Exim before 4.87.1 might allow remote attackers to obtain the private DKIM signing key via vectors related to log files and bounce messages.

This update for exim fixes the following issues :

Changes in exim :

  - specify users with ref:mail, to make them dynamic.
    (boo#1046971)

  - CVE-2017-1000369: Fixed memory leaks that could be     exploited to 'stack crash' local privilege escalation     (boo#1044692)

  - Require user(mail) group(mail) to meet new users     handling in TW.

  - Prerequire permissions (fixes rpmlint).

  - conditionally disable DANE on SuSE versions with OpenSSL     < 1.0

  - CVE-2016-1531: when installed setuid root, allows local     users to gain privileges via the perl_startup argument. 

  - CVE-2016-9963: DKIM information leakage (boo#1015930)



  - Makefile tuning :

  + add sqlite support

  + disable WITH_OLD_DEMIME

  + enable AUTH_CYRUS_SASL

  + enable AUTH_TLS

  + enable SYSLOG_LONG_LINES

  + enable SUPPORT_PAM

  + MAX_NAMED_LIST=64

  + enable EXPERIMENTAL_DMARC

  + enable EXPERIMENTAL_EVENT

  + enable EXPERIMENTAL_PROXY

  + enable EXPERIMENTAL_CERTNAMES

  + enable EXPERIMENTAL_DSN

  + enable EXPERIMENTAL_DANE

  + enable EXPERIMENTAL_SOCKS

  + enable EXPERIMENTAL_INTERNATIONAL

It was found that Exim leaked DKIM signing private keys to the 'mainlog' log file. As a result, an attacker with access to system log files could potentially access these leaked DKIM private keys.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3164-1 advisory.

    Bjoern Jacke discovered that Exim incorrectly handled DKIM keys. In certain configurations, private DKIM     signing keys could be leaked to the log files.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Exim project reports :

Exim leaks the private DKIM signing key to the log files.
Additionally, if the build option EXPERIMENTAL_DSN_INFO=yes is used, the key material is included in the bounce message.

Bjoern Jacke discovered that Exim, Debian's default mail transfer agent, may leak the private DKIM signing key to the log files if specific configuration options are met.

Bjoern Jacke discovered that Exim, Debian's default mail transfer agent, may leak the private DKIM signing key to the log files if specific configuration options are met.

For Debian 7 'Wheezy', these problems have been fixed in version 4.80-7+deb7u4.

We recommend that you upgrade your exim4 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
102834	openSUSE Security Update : exim (openSUSE-2017-980) (Stack Clash)	Nessus	SuSE Local Security Checks	high
97556	Amazon Linux AMI : exim (ALAS-2017-804)	Nessus	Amazon Linux Local Security Checks	medium
96336	Ubuntu 14.04 LTS / 16.04 LTS : Exim vulnerability (USN-3164-1)	Nessus	Ubuntu Local Security Checks	medium
96122	FreeBSD : exim -- DKIM private key leak (e7002b26-caaa-11e6-a76a-9f7324e5534e)	Nessus	FreeBSD Local Security Checks	medium
96104	Debian DSA-3747-1 : exim4 - security update	Nessus	Debian Local Security Checks	medium
96097	Debian DLA-762-1 : exim4 security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2016-9963

medium

Tenable Plugins

high

medium

medium

medium

medium

medium