exim4: Exploitable memory corruption vulnerability (CVE-2010-4344)

Debian Bug report logs - #606612
exim4: Exploitable memory corruption vulnerability (CVE-2010-4344)

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Dominic Hargreaves <dom@earth.li>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: exim4: Exploitable memory corruption vulnerability

Date: Fri, 10 Dec 2010 11:01:09 +0000

Package: exim4
Version: 4.69-9
Severity: critical
Tags: security
Justification: root security hole

There is a discussion on exim-dev[0] relating to an incident of root-level
compromise owing to a couple of bugs. The first (the remote attack)
appears[1] to be related to a bug already fixed in mainline[2].

[0] <http://www.exim.org/lurker/message/20101207.215955.bb32d4f2.en.html>
[1] <http://www.exim.org/lurker/message/20101210.071922.233697ac.en.html#exim-dev>
[2] <http://bugs.exim.org/show_bug.cgi?id=787>

I hadn't seen any response from any Debian people on this (publically
at least) so I thought it would be worth filing this bug, to make
sure the right people are aware of the issue.

Cheers,
Dominic.

Message #16 received at 606612@bugs.debian.org (full text, mbox, reply):

From: Dominic Hargreaves <dom@earth.li>

To: 606612@bugs.debian.org, 606527@bugs.debian.org

Subject: Re: Bug#606612: Acknowledgement (exim4: Exploitable memory corruption vulnerability)

Date: Fri, 10 Dec 2010 11:19:24 +0000

Julien, I just wanted to point out that there are two separate issues
here, and only one of them has been fixed in newer versions. #606527
relating to the root upgrade is AFAIK still an issue.

Dominic.

-- 
Dominic Hargreaves | http://www.larted.org.uk/~dom/
PGP key 5178E2A5 from the.earth.li (keyserver,web,email)

Message #25 received at 606612@bugs.debian.org (full text, mbox, reply):

From: Julien Cristau <jcristau@debian.org>

To: Dominic Hargreaves <dom@earth.li>, 606527@bugs.debian.org

Cc: 606612@bugs.debian.org

Subject: Re: Bug#606527: Bug#606612: Acknowledgement (exim4: Exploitable memory corruption vulnerability)

Date: Fri, 10 Dec 2010 12:28:28 +0100

[Message part 1 (text/plain, inline)]

On Fri, Dec 10, 2010 at 11:19:24 +0000, Dominic Hargreaves wrote:

> Julien, I just wanted to point out that there are two separate issues
> here, and only one of them has been fixed in newer versions. #606527
> relating to the root upgrade is AFAIK still an issue.
> 
Yeah sorry about that.  I think I've undone the wrong merge now.

Cheers,
Julien

[signature.asc (application/pgp-signature, inline)]

Message #34 received at 606612-done@bugs.debian.org (full text, mbox, reply):

From: Julien Cristau <jcristau@debian.org>

To: Dominic Hargreaves <dom@earth.li>, 606612-done@bugs.debian.org

Subject: Re: Bug#606612: exim4: Exploitable memory corruption vulnerability

Date: Fri, 10 Dec 2010 16:31:11 +0100

[Message part 1 (text/plain, inline)]

Version: 4.69-9+lenny1

On Fri, Dec 10, 2010 at 11:01:09 +0000, Dominic Hargreaves wrote:

> Package: exim4
> Version: 4.69-9
> Severity: critical
> Tags: security
> Justification: root security hole
> 
> There is a discussion on exim-dev[0] relating to an incident of root-level
> compromise owing to a couple of bugs. The first (the remote attack)
> appears[1] to be related to a bug already fixed in mainline[2].
> 
Fixed in DSA 2131-1.

Cheers,
Julien

[signature.asc (application/pgp-signature, inline)]

Send a report that this bug log contains spam.