openSUSE Security Update : exim (openSUSE-2017-980) (Stack Clash)
high Nessus Plugin ID 102834
Language:
New! Plugin Severity Now Using CVSS v3
The calculated severity for Plugins has been updated to use CVSS v3 by default. Plugins that do not have a CVSS v3 score will fall back to CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.
Synopsis
The remote openSUSE host is missing a security update.Description
This update for exim fixes the following issues :Changes in exim :
- specify users with ref:mail, to make them dynamic.
(boo#1046971)
- CVE-2017-1000369: Fixed memory leaks that could be exploited to 'stack crash' local privilege escalation (boo#1044692)
- Require user(mail) group(mail) to meet new users handling in TW.
- Prerequire permissions (fixes rpmlint).
- conditionally disable DANE on SuSE versions with OpenSSL < 1.0
- CVE-2016-1531: when installed setuid root, allows local users to gain privileges via the perl_startup argument.
- CVE-2016-9963: DKIM information leakage (boo#1015930)
- Makefile tuning :
+ add sqlite support
+ disable WITH_OLD_DEMIME
+ enable AUTH_CYRUS_SASL
+ enable AUTH_TLS
+ enable SYSLOG_LONG_LINES
+ enable SUPPORT_PAM
+ MAX_NAMED_LIST=64
+ enable EXPERIMENTAL_DMARC
+ enable EXPERIMENTAL_EVENT
+ enable EXPERIMENTAL_PROXY
+ enable EXPERIMENTAL_CERTNAMES
+ enable EXPERIMENTAL_DSN
+ enable EXPERIMENTAL_DANE
+ enable EXPERIMENTAL_SOCKS
+ enable EXPERIMENTAL_INTERNATIONAL
Solution
Update the affected exim packages.See Also
https://bugzilla.opensuse.org/show_bug.cgi?id=1015930
Plugin Details
Severity: High
ID: 102834
File Name: openSUSE-2017-980.nasl
Version: 3.4
Type: local
Agent: unix
Family: SuSE Local Security Checks
Published: 8/30/2017
Updated: 1/19/2021
Dependencies: ssh_get_info.nasl
Risk Information
VPR
Risk Factor: High
Score: 8.4
CVSS v2
Risk Factor: Medium
Base Score: 6.9
Temporal Score: 5.7
Vector: CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C
Temporal Vector: CVSS2#E:F/RL:OF/RC:C
CVSS v3
Risk Factor: High
Base Score: 7
Temporal Score: 6.5
Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C
Vulnerability Information
CPE: cpe:2.3:o:novell:opensuse:42.2:*:*:*:*:*:*:*, cpe:2.3:o:novell:opensuse:42.3:*:*:*:*:*:*:*, p-cpe:2.3:a:novell:opensuse:exim:*:*:*:*:*:*:*, p-cpe:2.3:a:novell:opensuse:exim-debuginfo:*:*:*:*:*:*:*, p-cpe:2.3:a:novell:opensuse:exim-debugsource:*:*:*:*:*:*:*, p-cpe:2.3:a:novell:opensuse:eximon:*:*:*:*:*:*:*, p-cpe:2.3:a:novell:opensuse:eximon-debuginfo:*:*:*:*:*:*:*, p-cpe:2.3:a:novell:opensuse:eximstats-html:*:*:*:*:*:*:*
Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 8/29/2017
Exploitable With
Core Impact