001
    ------------------------------------------------------------------------
    
    
    Package        : exim
    Problem type   : remote printf format attack
    Debian-specific: no
    
    Megyer Laszlo found a printf format bug in the exim mail transfer
    agent. The code that checks the header syntax of an email logs
    an error without protecting itself against printf format attacks.
    
    This problem has been fixed in version 3.12-10.1. Since that code is
    not turned on by default a standard installation is not vulnerable,
    but we still recommend to upgrade your exim package.
    
    wget url
            will fetch the file for you
    dpkg -i file.deb
            will install the referenced file.
    
    
    Debian GNU/Linux 2.2 alias potato
    ---------------------------------
    
      Potato was released for alpha, arm, i386, m68k, powerpc and sparc.
    
      Source archives:
        
    https://security.debian.org/dists/stable/updates/main/source/exim_3.12-10.1.diff.gz
          MD5 checksum: 959d5e70c78dd0f8daf1bcb470d2851a
        
    https://security.debian.org/dists/stable/updates/main/source/exim_3.12-10.1.dsc
          MD5 checksum: c3ae78797cc1da77b074b91c80f21fc8
        
    https://security.debian.org/dists/stable/updates/main/source/exim_3.12.orig.tar.gz
          MD5 checksum: 336cd605cb121703af4f22a8c34bb333
    
      ARM architecture:
        
    https://security.debian.org/dists/stable/updates/main/binary-arm/exim_3.12-10.1_arm.deb
          MD5 checksum: 8553e97eef733ab850eba6926bead792
       https://security.debian.org/dists/stable/updates/main/binary-arm/eximon_3.12-10.1_arm.deb
          MD5 checksum: 2b56110866983b0bc4828bc0e4b0b7bd
    
      Alpha architecture:
        
    https://security.debian.org/dists/stable/updates/main/binary-alpha/exim_3.12-10.1_alpha.deb
          MD5 checksum: 5e304c46581e3a1e6278b6a677b8308d
        
    https://security.debian.org/dists/stable/updates/main/binary-alpha/eximon_3.12-10.1_alpha.deb
          MD5 checksum: b01e0f2d7986475eba02c280f5321cf2
    
      Intel IA-32 architecture:
        
    https://security.debian.org/dists/stable/updates/main/binary-i386/exim_3.12-10.1_i386.deb
          MD5 checksum: d7e4c6e286fae05abfce28841dc0530e
        
    https://security.debian.org/dists/stable/updates/main/binary-i386/eximon_3.12-10.1_i386.deb
          MD5 checksum: 9dc3b11692b7047fef58c5a8da7741d8
    
      Motorola 680x0 architecture:
        
    https://security.debian.org/dists/stable/updates/main/binary-m68k/exim_3.12-10.1_m68k.deb
          MD5 checksum: 56ccf16d58ce07217a12809fca325597
        
    https://security.debian.org/dists/stable/updates/main/binary-m68k/eximon_3.12-10.1_m68k.deb
          MD5 checksum: 8031e4a9a8a65a63fdc686e81af0b469
    
      PowerPC architecture:
        
    https://security.debian.org/dists/stable/updates/main/binary-powerpc/exim_3.12-10.1_powerpc.deb
          MD5 checksum: 925523b2d5cb6aa43d146aec7125d59c
        
    https://security.debian.org/dists/stable/updates/main/binary-powerpc/eximon_3.12-10.1_powerpc.deb
          MD5 checksum: 9fa51619d73061c7c221bb876bf65047
    
      Sun Sparc architecture:
        
    https://security.debian.org/dists/stable/updates/main/binary-sparc/exim_3.12-10.1_sparc.deb
          MD5 checksum: b13d02e8d2eb3542c8876f81051e29c7
         
    https://security.debian.org/dists/stable/updates/main/binary-sparc/eximon_3.12-10.1_sparc.deb
          MD5 checksum: ae8d1ac5b1b228deea25ba8a89c77d21
    
      These packages will be moved into the stable distribution on its next
      revision.
    
    For not yet released architectures please refer to the appropriate
    directory  ftp://ftp.debian.org/debian/dists/sid/binary-$arch/ .
    
    --
    ----------------------------------------------------------------------------
    apt-get: deb  https://security.debian.org/ stable/updates main
    dpkg-ftp:  ftp://security.debian.org/debian-security dists/stable/updates/main
    Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.
    
    
    
    

    LinuxSecurity Poll

    Have you ever used tcpdump for network troubleshooting or debugging?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 2 answer(s).
    /main-polls/36-have-you-ever-used-tcpdump-for-network-troubleshooting-or-debugging?task=poll.vote&format=json
    36
    radio
    [{"id":"125","title":"Yes","votes":"45","type":"x","order":"1","pct":83.33,"resources":[]},{"id":"126","title":"No ","votes":"9","type":"x","order":"2","pct":16.67,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350


    VIEW MORE POLLS

    bottom 200

    Please enable / Bitte aktiviere JavaScript!
    Veuillez activer / Por favor activa el Javascript![ ? ]

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.