Bug 144099 - CAN-2005-0021 exim security issues (CAN-2005-0022)
CAN-2005-0021 exim security issues (CAN-2005-0022)
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 4
Classification: Red Hat
Component: exim (Show other bugs)
4.0
All Linux
medium Severity medium
: ---
: ---
Assigned To: Thomas Woerner
http://www.exim.org/mail-archives/exi...
impact=moderate,public=20050104
: Security
Depends On:
Blocks: 142822
  Show dependency treegraph
 
Reported: 2005-01-04 10:45 EST by David Woodhouse
Modified: 2007-11-30 17:07 EST (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2005-02-15 03:27:24 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description David Woodhouse 2005-01-04 10:45:03 EST
Discussion of security issues
- -----------------------------

1. The function host_aton() can overflow a buffer if it is presented
with an 
   illegal IPv6 address that has more than 8 components. The input to
this 
   function is supposed to be checked; the report said that an
unchecked value 
   could be passed via the command line (without specifying which
command line 
   option, annoyingly). I found one such case, which was a call do a dnsdb
   lookup for a PTR record, as part of testing expansions using -be.
The first
   patch below fixes this - as it happens, this change had already
been made to
   the current source. 
   
   The report stated that Exim was running as "exim" when the problem
occurred:
   with -be, Exim runs as the calling user. Therefore, either the
report was
   wrong, or there is another case that I could not find. However, if
there is
   another case, it will now be covered by the second patch below,
which puts a
   test into the host_aton() function itself. (This should, of course,
have
   been there all the time, as a bit of defensive programming, but
hey, I'm
   only human. :-)

2. The second report described a buffer overflow in the function 
   spa_base64_to_bits(), which is part of the code for SPA
authentication. This 
   code originated in the Samba project. The overflow can be exploited
only if 
   you are using SPA authentication. The remaining patches below fix this 
   problem by adding a buffer length parameter to the problem
function. I have 
   tested that SPA authentication still works, but I don't have the
tools to 
   test that an attempt to exploit the overflow is now detected.
Comment 4 Mark J. Cox (Product Security) 2005-01-05 03:56:01 EST
CAN-2005-0021 and CAN-2005-0022, this will be RHSA-2005:025
Comment 5 Jay Turner 2005-01-14 07:44:21 EST
Not quite sure why this is in modified, as it appears there are issues getting
the package built.  Flipping back to assigned until we have packages built with
the fix in them.
Comment 7 David Woodhouse 2005-01-14 09:32:53 EST
We have fixed packages built: 4.43-1.RHEL4.2
Comment 8 David Woodhouse 2005-01-17 05:31:03 EST
There was a problem with 4.43-1.RHEL4.2 -- the patch was present but not
applied. This is fixed in exim-4.43-1.RHEL4.3
Comment 9 Mark J. Cox (Product Security) 2005-02-15 03:27:24 EST
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2005-025.html

Note You need to log in before you can comment on or make changes to this bug.