TUCoPS :: Linux :: Debian :: dsa-376.htm

exim - buffer overflow

Debian Security Advisory

DSA-376-2 exim -- buffer overflow

Date Reported:
04 Sep 2003
Affected Packages:
exim exim-tls
Vulnerable:
Yes
Security database references:
In Mitre's CVE dictionary: CAN-2003-0743.
More information:

A buffer overflow exists in exim, which is the standard mail transport agent in Debian. By supplying a specially crafted HELO or EHLO command, an attacker could cause a constant string to be written past the end of a buffer allocated on the heap. This vulnerability is not believed at this time to be exploitable to execute arbitrary code.

For the stable distribution (woody) this problem has been fixed in exim version 3.35-1woody2 and exim-tls version 3.35-3woody1.

For the unstable distribution (sid) this problem has been fixed in exim version 3.36-8. The unstable distribution does not contain an exim-tls package.

We recommend that you update your exim or exim-tls package.

Fixed in:

Debian GNU/Linux 3.0 (woody)

Source:
http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody2.dsc
http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody2.diff.gz
http://security.debian.org/pool/updates/main/e/exim/exim_3.35.orig.tar.gz
http://security.debian.org/pool/updates/main/e/exim-tls/exim-tls_3.35-3woody1.dsc
http://security.debian.org/pool/updates/main/e/exim-tls/exim-tls_3.35-3woody1.diff.gz
http://security.debian.org/pool/updates/main/e/exim-tls/exim-tls_3.35.orig.tar.gz
Alpha:
http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody2_alpha.deb
http://security.debian.org/pool/updates/main/e/exim/eximon_3.35-1woody2_alpha.deb
http://security.debian.org/pool/updates/main/e/exim-tls/exim-tls_3.35-3woody1_alpha.deb
ARM:
http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody2_arm.deb
http://security.debian.org/pool/updates/main/e/exim/eximon_3.35-1woody2_arm.deb
http://security.debian.org/pool/updates/main/e/exim-tls/exim-tls_3.35-3woody1_arm.deb
Intel IA-32:
http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody2_i386.deb
http://security.debian.org/pool/updates/main/e/exim/eximon_3.35-1woody2_i386.deb
http://security.debian.org/pool/updates/main/e/exim-tls/exim-tls_3.35-3woody1_i386.deb
Intel IA-64:
http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody2_ia64.deb
http://security.debian.org/pool/updates/main/e/exim/eximon_3.35-1woody2_ia64.deb
http://security.debian.org/pool/updates/main/e/exim-tls/exim-tls_3.35-3woody1_ia64.deb
HPPA:
http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody2_hppa.deb
http://security.debian.org/pool/updates/main/e/exim/eximon_3.35-1woody2_hppa.deb
http://security.debian.org/pool/updates/main/e/exim-tls/exim-tls_3.35-3woody1_hppa.deb
Motorola 680x0:
http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody2_m68k.deb
http://security.debian.org/pool/updates/main/e/exim/eximon_3.35-1woody2_m68k.deb
http://security.debian.org/pool/updates/main/e/exim-tls/exim-tls_3.35-3woody1_m68k.deb
Big endian MIPS:
http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody2_mips.deb
http://security.debian.org/pool/updates/main/e/exim/eximon_3.35-1woody2_mips.deb
http://security.debian.org/pool/updates/main/e/exim-tls/exim-tls_3.35-3woody1_mips.deb
Little endian MIPS:
http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody2_mipsel.deb
http://security.debian.org/pool/updates/main/e/exim/eximon_3.35-1woody2_mipsel.deb
http://security.debian.org/pool/updates/main/e/exim-tls/exim-tls_3.35-3woody1_mipsel.deb
PowerPC:
http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody2_powerpc.deb
http://security.debian.org/pool/updates/main/e/exim/eximon_3.35-1woody2_powerpc.deb
http://security.debian.org/pool/updates/main/e/exim-tls/exim-tls_3.35-3woody1_powerpc.deb
IBM S/390:
http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody2_s390.deb
http://security.debian.org/pool/updates/main/e/exim/eximon_3.35-1woody2_s390.deb
http://security.debian.org/pool/updates/main/e/exim-tls/exim-tls_3.35-3woody1_s390.deb
Sun Sparc:
http://security.debian.org/pool/updates/main/e/exim/exim_3.35-1woody2_sparc.deb
http://security.debian.org/pool/updates/main/e/exim/eximon_3.35-1woody2_sparc.deb
http://security.debian.org/pool/updates/main/e/exim-tls/exim-tls_3.35-3woody1_sparc.deb

MD5 checksums of the listed files are available in the original advisory.

MD5 checksums of the listed files are available in the original advisory.


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2024 AOH