Exim 4.70 - 4.80 DKIM DNS Record Parsing Remote Buffer Overflow

This script is Copyright (C) 2012-2014 Tenable Network Security, Inc.


Synopsis :

The remote mail server is potentially affected by a buffer overflow
vulnerability.

Description :

According to its banner, the version of Exim running on the remote host
is between 4.70 and 4.80 inclusive. It therefore is potentially
affected by a remote, heap-based buffer overflow vulnerability when
decoding DKIM (DomainKeys Identified Mail) DNS records that can be
triggered by a specially crafted email sent from a domain under the
attacker's control.

By exploiting this flaw, a remote, unauthenticated attacker could
execute arbitrary code on the remote host subject to the privileges of
the user running the affected application.

Note that this issue is only exploitable when exim is built with DKIM
support, which is true by default, and has not been disabled. Note too
that Nessus has not checked whether either condition is true.

See also :

ftp://ftp.exim.org/pub/exim/ChangeLogs/ChangeLog-4.80.1
https://lists.exim.org/lurker/message/20121026.080330.74b9147b.en.html

Solution :

Upgrade to Exim 4.80.1 or later.

Risk factor :

High / CVSS Base Score : 7.5
(CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS Temporal Score : 6.5
(CVSS2#E:ND/RL:OF/RC:C)
Public Exploit Available : false

Family: SMTP problems

Nessus Plugin ID: 62734 ()

Bugtraq ID: 56285

CVE ID: CVE-2012-5671