exim4 vulnerability

5 January 2017

exim4 vulnerability

A security issue affects these releases of Ubuntu and its derivatives:

• Ubuntu 16.10
• Ubuntu 16.04 LTS
• Ubuntu 14.04 LTS
• Ubuntu 12.04 LTS

Summary

Exim could be made to expose private DKIM signing keys.

Software Description

• exim4 - Exim is a mail transport agent

Details

Bjoern Jacke discovered that Exim incorrectly handled DKIM keys. In certain configurations, private DKIM signing keys could be leaked to the log files.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 16.10

exim4-daemon-heavy - 4.87-3ubuntu1.1

exim4-daemon-light - 4.87-3ubuntu1.1

Ubuntu 16.04 LTS

exim4-daemon-heavy - 4.86.2-2ubuntu2.1

exim4-daemon-light - 4.86.2-2ubuntu2.1

Ubuntu 14.04 LTS

exim4-daemon-heavy - 4.82-3ubuntu2.2

exim4-daemon-light - 4.82-3ubuntu2.2

Ubuntu 12.04 LTS

exim4-daemon-heavy - 4.76-3ubuntu3.4

exim4-daemon-light - 4.76-3ubuntu3.4

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References

• CVE-2016-9963