Stack-based buffer overflow in Exim 4 before 4.33, when the headers_check_syntax option is enabled, allows remote attackers to cause a denial of service and possibly execute arbitrary code during the header check.

A remote exploitable buffer overflow has been discovered in exim when verify = header_syntax is used in the configuration file. This does not affect the default configuration.

Georgi Guninski discovered two stack-based buffer overflows in exim and exim-tls. They cannot be exploited with the default configuration from the Debian system, though. The Common Vulnerabilities and Exposures project identifies the following problems that are fixed with this update :

  - CAN-2004-0399     When 'sender_verify = true' is configured in exim.conf a     buffer overflow can happen during verification of the     sender. This problem is fixed in exim 4.

  - CAN-2004-0400

    When headers_check_syntax is configured in exim.conf a     buffer overflow can happen during the header check. This     problem does also exist in exim 4.

Georgi Guninski discovered two stack-based buffer overflows. They can not be exploited with the default configuration from the Debian system, though. The Common Vulnerabilities and Exposures project identifies the following problems that are fixed with this update :

  - CAN-2004-0399     When 'sender_verify = true' is configured in exim.conf a     buffer overflow can happen during verification of the     sender. This problem is fixed in exim 4.

  - CAN-2004-0400

    When headers_check_syntax is configured in exim.conf a     buffer overflow can happen during the header check. This     problem does also exist in exim 4.

The remote host is affected by the vulnerability described in GLSA-200405-07 (Exim verify=header_syntax buffer overflow)

    When the option 'verify = header_syntax' is used in an ACL in the     configuration file, Exim is vulnerable to a buffer overflow attack that can     be triggered remotely by sending malicious headers in an email message.
    Note that this option is not enabled in Exim's default configuration file.
  Impact :

    This vulnerability can be exploited to trigger a denial of service attack     and potentially execute arbitrary code with the rights of the user used by     the Exim daemon (by default this is the 'mail' user in Gentoo Linux).
  Workaround :

    Make sure the verify=header_syntax option is not used in your exim.conf     file.

The remote version of Exim has multiple remote stack-based buffer overflow vulnerabilities when header syntax checking is enabled. It should be noted that this is not the default configuration. A remote attacker could exploit this to execute arbitrary code.

ID	Name	Product	Family	Severity
36893	FreeBSD : exim buffer overflow when verify = header_syntax is used (5f29c2e4-9f6a-11d8-abbc-00e08110b673)	Nessus	FreeBSD Local Security Checks	high
15339	Debian DSA-502-1 : exim-tls - buffer overflow	Nessus	Debian Local Security Checks	high
15338	Debian DSA-501-1 : exim - buffer overflow	Nessus	Debian Local Security Checks	high
14493	GLSA-200405-07 : Exim verify=header_syntax buffer overflow	Nessus	Gentoo Local Security Checks	high
12232	Exim < 3.36 / 4.33 Multiple Remote Overflows	Nessus	SMTP problems	medium

Detections

Analytics

CVE-2004-0400

critical

Tenable Plugins

high

high

high

high

medium