Exim: heap overflow in string_vformat() [CVE-2019-16928]

wattie

Verified User
Joined
May 31, 2008
Messages
997
Location
Bulgaria
It is highly unlikely to become remote code execution; however it may still crash the server which is not ok! Definitely waiting for a patch.
 

CrazyFrog

New member
Joined
Aug 28, 2019
Messages
3
Exim update has been released. Hoping for a Custombuild update...

** Exim 4.92.3 released (security release) **

CVE ID: CVE-2019-16928
Date: 2019-09-27 (CVE assigned)
Version(s): from 4.92 up to and including 4.92.2
Reporter: QAX-A-TEAM <areuu@outlook.com>
Reference: https://bugs.exim.org/show_bug.cgi?id=2449
Issue: Heap-based buffer overflow in string_vformat,
remote code execution seems to be possible

Conditions to be vulnerable
===========================

All versions from (and including) 4.92 up to (and including) 4.92.2 are
vulnerable.

Details
=======

There is a heap-based buffer overflow in string_vformat (string.c).
The currently known exploit uses a extraordinary long EHLO string to
crash the Exim process that is receiving the message. While at this
mode of operation Exim already dropped its privileges, other paths to
reach the vulnerable code may exist.

Mitigation
==========

There is - beside updating the server - no known mitigation.

Fix
===

Download and build the fixed version 4.92.3

Tarballs: https://ftp.exim.org/pub/exim/exim4/
Git: https://github.com/Exim/exim.git (mirror)
git://git.exim.org/exim.git
- tag exim-4.92.3
- branch exim-4.92.3+fixes

The tagged commit is the officially released version. The +fixes branch
isn't officially maintained, but contains the security fix *and* useful
fixes.

The tarballs, the Git tag, and the Git commits are signed with my GPG
key (same as I used to sign this mail.)

If you can't install the above versions, ask your package maintainer for
a version containing the backported fix. On request and depending on our
resources we will support you in backporting the fix. (Please note,
the Exim project officially doesn't support versions prior the current
stable version.)

Timeline
=========

- 2019-09-27 Report as Bug 2499
- 2019-09-28 Announcement to exim-maintainers, oss-security
- 2019-09-28 Release 4.92.3, Release-Announcements to
exim-{announce,users,maintainers}, oss-security
 

DirectAdmin Support

Administrator
Staff member
Joined
Feb 27, 2003
Messages
8,927
Hello,

files.directadmin.com was updated earlier today with the update.
Allow up to 24 hours for other mirrors to update.

John
 

DirectAdmin Support

Administrator
Staff member
Joined
Feb 27, 2003
Messages
8,927
Thanks, this bump notified me about the FreeBSD issue. I've replied in the other thread.
John
 
Top