Exim string_format Function Remote Overflow

High Nessus Plugin ID 51179

New! Vulnerability Priority Rating (VPR)

Tenable calculates a dynamic VPR for every vulnerability. VPR combines vulnerability information with threat intelligence and machine learning algorithms to predict which vulnerabilities are most likely to be exploited in attacks. Read more about what VPR is and how it's different from CVSS.

VPR Score: 7.4

Synopsis

The remote service has a buffer overflow.

Description

A heap overflow vulnerability exists in the version of exim installed on the remote host.

By sending a specially crafted message to the server, a remote attacker can leverage this vulnerability to execute arbitrary code on the server with the privilege of the exim server. A separate vulnerability that Nessus didn't test for, CVE-2010-4345, is often used to elevate the exim user to root access.

Note that Nessus checked for this vulnerability by sending a specially crafted packet and checking the response, without crashing the service.

All 4.6x versions 4.69-9 and below are known to be affected, and others may be as well.

Solution

Upgrade to version 4.70 as it addresses the issue.

See Also

https://bugs.exim.org/show_bug.cgi?id=787

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=606612

https://lists.exim.org/lurker/message/20101207.215955.bb32d4f2.en.html

Plugin Details

Severity: High

ID: 51179

File Name: exim_string_vformat.nasl

Version: 1.17

Type: remote

Published: 2010/12/15

Updated: 2018/11/15

Dependencies: 10263

Risk Information

Risk Factor: High

VPR Score: 7.4

CVSS v2.0

Base Score: 7.5

Temporal Score: 6.2

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Temporal Vector: CVSS2#E:F/RL:OF/RC:C

CVSS v3.0

Base Score: 8.8

Temporal Score: 8.2

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:exim:exim

Exploit Available: true

Exploit Ease: Exploits are available

Exploited by Nessus: true

Patch Publication Date: 2008/12/08

Vulnerability Publication Date: 2010/12/10

Exploitable With

CANVAS (CANVAS)

Core Impact

Metasploit (Exim4 string_format Function Heap Buffer Overflow)

Reference Information

CVE: CVE-2010-4344

BID: 45308