Ubuntu 12.04: USN-1747-1 High: Bind Remote Exploit Vulnerability

ubuntu

May 10, 2011

Exim could be made to run arbitrary code under some conditions.

Summary

Exim could be made to run arbitrary code under some conditions.

Software Description:

- exim4: Exim mail transfer agent

Details:

It was discovered that the Exim daemon did not correctly handle format

strings in DKIM headers. An unauthenticated remote attacker could send

specially crafted email to run arbitrary code as the Exim user. The

default compiler options for affected releases reduces the vulnerability

to a denial of service under most conditions.

Topics Covered

security advisory exim DoS Ubuntu update instructions arbitrary code exim4

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 11.04:
  exim4-daemon-custom             4.74-1ubuntu1.1
  exim4-daemon-heavy              4.74-1ubuntu1.1
  exim4-daemon-light              4.74-1ubuntu1.1

Ubuntu 10.10:
  exim4-daemon-custom             4.72-1ubuntu1.2
  exim4-daemon-heavy              4.72-1ubuntu1.2
  exim4-daemon-light              4.72-1ubuntu1.2

Ubuntu 10.04 LTS:
  exim4-daemon-custom             4.71-3ubuntu1.2
  exim4-daemon-heavy              4.71-3ubuntu1.2
  exim4-daemon-light              4.71-3ubuntu1.2

In general, a standard system update will make all the necessary changes.