Important: exim

2023-10-1215:48:00

alas.aws.amazon.com

exim

smtp

buffer overflow

rce

vulnerability

update

i686

x86_64

red hat

mitre

unix

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

28.8%

JSON

Issue Overview:

Exim SMTP Challenge Stack-based Buffer Overflow Remote Code Execution Vulnerability

NOTE: https://www.zerodayinitiative.com/advisories/ZDI-23-1470/ (CVE-2023-42116)

Exim Improper Neutralization of Special Elements Remote Code Execution Vulnerability

NOTE: https://www.zerodayinitiative.com/advisories/ZDI-23-1471/ (CVE-2023-42117)

Affected Packages:

exim

Issue Correction:
Run yum update exim to update your system.

New Packages:

i686:  
    exim-pgsql-4.92-1.39.amzn1.i686  
    exim-debuginfo-4.92-1.39.amzn1.i686  
    exim-mon-4.92-1.39.amzn1.i686  
    exim-mysql-4.92-1.39.amzn1.i686  
    exim-greylist-4.92-1.39.amzn1.i686  
    exim-4.92-1.39.amzn1.i686  
  
src:  
    exim-4.92-1.39.amzn1.src  
  
x86_64:  
    exim-4.92-1.39.amzn1.x86_64  
    exim-mon-4.92-1.39.amzn1.x86_64  
    exim-mysql-4.92-1.39.amzn1.x86_64  
    exim-pgsql-4.92-1.39.amzn1.x86_64  
    exim-debuginfo-4.92-1.39.amzn1.x86_64  
    exim-greylist-4.92-1.39.amzn1.x86_64

Additional References

Red Hat: CVE-2023-42116, CVE-2023-42117

Mitre: CVE-2023-42116, CVE-2023-42117

OSVersionArchitecturePackageVersionFilename
Amazon Linux1i686exim-pgsql< 4.92-1.39.amzn1exim-pgsql-4.92-1.39.amzn1.i686.rpm
Amazon Linux1i686exim-debuginfo< 4.92-1.39.amzn1exim-debuginfo-4.92-1.39.amzn1.i686.rpm
Amazon Linux1i686exim-mon< 4.92-1.39.amzn1exim-mon-4.92-1.39.amzn1.i686.rpm
Amazon Linux1i686exim-mysql< 4.92-1.39.amzn1exim-mysql-4.92-1.39.amzn1.i686.rpm
Amazon Linux1i686exim-greylist< 4.92-1.39.amzn1exim-greylist-4.92-1.39.amzn1.i686.rpm
Amazon Linux1i686exim< 4.92-1.39.amzn1exim-4.92-1.39.amzn1.i686.rpm
Amazon Linux1x86_64exim< 4.92-1.39.amzn1exim-4.92-1.39.amzn1.x86_64.rpm
Amazon Linux1x86_64exim-mon< 4.92-1.39.amzn1exim-mon-4.92-1.39.amzn1.x86_64.rpm
Amazon Linux1x86_64exim-mysql< 4.92-1.39.amzn1exim-mysql-4.92-1.39.amzn1.x86_64.rpm
Amazon Linux1x86_64exim-pgsql< 4.92-1.39.amzn1exim-pgsql-4.92-1.39.amzn1.x86_64.rpm

OS	Version	Architecture	Package	Version	Filename
Amazon Linux	1	i686	exim-pgsql	< 4.92-1.39.amzn1	exim-pgsql-4.92-1.39.amzn1.i686.rpm
Amazon Linux	1	i686	exim-debuginfo	< 4.92-1.39.amzn1	exim-debuginfo-4.92-1.39.amzn1.i686.rpm
Amazon Linux	1	i686	exim-mon	< 4.92-1.39.amzn1	exim-mon-4.92-1.39.amzn1.i686.rpm
Amazon Linux	1	i686	exim-mysql	< 4.92-1.39.amzn1	exim-mysql-4.92-1.39.amzn1.i686.rpm
Amazon Linux	1	i686	exim-greylist	< 4.92-1.39.amzn1	exim-greylist-4.92-1.39.amzn1.i686.rpm
Amazon Linux	1	i686	exim	< 4.92-1.39.amzn1	exim-4.92-1.39.amzn1.i686.rpm
Amazon Linux	1	x86_64	exim	< 4.92-1.39.amzn1	exim-4.92-1.39.amzn1.x86_64.rpm
Amazon Linux	1	x86_64	exim-mon	< 4.92-1.39.amzn1	exim-mon-4.92-1.39.amzn1.x86_64.rpm
Amazon Linux	1	x86_64	exim-mysql	< 4.92-1.39.amzn1	exim-mysql-4.92-1.39.amzn1.x86_64.rpm
Amazon Linux	1	x86_64	exim-pgsql	< 4.92-1.39.amzn1	exim-pgsql-4.92-1.39.amzn1.x86_64.rpm