{"hash": "81cda2d939b6d4b2b9410c8f9e53f3e56e7d0c05224ef4eb4e8e7c8ea69cfd1b", "id": "GLSA-201607-12", "lastseen": "2016-09-06T19:46:30", "viewCount": 4, "hashmap": [{"hash": "a4840bbf30f515966d522d6afac833e8", "key": "affectedPackage"}, {"hash": "4913a9178621eadcdf191db17915fbcb", "key": "bulletinFamily"}, {"hash": "89979583163c6e9f5d595be30e456ca3", "key": "cvelist"}, {"hash": "292f2e293571b0e70e3182b615982dad", "key": "cvss"}, {"hash": "06294f4529cbe32ccb2170b9595e11c8", "key": "description"}, {"hash": "b8468bf244feb99a7e6f1664486c02c1", "key": "href"}, {"hash": "917093a96e149eab7b511c24b475fe07", "key": "modified"}, {"hash": "777d45bbbcdf50d49c42c70ad7acf5fe", "key": "objectVersion"}, {"hash": "917093a96e149eab7b511c24b475fe07", "key": "published"}, {"hash": "1921220b2f04d098ee4f897aba85737f", "key": "references"}, {"hash": "ac1fd6b3deacaf22b54dd1934ae33181", "key": "reporter"}, {"hash": "57b76fe1ae1449421b46177c9510eb70", "key": "title"}, {"hash": "365d0fc7d6206ff26e2f2c2a78c91a94", "key": "type"}], "bulletinFamily": "unix", "cvss": {"vector": "AV:LOCAL/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/", "score": 4.6}, "edition": 1, "enchantments": {"score": {"value": 5.8, "vector": "NONE", "modified": "2016-09-06T19:46:30"}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2014-2972"]}, {"type": "nessus", "idList": ["ALA_ALAS-2014-395.NASL", "FEDORA_2014-8865.NASL", "GENTOO_GLSA-201607-12.NASL", "FEDORA_2014-8803.NASL", "EXIM_4_83.NASL", "UBUNTU_USN-2933-1.NASL", "OPENSUSE-2014-482.NASL"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310868054", "OPENVAS:1361412562310868048", "OPENVAS:1361412562310120245", "OPENVAS:1361412562310842695"]}, {"type": "amazon", "idList": ["ALAS-2014-395"]}, {"type": "ubuntu", "idList": ["USN-2933-1"]}], "modified": "2016-09-06T19:46:30"}, "vulnersScore": 5.8}, "type": "gentoo", "affectedPackage": [{"arch": "all", "packageFilename": "UNKNOWN", "OSVersion": "any", "operator": "lt", "packageName": "mail-mta/exim", "packageVersion": "4.87", "OS": "Gentoo"}], "description": "### Background\n\nExim is a message transfer agent (MTA) designed to be a a highly configurable, drop-in replacement for sendmail. \n\n### Description\n\nVulnerabilities have been discovered in Exim\u2019s implementation of set-uid root and when using \u2018perl_startup\u2019. These vulnerabilities require a user account on the Exim server and a configuration that does lookups against files to which the user has edit access. \n\n### Impact\n\nA local attacker could possibly execute arbitrary code with the privileges of the process, or escalate privileges. \n\n### Workaround\n\nThere is no known workaround at this time.\n\n### Resolution\n\nAll Exim users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=mail-mta/exim-4.87\"", "title": "Exim: Arbitrary code execution", "history": [], "objectVersion": "1.2", "cvelist": ["CVE-2014-2972"], "published": "2016-07-20T00:00:00", "references": ["https://bugs.gentoo.org/show_bug.cgi?id=517934", "http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2972", "https://bugs.gentoo.org/show_bug.cgi?id=576582"], "reporter": "Gentoo Foundation", "modified": "2016-07-20T00:00:00", "href": "https://security.gentoo.org/glsa/201607-12"}

{"cve": [{"lastseen": "2019-05-29T18:13:45", "bulletinFamily": "NVD", "description": "expand.c in Exim before 4.83 expands mathematical comparisons twice, which allows local users to gain privileges and execute arbitrary commands via a crafted lookup value.", "modified": "2016-12-03T03:01:00", "id": "CVE-2014-2972", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-2972", "published": "2014-09-04T17:55:00", "title": "CVE-2014-2972", "type": "cve", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}}], "nessus": [{"lastseen": "2019-02-21T01:22:32", "bulletinFamily": "scanner", "description": "expand.c in Exim before 4.83 expands mathematical comparisons twice, which allows local users to gain privileges and execute arbitrary commands via a crafted lookup value.", "modified": "2018-04-18T00:00:00", "id": "ALA_ALAS-2014-395.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=78338", "published": "2014-10-12T00:00:00", "title": "Amazon Linux AMI : exim (ALAS-2014-395)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Amazon Linux AMI Security Advisory ALAS-2014-395.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(78338);\n script_version(\"1.3\");\n script_cvs_date(\"Date: 2018/04/18 15:09:35\");\n\n script_cve_id(\"CVE-2014-2972\");\n script_xref(name:\"ALAS\", value:\"2014-395\");\n\n script_name(english:\"Amazon Linux AMI : exim (ALAS-2014-395)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Amazon Linux AMI host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"expand.c in Exim before 4.83 expands mathematical comparisons twice,\nwhich allows local users to gain privileges and execute arbitrary\ncommands via a crafted lookup value.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://alas.aws.amazon.com/ALAS-2014-395.html\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Run 'yum update exim' to update your system.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:exim\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:exim-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:exim-greylist\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:exim-mon\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:exim-mysql\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:amazon:linux:exim-pgsql\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:amazon:linux\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/08/21\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/10/12\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014-2018 Tenable Network Security, Inc.\");\n script_family(english:\"Amazon Linux Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/AmazonLinux/release\", \"Host/AmazonLinux/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/AmazonLinux/release\");\nif (isnull(release) || !strlen(release)) audit(AUDIT_OS_NOT, \"Amazon Linux\");\nos_ver = pregmatch(pattern: \"^AL(A|\\d)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Amazon Linux\");\nos_ver = os_ver[1];\nif (os_ver != \"A\")\n{\n if (os_ver == 'A') os_ver = 'AMI';\n audit(AUDIT_OS_NOT, \"Amazon Linux AMI\", \"Amazon Linux \" + os_ver);\n}\n\nif (!get_kb_item(\"Host/AmazonLinux/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (rpm_check(release:\"ALA\", reference:\"exim-4.72-6.6.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"exim-debuginfo-4.72-6.6.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"exim-greylist-4.72-6.6.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"exim-mon-4.72-6.6.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"exim-mysql-4.72-6.6.amzn1\")) flag++;\nif (rpm_check(release:\"ALA\", reference:\"exim-pgsql-4.72-6.6.amzn1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"exim / exim-debuginfo / exim-greylist / exim-mon / exim-mysql / etc\");\n}\n", "cvss": {"score": 4.6, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2019-02-21T01:22:13", "bulletinFamily": "scanner", "description": "Security fix for CVE-2014-2972\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "modified": "2018-12-05T00:00:00", "id": "FEDORA_2014-8865.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=76982", "published": "2014-08-04T00:00:00", "title": "Fedora 20 : exim-4.80.1-7.fc20 (2014-8865)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2014-8865.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(76982);\n script_version(\"1.5\");\n script_cvs_date(\"Date: 2018/12/05 20:31:22\");\n\n script_cve_id(\"CVE-2014-2972\");\n script_bugtraq_id(68857);\n script_xref(name:\"FEDORA\", value:\"2014-8865\");\n\n script_name(english:\"Fedora 20 : exim-4.80.1-7.fc20 (2014-8865)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Security fix for CVE-2014-2972\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1122552\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2014-August/136264.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?878f148a\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected exim package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:exim\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:20\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/07/25\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/08/04\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014-2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^20([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 20.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC20\", reference:\"exim-4.80.1-7.fc20\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"exim\");\n}\n", "cvss": {"score": 4.6, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2019-02-21T01:22:13", "bulletinFamily": "scanner", "description": "Security fix for CVE-2014-2972\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "modified": "2018-12-05T00:00:00", "id": "FEDORA_2014-8803.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=76981", "published": "2014-08-04T00:00:00", "title": "Fedora 19 : exim-4.80.1-4.fc19 (2014-8803)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2014-8803.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(76981);\n script_version(\"1.5\");\n script_cvs_date(\"Date: 2018/12/05 20:31:22\");\n\n script_cve_id(\"CVE-2014-2972\");\n script_bugtraq_id(68857);\n script_xref(name:\"FEDORA\", value:\"2014-8803\");\n\n script_name(english:\"Fedora 19 : exim-4.80.1-4.fc19 (2014-8803)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Security fix for CVE-2014-2972\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=1122552\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2014-August/136251.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?65188ee9\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected exim package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:exim\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:19\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/07/25\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/08/04\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014-2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^19([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 19.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC19\", reference:\"exim-4.80.1-4.fc19\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"exim\");\n}\n", "cvss": {"score": 4.6, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2019-02-21T01:27:28", "bulletinFamily": "scanner", "description": "The remote host is affected by the vulnerability described in GLSA-201607-12 (Exim: Arbitrary code execution)\n\n Vulnerabilities have been discovered in Exim&rsquo;s implementation of set-uid root and when using &lsquo;perl_startup&rsquo;. These vulnerabilities require a user account on the Exim server and a configuration that does lookups against files to which the user has edit access.\n Impact :\n\n A local attacker could possibly execute arbitrary code with the privileges of the process, or escalate privileges.\n Workaround :\n\n There is no known workaround at this time.", "modified": "2016-07-21T00:00:00", "id": "GENTOO_GLSA-201607-12.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=92482", "published": "2016-07-21T00:00:00", "title": "GLSA-201607-12 : Exim: Arbitrary code execution", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Gentoo Linux Security Advisory GLSA 201607-12.\n#\n# The advisory text is Copyright (C) 2001-2016 Gentoo Foundation, Inc.\n# and licensed under the Creative Commons - Attribution / Share Alike \n# license. See http://creativecommons.org/licenses/by-sa/3.0/\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(92482);\n script_version(\"$Revision: 2.1 $\");\n script_cvs_date(\"$Date: 2016/07/21 13:58:10 $\");\n\n script_cve_id(\"CVE-2014-2972\");\n script_xref(name:\"GLSA\", value:\"201607-12\");\n\n script_name(english:\"GLSA-201607-12 : Exim: Arbitrary code execution\");\n script_summary(english:\"Checks for updated package(s) in /var/db/pkg\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Gentoo host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The remote host is affected by the vulnerability described in GLSA-201607-12\n(Exim: Arbitrary code execution)\n\n Vulnerabilities have been discovered in Exim&rsquo;s implementation of\n set-uid root and when using &lsquo;perl_startup&rsquo;. These vulnerabilities\n require a user account on the Exim server and a configuration that does\n lookups against files to which the user has edit access.\n \nImpact :\n\n A local attacker could possibly execute arbitrary code with the\n privileges of the process, or escalate privileges.\n \nWorkaround :\n\n There is no known workaround at this time.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security.gentoo.org/glsa/201607-12\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"All Exim users should upgrade to the latest version:\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=mail-mta/exim-4.87'\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:gentoo:linux:exim\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:gentoo:linux\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/07/20\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/07/21\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2016 Tenable Network Security, Inc.\");\n script_family(english:\"Gentoo Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Gentoo/release\", \"Host/Gentoo/qpkg-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"qpkg.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Gentoo/release\")) audit(AUDIT_OS_NOT, \"Gentoo\");\nif (!get_kb_item(\"Host/Gentoo/qpkg-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (qpkg_check(package:\"mail-mta/exim\", unaffected:make_list(\"ge 4.87\"), vulnerable:make_list(\"lt 4.87\"))) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:qpkg_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = qpkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"Exim\");\n}\n", "cvss": {"score": 4.6, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2019-02-21T01:22:15", "bulletinFamily": "scanner", "description": "According to its banner, the version of Exim running on the remote host is prior to 4.83. It is, therefore, potentially affected by a data insertion vulnerability. A flaw exists in the expansion of arguments to math comparison functions which can cause values to be expanded twice. This could permit a local attacker to insert arbitrary data.", "modified": "2018-07-10T00:00:00", "id": "EXIM_4_83.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=77055", "published": "2014-08-07T00:00:00", "title": "Exim < 4.83 Math Comparison Functions Data Insertion", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(77055);\n script_version(\"1.2\");\n script_cvs_date(\"Date: 2018/07/10 14:27:33\");\n\n script_cve_id(\"CVE-2014-2972\");\n script_bugtraq_id(68857);\n\n script_name(english:\"Exim < 4.83 Math Comparison Functions Data Insertion\");\n script_summary(english:\"Checks the version of the SMTP banner.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote mail server is potentially affected by a data insertion\nvulnerability.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to its banner, the version of Exim running on the remote\nhost is prior to 4.83. It is, therefore, potentially affected by a\ndata insertion vulnerability. A flaw exists in the expansion of\narguments to math comparison functions which can cause values to be\nexpanded twice. This could permit a local attacker to insert arbitrary\ndata.\");\n script_set_attribute(attribute:\"see_also\", value:\"ftp://ftp.exim.org/pub/exim/exim4/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://lists.exim.org/lurker/message/20140722.160524.be7e58a9.en.html\");\n script_set_attribute(attribute:\"see_also\", value:\"ftp://ftp.exim.org/pub/exim/ChangeLogs/ChangeLog-4.83\");\n script_set_attribute(attribute:\"solution\", value:\"Upgrade to Exim 4.83 or later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:N/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2012/07/22\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2012/07/22\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/08/07\");\n\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:exim:exim\");\n script_set_attribute(attribute:\"potential_vulnerability\", value:\"true\");\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"SMTP problems\");\n\n script_copyright(english:\"This script is Copyright (C) 2014-2018 Tenable Network Security, Inc.\");\n\n script_dependencies(\"smtpserver_detect.nasl\");\n script_require_ports(\"Services/smtp\", 25);\n script_require_keys(\"Settings/ParanoidReport\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"smtp_func.inc\");\n\nif (report_paranoia < 2) audit(AUDIT_PARANOID);\n\nport = get_service(svc:\"smtp\", default:25, exit_on_fail:TRUE);\n\nbanner = get_smtp_banner(port:port);\nif (!banner) audit(AUDIT_NO_BANNER, port);\nif (\"Exim\" >!< banner) audit(AUDIT_NOT_LISTEN, 'Exim', port);\n\nmatches = eregmatch(pattern:\"220.*Exim ([0-9\\.]+)\", string:banner);\nif (isnull(matches)) audit(AUDIT_SERVICE_VER_FAIL, 'Exim', port);\n\nversion = matches[1];\nif (\n version =~ \"^[0-3]\\.\" ||\n version =~ \"^4\\.([0-7][0-9]|8[0-2])([^0-9]|$)\"\n )\n{\n if (report_verbosity > 0)\n {\n report =\n '\\n Banner : ' + banner +\n '\\n Installed version : ' + version +\n '\\n Fixed version : 4.83';\n security_note(port:port, extra:report);\n }\n else security_note(port);\n exit(0);\n}\nelse audit(AUDIT_LISTEN_NOT_VULN, 'Exim', port, version);\n", "cvss": {"score": 4.6, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2019-02-21T01:26:29", "bulletinFamily": "scanner", "description": "It was discovered that Exim incorrectly filtered environment variables when used with the perl_startup configuration option. If the perl_startup option was enabled, a local attacker could use this issue to escalate their privileges to the root user. This issue has been fixed by having Exim clean the complete execution environment by default on startup, including any subprocesses such as transports that call other programs. This change in behaviour may break existing installations and can be adjusted by using two new configuration options, keep_environment and add_environment. (CVE-2016-1531)\n\nPatrick William discovered that Exim incorrectly expanded mathematical comparisons twice. A local attacker could possibly use this issue to perform arbitrary file operations as the Exim user. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-2972).\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "modified": "2018-12-01T00:00:00", "id": "UBUNTU_USN-2933-1.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=89962", "published": "2016-03-16T00:00:00", "title": "Ubuntu 12.04 LTS / 14.04 LTS / 15.10 : exim4 vulnerabilities (USN-2933-1)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-2933-1. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(89962);\n script_version(\"2.12\");\n script_cvs_date(\"Date: 2018/12/01 15:12:40\");\n\n script_cve_id(\"CVE-2014-2972\", \"CVE-2016-1531\");\n script_xref(name:\"USN\", value:\"2933-1\");\n\n script_name(english:\"Ubuntu 12.04 LTS / 14.04 LTS / 15.10 : exim4 vulnerabilities (USN-2933-1)\");\n script_summary(english:\"Checks dpkg output for updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Ubuntu host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"It was discovered that Exim incorrectly filtered environment variables\nwhen used with the perl_startup configuration option. If the\nperl_startup option was enabled, a local attacker could use this issue\nto escalate their privileges to the root user. This issue has been\nfixed by having Exim clean the complete execution environment by\ndefault on startup, including any subprocesses such as transports that\ncall other programs. This change in behaviour may break existing\ninstallations and can be adjusted by using two new configuration\noptions, keep_environment and add_environment. (CVE-2016-1531)\n\nPatrick William discovered that Exim incorrectly expanded mathematical\ncomparisons twice. A local attacker could possibly use this issue to\nperform arbitrary file operations as the Exim user. This issue only\naffected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-2972).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://usn.ubuntu.com/2933-1/\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Update the affected exim4-daemon-custom, exim4-daemon-heavy and / or\nexim4-daemon-light packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_core\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:exim4-daemon-custom\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:exim4-daemon-heavy\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:exim4-daemon-light\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:12.04:-:lts\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:14.04\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:15.10\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2016/03/15\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2016/03/16\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2016-2018 Canonical, Inc. / NASL script (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"misc_func.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nrelease = chomp(release);\nif (! ereg(pattern:\"^(12\\.04|14\\.04|15\\.10)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 12.04 / 14.04 / 15.10\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Ubuntu\", cpu);\n\nflag = 0;\n\nif (ubuntu_check(osver:\"12.04\", pkgname:\"exim4-daemon-custom\", pkgver:\"4.76-3ubuntu3.3\")) flag++;\nif (ubuntu_check(osver:\"12.04\", pkgname:\"exim4-daemon-heavy\", pkgver:\"4.76-3ubuntu3.3\")) flag++;\nif (ubuntu_check(osver:\"12.04\", pkgname:\"exim4-daemon-light\", pkgver:\"4.76-3ubuntu3.3\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"exim4-daemon-custom\", pkgver:\"4.82-3ubuntu2.1\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"exim4-daemon-heavy\", pkgver:\"4.82-3ubuntu2.1\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"exim4-daemon-light\", pkgver:\"4.82-3ubuntu2.1\")) flag++;\nif (ubuntu_check(osver:\"15.10\", pkgname:\"exim4-daemon-heavy\", pkgver:\"4.86-3ubuntu1.1\")) flag++;\nif (ubuntu_check(osver:\"15.10\", pkgname:\"exim4-daemon-light\", pkgver:\"4.86-3ubuntu1.1\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"exim4-daemon-custom / exim4-daemon-heavy / exim4-daemon-light\");\n}\n", "cvss": {"score": 6.9, "vector": "AV:LOCAL/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2019-02-21T01:22:16", "bulletinFamily": "scanner", "description": "Changes in exim :\n\n - Silence static checkers; (beo#1506).\n\n - update to 4.83 This release of Exim includes one incompatible fix :\n\n + the behavior of expansion of arguments to math comparison functions (<, <=, =, =>, >) was unexpected, expanding the values twice; CVE-2014-2972; (bnc#888520) This release contains the following enhancements and bugfixes :\n\n + PRDR was promoted from Experimental to mainline\n\n + OCSP Stapling was promoted from Experimental to mainline\n\n + new Experimental feature Proxy Protocol\n\n + new Experimental feature DSN (Delivery Status Notifications)\n\n + TLS session improvements\n\n + TLS SNI fixes\n\n + LDAP enhancements\n\n + DMARC fixes (previous CVE-2014-2957) and new $dmarc_domain_policy\n\n + several new operations (listextract, utf8clean, md5, sha1)\n\n + enforce header formatting with verify=header_names_ascii\n\n + new commandline option -oMm\n\n + new TLSA dns lookup\n\n + new malware 'sock' type\n\n + cutthrough routing enhancements\n\n + logging enhancements\n\n + DNSSEC enhancements\n\n + exiqgrep enhancements\n\n + deprecating non-standard SPF results\n\n + build and portability fixes\n\n + documentation fixes and enhancements\n\n - Verify source tar ball gpg signature.\n\n - Refresh exim-enable_ecdh_openssl.patch and strip version number from the patch filename.\n\n - exim482-enable_ecdh_openssl.patch: Enable ECDH (elliptic curve diffie hellman) support, taken from http://bugs.exim.org/show_bug.cgi?id=1397\n\n - BuildRequire libopenssl-devel only on SUSE systems.\n\n - Fix suse_version condition of the pre- and postun scriptlets.\n\n - Call service_add_pre from pre scriptlet on post-12.2 systems.\n\n - update to 4.82\n\n - Add -bI: framework, and -bI:sieve for querying sieve capabilities.\n\n - Make -n do something, by making it not do something.\n When combined with -bP, the name of an option is not output.\n\n - Added tls_dh_min_bits SMTP transport driver option, only honoured by GnuTLS.\n\n - First step towards DNSSEC, provide $sender_host_dnssec for $sender_host_name and config options to manage this, and basic check routines.\n\n - DSCP support for outbound connections and control modifier for inbound.\n\n - Cyrus SASL: set local and remote IP;port properties for driver. (Only plugin which currently uses this is kerberos4, which nobody should be using, but we should make it available and other future plugins might conceivably use it, even though it would break NAT;\n stuff *should* be using channel bindings instead).\n\n - Handle 'exim -L <tag>' to indicate to use syslog with tag as the process name; added for Sendmail compatibility; requires admin caller. Handle -G as equivalent to 'control = suppress_local_fixups' (we used to just ignore it); requires trusted caller. Also parse but ignore: -Ac -Am -X<logfile> Bugzilla 1117.\n\n - Bugzilla 1258 - Refactor MAIL FROM optional args processing.\n\n - Add +smtp_confirmation as a default logging option.\n\n - Bugzilla 198 - Implement remove_header ACL modifier.\n\n - Bugzilla 1197, 1281, 1283 - Spec typo.\n\n - Bugzilla 1290 - Spec grammar fixes.\n\n - Bugzilla 1285 - Spec omission, fix docbook errors for spec.txt creation.\n\n - Add Experimental DMARC support using libopendmarc libraries.\n\n - Fix an out of order global option causing a segfault.\n Reported to dev mailing list by by Dmitry Isaikin.\n\n - Bugzilla 1201 & 304 - New cutthrough-delivery feature, with TLS support.\n\n - Support 'G' suffix to numbers in ${if comparisons.\n\n - Handle smtp transport tls_sni option forced-fail for OpenSSL.\n\n - Bugzilla 1196 - Spec examples corrections\n\n - Add expansion operators ${listnamed:name} and ${listcount:string}\n\n - Add gnutls_allow_auto_pkcs11 option (was originally called gnutls_enable_pkcs11, but renamed to more accurately indicate its function.\n\n - Let Linux makefile inherit CFLAGS/CFLAGS_DYNAMIC. Pulled from Debian 30_dontoverridecflags.dpatch by Andreas Metzler.\n\n - Add expansion item ${acl {name}{arg}...}, expansion condition 'acl {{name}{arg}...}', and optional args on acl condition 'acl = name arg...'\n\n - Permit multiple router/transport headers_add/remove lines.\n\n - Add dnsdb pseudo-lookup 'a+' to do an 'aaaa' + 'a' combination.\n\n - Avoid using a waiting database for a single-message-only transport. Performance patch from Paul Fisher. Bugzilla 1262.\n\n - Strip leading/trailing newlines from add_header ACL modifier data. Bugzilla 884.\n\n - Add $headers_added variable, with content from use of ACL modifier add_header (but not yet added to the message). Bugzilla 199.\n\n - Add 8bitmime log_selector, for 8bitmime status on the received line. Pulled from Bugzilla 817 by Wolfgang Breyha.\n\n - SECURITY: protect DKIM DNS decoding from remote exploit.\n CVE-2012-5671 (nb: this is the same fix as in Exim 4.80.1)\n\n - Add A= logging on delivery lines, and a client_set_id option on authenticators.\n\n - Add optional authenticated_sender logging to A= and a log_selector for control.\n\n - Unbreak server_set_id for NTLM/SPA auth, broken by 4.80 PP/29.\n\n - Dovecot auth: log better reason to rejectlog if Dovecot did not advertise SMTP AUTH mechanism to us, instead of a generic protocol violation error. Also, make Exim more robust to bad data from the Dovecot auth socket.\n\n - Fix ultimate retry timeouts for intermittently deliverable recipients.\n\n - When a queue runner is handling a message, Exim first routes the recipient addresses, during which it prunes them based on the retry hints database. After that it attempts to deliver the message to any remaining recipients. It then updates the hints database using the retry rules.\n\n - So if a recipient address works intermittently, it can get repeatedly deferred at routing time. The retry hints record remains fresh so the address never reaches the final cutoff time.\n\n - This is a fairly common occurrence when a user is bumping up against their storage quota. Exim had some logic in its local delivery code to deal with this.\n However it did not apply to per-recipient defers in remote deliveries, e.g. over LMTP to a separate IMAP message store.\n\n - This change adds a proper retry rule check during routing so that the final cutoff time is checked against the message's age. We only do this check if there is an address retry record and there is not a domain retry record; this implies that previous attempts to handle the address had the retry_use_local_parts option turned on. We use this as an approximation for the destination being like a local delivery, as in LMTP.\n\n - I suspect this new check makes the old local delivery cutoff check redundant, but I have not verified this so I left the code in place.\n\n - Correct gecos expansion when From: is a prefix of the username.\n\n - Test 0254 submits a message to Exim with the header &#9;\n Resent-From: f\n\n - When I ran the test suite under the user fanf2, Exim expanded the header to contain my full name, whereas it should have added a Resent-Sender: header. It erroneously treats any prefix of the username as equal to the username. This change corrects that bug.\n\n - DCC debug and logging tidyup Error conditions log to paniclog rather than rejectlog. Debug lines prefixed by 'DCC: ' to remove any ambiguity.\n\n - Avoid unnecessary rebuilds of lookup-related code.\n\n - Fix OCSP reinitialisation in SNI handling for Exim/TLS as server. Bug spotted by Jeremy Harris; was flawed since initial commit. Would have resulted in OCSP responses post-SNI triggering an Exim NULL dereference and crash.\n\n - Add $router_name and $transport_name variables. Bugzilla 308.\n\n - Define SIOCGIFCONF_GIVES_ADDR for GNU Hurd. Bug detection, analysis and fix by Samuel Thibault. Bugzilla 1331, Debian bug #698092.\n\n - Update eximstats to watch out for senders sending 'HELO [IpAddr]'\n\n - SMTP PRDR (http://www.eric-a-hall.com/specs/draft-hall-prdr-00.txt ). Server implementation by Todd Lyons, client by JH.\n Only enabled when compiled with EXPERIMENTAL_PRDR. A new config variable 'prdr_enable' controls whether the server advertises the facility. If the client requests PRDR a new acl_data_smtp_prdr ACL is called once for each recipient, after the body content is received and before the acl_smtp_data ACL. The client is controlled by bolth of: a hosts_try_prdr option on the smtp transport, and the server advertisement. Default client logging of deliveries and rejections involving PRDR are flagged with the string 'PRDR'.\n\n - Fix problems caused by timeouts during quit ACLs trying to double fclose(). Diagnosis by Todd Lyons. Update configure.default to handle IPv6 localhost better. Patch by Alain Williams (plus minor tweaks). Bugzilla 880.\n\n - OpenSSL made graceful with empty tls_verify_certificates setting. This is now consistent with GnuTLS, and is now documented: the previous undocumented portable approach to treating the option as unset was to force an expansion failure. That still works, and an empty string is now equivalent.\n\n - Renamed DNSSEC-enabling option to 'dns_dnssec_ok', to make it clearer that Exim is using the DO (DNSSEC OK) EDNS0 resolver flag, not performing validation itself.\n\n - Added force_command boolean option to pipe transport.\n Patch from Nick Koston, of cPanel Inc.\n\n - AUTH support on callouts (and hence cutthrough-deliveries). Bugzilla 321, 823.\n\n - Added udpsend ACL modifer and hexquote expansion operator\n\n - Fix eximon continuous updating with timestamped log-files. Broken in a format-string cleanup in 4.80, missed when I repaired the other false fix of the same issue. Report and fix from Heiko Schlichting. Bugzilla 1363.\n\n - Guard LDAP TLS usage against Solaris LDAP variant.\n Report from Prashanth Katuri.\n\n - Support safari_ecdhe_ecdsa_bug for openssl_options. It's SecureTransport, so affects any MacOS clients which use the system-integrated TLS libraries, including email clients.\n\n - Fix segfault from trying to fprintf() to a NULL stdio FILE* if using a MIME ACL for non-SMTP local injection.\n Report and assistance in diagnosis by Warren Baker.\n\n - Adjust exiqgrep to be case-insensitive for sender/receiver.\n\n - Fix comparisons for 64b. Bugzilla 1385.\n\n - Add expansion variable $authenticated_fail_id to keep track of last id that failed so it may be referenced in subsequent ACL's.\n\n - Bugzilla 1375 - Prevent TLS rebinding in ldap. Patch provided by Alexander Miroch.\n\n - Bugzilla 1382 - Option ldap_require_cert overrides start_tls ldap library initialization, allowing self-signed CA's to be used. Also properly sets require_cert option later in code by using NULL (global ldap config) instead of ldap handle (per session). Bug diagnosis and testing by alxgomz.\n\n - Enhanced documentation in the ratelimit.pl script provided in the src/util/ subdirectory.\n\n - Bug 1301 - Imported transport SQL logging patch from Axel Rau renamed to Transport Post Delivery Action by Jeremy Harris, as EXPERIMENTAL_TPDA.\n\n - Bugzilla 1217 - Redis lookup support has been added. It is only enabled when Exim is compiled with EXPERIMENTAL_REDIS. A new config variable redis_servers = needs to be configured which will be used by the redis lookup. Patch from Warren Baker, of The Packet Hub.\n\n - Fix exiqsumm summary for corner case. Patch provided by Richard Hall.\n\n - Bugzilla 1289 - Clarify host/ip processing when have errors looking up a hostname or reverse DNS when processing a host list. Used suggestions from multiple comments on this bug.\n\n - Bugzilla 1057 - Multiple clamd TCP targets patch from Mark Zealey.\n\n - Had previously added a -CONTINUE option to runtest in the test suite. Missed a few lines, added it to make the runtest require no keyboard interaction.\n\n - Bugzilla 1402 - Test 533 fails if any part of the path to the test suite contains upper case chars. Make router use caseful_local_part.\n\n - Bugzilla 1400 - Add AVOID_GNUTLS_PKCS11 build option.\n Allows GnuTLS support when GnuTLS has been built with p11-kit.\n\n - Add systemd support for openSUSE > 12.2\n\n - Remove some obsolete conditionnal macros\n\n - exim.spec forces the use of SSL libraries, so make sure the BuildRequires are there. Also add previously implicit cyrus-sasl back.\n\n - Fixed another remote code execution issue (CVE-2011-1407 / bnc#694798)\n\n - Fixed STARTTLS command injection (bnc#695144)", "modified": "2018-11-19T00:00:00", "id": "OPENSUSE-2014-482.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=77126", "published": "2014-08-12T00:00:00", "title": "openSUSE Security Update : exim (openSUSE-SU-2014:0983-1)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2014-482.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(77126);\n script_version(\"1.3\");\n script_cvs_date(\"Date: 2018/11/19 11:02:42\");\n\n script_cve_id(\"CVE-2011-1407\", \"CVE-2012-5671\", \"CVE-2014-2957\", \"CVE-2014-2972\");\n\n script_name(english:\"openSUSE Security Update : exim (openSUSE-SU-2014:0983-1)\");\n script_summary(english:\"Check for the openSUSE-2014-482 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Changes in exim :\n\n - Silence static checkers; (beo#1506).\n\n - update to 4.83 This release of Exim includes one\n incompatible fix :\n\n + the behavior of expansion of arguments to math\n comparison functions (<, <=, =, =>, >) was unexpected,\n expanding the values twice; CVE-2014-2972; (bnc#888520)\n This release contains the following enhancements and\n bugfixes :\n\n + PRDR was promoted from Experimental to mainline\n\n + OCSP Stapling was promoted from Experimental to mainline\n\n + new Experimental feature Proxy Protocol\n\n + new Experimental feature DSN (Delivery Status\n Notifications)\n\n + TLS session improvements\n\n + TLS SNI fixes\n\n + LDAP enhancements\n\n + DMARC fixes (previous CVE-2014-2957) and new\n $dmarc_domain_policy\n\n + several new operations (listextract, utf8clean, md5,\n sha1)\n\n + enforce header formatting with verify=header_names_ascii\n\n + new commandline option -oMm\n\n + new TLSA dns lookup\n\n + new malware 'sock' type\n\n + cutthrough routing enhancements\n\n + logging enhancements\n\n + DNSSEC enhancements\n\n + exiqgrep enhancements\n\n + deprecating non-standard SPF results\n\n + build and portability fixes\n\n + documentation fixes and enhancements\n\n - Verify source tar ball gpg signature.\n\n - Refresh exim-enable_ecdh_openssl.patch and strip version\n number from the patch filename.\n\n - exim482-enable_ecdh_openssl.patch: Enable ECDH (elliptic\n curve diffie hellman) support, taken from\n http://bugs.exim.org/show_bug.cgi?id=1397\n\n - BuildRequire libopenssl-devel only on SUSE systems.\n\n - Fix suse_version condition of the pre- and postun\n scriptlets.\n\n - Call service_add_pre from pre scriptlet on post-12.2\n systems.\n\n - update to 4.82\n\n - Add -bI: framework, and -bI:sieve for querying sieve\n capabilities.\n\n - Make -n do something, by making it not do something.\n When combined with -bP, the name of an option is not\n output.\n\n - Added tls_dh_min_bits SMTP transport driver option, only\n honoured by GnuTLS.\n\n - First step towards DNSSEC, provide $sender_host_dnssec\n for $sender_host_name and config options to manage this,\n and basic check routines.\n\n - DSCP support for outbound connections and control\n modifier for inbound.\n\n - Cyrus SASL: set local and remote IP;port properties for\n driver. (Only plugin which currently uses this is\n kerberos4, which nobody should be using, but we should\n make it available and other future plugins might\n conceivably use it, even though it would break NAT;\n stuff *should* be using channel bindings instead).\n\n - Handle 'exim -L <tag>' to indicate to use syslog with\n tag as the process name; added for Sendmail\n compatibility; requires admin caller. Handle -G as\n equivalent to 'control = suppress_local_fixups' (we used\n to just ignore it); requires trusted caller. Also parse\n but ignore: -Ac -Am -X<logfile> Bugzilla 1117.\n\n - Bugzilla 1258 - Refactor MAIL FROM optional args\n processing.\n\n - Add +smtp_confirmation as a default logging option.\n\n - Bugzilla 198 - Implement remove_header ACL modifier.\n\n - Bugzilla 1197, 1281, 1283 - Spec typo.\n\n - Bugzilla 1290 - Spec grammar fixes.\n\n - Bugzilla 1285 - Spec omission, fix docbook errors for\n spec.txt creation.\n\n - Add Experimental DMARC support using libopendmarc\n libraries.\n\n - Fix an out of order global option causing a segfault.\n Reported to dev mailing list by by Dmitry Isaikin.\n\n - Bugzilla 1201 & 304 - New cutthrough-delivery feature,\n with TLS support.\n\n - Support 'G' suffix to numbers in ${if comparisons.\n\n - Handle smtp transport tls_sni option forced-fail for\n OpenSSL.\n\n - Bugzilla 1196 - Spec examples corrections\n\n - Add expansion operators ${listnamed:name} and\n ${listcount:string}\n\n - Add gnutls_allow_auto_pkcs11 option (was originally\n called gnutls_enable_pkcs11, but renamed to more\n accurately indicate its function.\n\n - Let Linux makefile inherit CFLAGS/CFLAGS_DYNAMIC. Pulled\n from Debian 30_dontoverridecflags.dpatch by Andreas\n Metzler.\n\n - Add expansion item ${acl {name}{arg}...}, expansion\n condition 'acl {{name}{arg}...}', and optional args on\n acl condition 'acl = name arg...'\n\n - Permit multiple router/transport headers_add/remove\n lines.\n\n - Add dnsdb pseudo-lookup 'a+' to do an 'aaaa' + 'a'\n combination.\n\n - Avoid using a waiting database for a single-message-only\n transport. Performance patch from Paul Fisher. Bugzilla\n 1262.\n\n - Strip leading/trailing newlines from add_header ACL\n modifier data. Bugzilla 884.\n\n - Add $headers_added variable, with content from use of\n ACL modifier add_header (but not yet added to the\n message). Bugzilla 199.\n\n - Add 8bitmime log_selector, for 8bitmime status on the\n received line. Pulled from Bugzilla 817 by Wolfgang\n Breyha.\n\n - SECURITY: protect DKIM DNS decoding from remote exploit.\n CVE-2012-5671 (nb: this is the same fix as in Exim\n 4.80.1)\n\n - Add A= logging on delivery lines, and a client_set_id\n option on authenticators.\n\n - Add optional authenticated_sender logging to A= and a\n log_selector for control.\n\n - Unbreak server_set_id for NTLM/SPA auth, broken by 4.80\n PP/29.\n\n - Dovecot auth: log better reason to rejectlog if Dovecot\n did not advertise SMTP AUTH mechanism to us, instead of\n a generic protocol violation error. Also, make Exim more\n robust to bad data from the Dovecot auth socket.\n\n - Fix ultimate retry timeouts for intermittently\n deliverable recipients.\n\n - When a queue runner is handling a message, Exim first\n routes the recipient addresses, during which it prunes\n them based on the retry hints database. After that it\n attempts to deliver the message to any remaining\n recipients. It then updates the hints database using the\n retry rules.\n\n - So if a recipient address works intermittently, it can\n get repeatedly deferred at routing time. The retry hints\n record remains fresh so the address never reaches the\n final cutoff time.\n\n - This is a fairly common occurrence when a user is\n bumping up against their storage quota. Exim had some\n logic in its local delivery code to deal with this.\n However it did not apply to per-recipient defers in\n remote deliveries, e.g. over LMTP to a separate IMAP\n message store.\n\n - This change adds a proper retry rule check during\n routing so that the final cutoff time is checked against\n the message's age. We only do this check if there is an\n address retry record and there is not a domain retry\n record; this implies that previous attempts to handle\n the address had the retry_use_local_parts option turned\n on. We use this as an approximation for the destination\n being like a local delivery, as in LMTP.\n\n - I suspect this new check makes the old local delivery\n cutoff check redundant, but I have not verified this so\n I left the code in place.\n\n - Correct gecos expansion when From: is a prefix of the\n username.\n\n - Test 0254 submits a message to Exim with the header &#9;\n Resent-From: f\n\n - When I ran the test suite under the user fanf2, Exim\n expanded the header to contain my full name, whereas it\n should have added a Resent-Sender: header. It\n erroneously treats any prefix of the username as equal\n to the username. This change corrects that bug.\n\n - DCC debug and logging tidyup Error conditions log to\n paniclog rather than rejectlog. Debug lines prefixed by\n 'DCC: ' to remove any ambiguity.\n\n - Avoid unnecessary rebuilds of lookup-related code.\n\n - Fix OCSP reinitialisation in SNI handling for Exim/TLS\n as server. Bug spotted by Jeremy Harris; was flawed\n since initial commit. Would have resulted in OCSP\n responses post-SNI triggering an Exim NULL dereference\n and crash.\n\n - Add $router_name and $transport_name variables. Bugzilla\n 308.\n\n - Define SIOCGIFCONF_GIVES_ADDR for GNU Hurd. Bug\n detection, analysis and fix by Samuel Thibault. Bugzilla\n 1331, Debian bug #698092.\n\n - Update eximstats to watch out for senders sending 'HELO\n [IpAddr]'\n\n - SMTP PRDR\n (http://www.eric-a-hall.com/specs/draft-hall-prdr-00.txt\n ). Server implementation by Todd Lyons, client by JH.\n Only enabled when compiled with EXPERIMENTAL_PRDR. A new\n config variable 'prdr_enable' controls whether the\n server advertises the facility. If the client requests\n PRDR a new acl_data_smtp_prdr ACL is called once for\n each recipient, after the body content is received and\n before the acl_smtp_data ACL. The client is controlled\n by bolth of: a hosts_try_prdr option on the smtp\n transport, and the server advertisement. Default client\n logging of deliveries and rejections involving PRDR are\n flagged with the string 'PRDR'.\n\n - Fix problems caused by timeouts during quit ACLs trying\n to double fclose(). Diagnosis by Todd Lyons. Update\n configure.default to handle IPv6 localhost better. Patch\n by Alain Williams (plus minor tweaks). Bugzilla 880.\n\n - OpenSSL made graceful with empty tls_verify_certificates\n setting. This is now consistent with GnuTLS, and is now\n documented: the previous undocumented portable approach\n to treating the option as unset was to force an\n expansion failure. That still works, and an empty string\n is now equivalent.\n\n - Renamed DNSSEC-enabling option to 'dns_dnssec_ok', to\n make it clearer that Exim is using the DO (DNSSEC OK)\n EDNS0 resolver flag, not performing validation itself.\n\n - Added force_command boolean option to pipe transport.\n Patch from Nick Koston, of cPanel Inc.\n\n - AUTH support on callouts (and hence\n cutthrough-deliveries). Bugzilla 321, 823.\n\n - Added udpsend ACL modifer and hexquote expansion\n operator\n\n - Fix eximon continuous updating with timestamped\n log-files. Broken in a format-string cleanup in 4.80,\n missed when I repaired the other false fix of the same\n issue. Report and fix from Heiko Schlichting. Bugzilla\n 1363.\n\n - Guard LDAP TLS usage against Solaris LDAP variant.\n Report from Prashanth Katuri.\n\n - Support safari_ecdhe_ecdsa_bug for openssl_options. It's\n SecureTransport, so affects any MacOS clients which use\n the system-integrated TLS libraries, including email\n clients.\n\n - Fix segfault from trying to fprintf() to a NULL stdio\n FILE* if using a MIME ACL for non-SMTP local injection.\n Report and assistance in diagnosis by Warren Baker.\n\n - Adjust exiqgrep to be case-insensitive for\n sender/receiver.\n\n - Fix comparisons for 64b. Bugzilla 1385.\n\n - Add expansion variable $authenticated_fail_id to keep\n track of last id that failed so it may be referenced in\n subsequent ACL's.\n\n - Bugzilla 1375 - Prevent TLS rebinding in ldap. Patch\n provided by Alexander Miroch.\n\n - Bugzilla 1382 - Option ldap_require_cert overrides\n start_tls ldap library initialization, allowing\n self-signed CA's to be used. Also properly sets\n require_cert option later in code by using NULL (global\n ldap config) instead of ldap handle (per session). Bug\n diagnosis and testing by alxgomz.\n\n - Enhanced documentation in the ratelimit.pl script\n provided in the src/util/ subdirectory.\n\n - Bug 1301 - Imported transport SQL logging patch from\n Axel Rau renamed to Transport Post Delivery Action by\n Jeremy Harris, as EXPERIMENTAL_TPDA.\n\n - Bugzilla 1217 - Redis lookup support has been added. It\n is only enabled when Exim is compiled with\n EXPERIMENTAL_REDIS. A new config variable redis_servers\n = needs to be configured which will be used by the redis\n lookup. Patch from Warren Baker, of The Packet Hub.\n\n - Fix exiqsumm summary for corner case. Patch provided by\n Richard Hall.\n\n - Bugzilla 1289 - Clarify host/ip processing when have\n errors looking up a hostname or reverse DNS when\n processing a host list. Used suggestions from multiple\n comments on this bug.\n\n - Bugzilla 1057 - Multiple clamd TCP targets patch from\n Mark Zealey.\n\n - Had previously added a -CONTINUE option to runtest in\n the test suite. Missed a few lines, added it to make the\n runtest require no keyboard interaction.\n\n - Bugzilla 1402 - Test 533 fails if any part of the path\n to the test suite contains upper case chars. Make router\n use caseful_local_part.\n\n - Bugzilla 1400 - Add AVOID_GNUTLS_PKCS11 build option.\n Allows GnuTLS support when GnuTLS has been built with\n p11-kit.\n\n - Add systemd support for openSUSE > 12.2\n\n - Remove some obsolete conditionnal macros\n\n - exim.spec forces the use of SSL libraries, so make sure\n the BuildRequires are there. Also add previously\n implicit cyrus-sasl back.\n\n - Fixed another remote code execution issue (CVE-2011-1407\n / bnc#694798)\n\n - Fixed STARTTLS command injection (bnc#695144)\"\n );\n # http://bugs.exim.org/show_bug.cgi?id=1397\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.exim.org/show_bug.cgi?id=1397\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.eric-a-hall.com/specs/draft-hall-prdr-00.txt\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=694798\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=695144\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.novell.com/show_bug.cgi?id=888520\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://lists.opensuse.org/opensuse-updates/2014-08/msg00014.html\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected exim packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:exim\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:exim-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:exim-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:eximon\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:eximon-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:eximstats-html\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:12.3\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:13.1\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/07/25\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/08/12\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2014-2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE12\\.3|SUSE13\\.1)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"12.3 / 13.1\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE12.3\", reference:\"exim-4.83-3.4.1\") ) flag++;\nif ( rpm_check(release:\"SUSE12.3\", reference:\"exim-debuginfo-4.83-3.4.1\") ) flag++;\nif ( rpm_check(release:\"SUSE12.3\", reference:\"exim-debugsource-4.83-3.4.1\") ) flag++;\nif ( rpm_check(release:\"SUSE12.3\", reference:\"eximon-4.83-3.4.1\") ) flag++;\nif ( rpm_check(release:\"SUSE12.3\", reference:\"eximon-debuginfo-4.83-3.4.1\") ) flag++;\nif ( rpm_check(release:\"SUSE12.3\", reference:\"eximstats-html-4.83-3.4.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"exim-4.83-6.4.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"exim-debuginfo-4.83-6.4.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"exim-debugsource-4.83-6.4.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"eximon-4.83-6.4.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"eximon-debuginfo-4.83-6.4.1\") ) flag++;\nif ( rpm_check(release:\"SUSE13.1\", reference:\"eximstats-html-4.83-6.4.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"exim / exim-debuginfo / exim-debugsource / eximon / etc\");\n}\n", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "openvas": [{"lastseen": "2019-05-29T18:37:09", "bulletinFamily": "scanner", "description": "The remote host is missing an update for the ", "modified": "2019-03-15T00:00:00", "published": "2014-08-05T00:00:00", "id": "OPENVAS:1361412562310868054", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310868054", "title": "Fedora Update for exim FEDORA-2014-8803", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for exim FEDORA-2014-8803\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2014 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.868054\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2014-08-05 16:43:29 +0530 (Tue, 05 Aug 2014)\");\n script_cve_id(\"CVE-2014-2972\");\n script_tag(name:\"cvss_base\", value:\"4.6\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:L/AC:L/Au:N/C:P/I:P/A:P\");\n script_name(\"Fedora Update for exim FEDORA-2014-8803\");\n script_tag(name:\"affected\", value:\"exim on Fedora 19\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name:\"FEDORA\", value:\"2014-8803\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/pipermail/package-announce/2014-August/136251.html\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'exim'\n package(s) announced via the referenced advisory.\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2014 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC19\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC19\")\n{\n\n if ((res = isrpmvuln(pkg:\"exim\", rpm:\"exim~4.80.1~4.fc19\", rls:\"FC19\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-05-29T18:37:17", "bulletinFamily": "scanner", "description": "The remote host is missing an update for the ", "modified": "2019-03-15T00:00:00", "published": "2014-08-05T00:00:00", "id": "OPENVAS:1361412562310868048", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310868048", "title": "Fedora Update for exim FEDORA-2014-8865", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for exim FEDORA-2014-8865\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2014 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.868048\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2014-08-05 16:40:39 +0530 (Tue, 05 Aug 2014)\");\n script_cve_id(\"CVE-2014-2972\");\n script_tag(name:\"cvss_base\", value:\"4.6\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:L/AC:L/Au:N/C:P/I:P/A:P\");\n script_name(\"Fedora Update for exim FEDORA-2014-8865\");\n script_tag(name:\"affected\", value:\"exim on Fedora 20\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name:\"FEDORA\", value:\"2014-8865\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/pipermail/package-announce/2014-August/136264.html\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'exim'\n package(s) announced via the referenced advisory.\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2014 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC20\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC20\")\n{\n\n if ((res = isrpmvuln(pkg:\"exim\", rpm:\"exim~4.80.1~7.fc20\", rls:\"FC20\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-05-29T18:37:26", "bulletinFamily": "scanner", "description": "Amazon Linux Local Security Checks", "modified": "2018-10-01T00:00:00", "published": "2015-09-08T00:00:00", "id": "OPENVAS:1361412562310120245", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310120245", "title": "Amazon Linux Local Check: ALAS-2014-395", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: alas-2014-395.nasl 6735 2017-07-17 09:56:49Z teissa$\n#\n# Amazon Linux security check\n#\n# Authors:\n# Eero Volotinen <eero.volotinen@iki.fi>\n#\n# Copyright:\n# Copyright (c) 2015 Eero Volotinen, http://ping-viini.org\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.120245\");\n script_version(\"$Revision: 11703 $\");\n script_tag(name:\"creation_date\", value:\"2015-09-08 13:21:17 +0200 (Tue, 08 Sep 2015)\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-10-01 10:05:31 +0200 (Mon, 01 Oct 2018) $\");\n script_name(\"Amazon Linux Local Check: ALAS-2014-395\");\n script_tag(name:\"insight\", value:\"expand.c in Exim before 4.83 expands mathematical comparisons twice, which allows local users to gain privileges and execute arbitrary commands via a crafted lookup value.\");\n script_tag(name:\"solution\", value:\"Run yum update exim to update your system.\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name:\"URL\", value:\"https://alas.aws.amazon.com/ALAS-2014-395.html\");\n script_cve_id(\"CVE-2014-2972\");\n script_tag(name:\"cvss_base\", value:\"4.6\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:L/AC:L/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/amazon_linux\", \"ssh/login/release\");\n script_category(ACT_GATHER_INFO);\n script_tag(name:\"summary\", value:\"Amazon Linux Local Security Checks\");\n script_copyright(\"Eero Volotinen\");\n script_family(\"Amazon Linux Local Security Checks\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release) exit(0);\n\nres = \"\";\n\nif(release == \"AMAZON\")\n{\nif ((res = isrpmvuln(pkg:\"exim-mon\", rpm:\"exim-mon~4.72~6.6.amzn1\", rls:\"AMAZON\")) != NULL) {\n security_message(data:res);\n exit(0);\n}\nif ((res = isrpmvuln(pkg:\"exim-debuginfo\", rpm:\"exim-debuginfo~4.72~6.6.amzn1\", rls:\"AMAZON\")) != NULL) {\n security_message(data:res);\n exit(0);\n}\nif ((res = isrpmvuln(pkg:\"exim-mysql\", rpm:\"exim-mysql~4.72~6.6.amzn1\", rls:\"AMAZON\")) != NULL) {\n security_message(data:res);\n exit(0);\n}\nif ((res = isrpmvuln(pkg:\"exim-greylist\", rpm:\"exim-greylist~4.72~6.6.amzn1\", rls:\"AMAZON\")) != NULL) {\n security_message(data:res);\n exit(0);\n}\nif ((res = isrpmvuln(pkg:\"exim-pgsql\", rpm:\"exim-pgsql~4.72~6.6.amzn1\", rls:\"AMAZON\")) != NULL) {\n security_message(data:res);\n exit(0);\n}\nif ((res = isrpmvuln(pkg:\"exim\", rpm:\"exim~4.72~6.6.amzn1\", rls:\"AMAZON\")) != NULL) {\n security_message(data:res);\n exit(0);\n}\nif (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-05-29T18:35:01", "bulletinFamily": "scanner", "description": "The remote host is missing an update for the ", "modified": "2019-03-13T00:00:00", "published": "2016-03-16T00:00:00", "id": "OPENVAS:1361412562310842695", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310842695", "title": "Ubuntu Update for exim4 USN-2933-1", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Ubuntu Update for exim4 USN-2933-1\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2016 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.842695\");\n script_version(\"$Revision: 14140 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-13 13:26:09 +0100 (Wed, 13 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2016-03-16 06:09:39 +0100 (Wed, 16 Mar 2016)\");\n script_cve_id(\"CVE-2016-1531\", \"CVE-2014-2972\");\n script_tag(name:\"cvss_base\", value:\"6.9\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:L/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Ubuntu Update for exim4 USN-2933-1\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'exim4'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"insight\", value:\"It was discovered that Exim incorrectly\n filtered environment variables when used with the perl_startup configuration\n option. If the perl_startup option was enabled, a local attacker could use this\n issue to escalate their privileges to the root user. This issue has been fixed\n by having Exim clean the complete execution environment by default on startup,\n including any subprocesses such as transports that call other programs. This\n change in behaviour may break existing installations and can be adjusted by\n using two new configuration options, keep_environment and add_environment.\n (CVE-2016-1531)\n\n Patrick William discovered that Exim incorrectly expanded mathematical\n comparisons twice. A local attacker could possibly use this issue to\n perform arbitrary file operations as the Exim user. This issue only\n affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-2972)\");\n script_tag(name:\"affected\", value:\"exim4 on Ubuntu 15.10,\n Ubuntu 14.04 LTS,\n Ubuntu 12.04 LTS\");\n script_tag(name:\"solution\", value:\"Please Install the Updated Packages.\");\n\n script_xref(name:\"USN\", value:\"2933-1\");\n script_xref(name:\"URL\", value:\"http://www.ubuntu.com/usn/usn-2933-1/\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2016 Greenbone Networks GmbH\");\n script_family(\"Ubuntu Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/ubuntu_linux\", \"ssh/login/packages\", re:\"ssh/login/release=UBUNTU(14\\.04 LTS|12\\.04 LTS|15\\.10)\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nrelease = dpkg_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"UBUNTU14.04 LTS\")\n{\n\n if ((res = isdpkgvuln(pkg:\"exim4-daemon-custom\", ver:\"4.82-3ubuntu2.1\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"exim4-daemon-heavy\", ver:\"4.82-3ubuntu2.1\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"exim4-daemon-light\", ver:\"4.82-3ubuntu2.1\", rls:\"UBUNTU14.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n\n\nif(release == \"UBUNTU12.04 LTS\")\n{\n\n if ((res = isdpkgvuln(pkg:\"exim4-daemon-custom\", ver:\"4.76-3ubuntu3.3\", rls:\"UBUNTU12.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"exim4-daemon-heavy\", ver:\"4.76-3ubuntu3.3\", rls:\"UBUNTU12.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"exim4-daemon-light\", ver:\"4.76-3ubuntu3.3\", rls:\"UBUNTU12.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"existing\", ver:\"installations. After performing a standard system update, the new\", rls:\"UBUNTU12.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"to\", ver:\"adjust the new behaviour.\", rls:\"UBUNTU12.04 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n\n\nif(release == \"UBUNTU15.10\")\n{\n\n if ((res = isdpkgvuln(pkg:\"exim4-daemon-heavy\", ver:\"4.86-3ubuntu1.1\", rls:\"UBUNTU15.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"exim4-daemon-light\", ver:\"4.86-3ubuntu1.1\", rls:\"UBUNTU15.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}], "amazon": [{"lastseen": "2019-05-29T17:22:32", "bulletinFamily": "unix", "description": "**Issue Overview:**\n\nexpand.c in Exim before 4.83 expands mathematical comparisons twice, which allows local users to gain privileges and execute arbitrary commands via a crafted lookup value.\n\n \n**Affected Packages:** \n\n\nexim\n\n \n**Issue Correction:** \nRun _yum update exim_ to update your system.\n\n \n\n\n**New Packages:**\n \n \n i686: \n exim-mon-4.72-6.6.amzn1.i686 \n exim-debuginfo-4.72-6.6.amzn1.i686 \n exim-mysql-4.72-6.6.amzn1.i686 \n exim-greylist-4.72-6.6.amzn1.i686 \n exim-pgsql-4.72-6.6.amzn1.i686 \n exim-4.72-6.6.amzn1.i686 \n \n src: \n exim-4.72-6.6.amzn1.src \n \n x86_64: \n exim-pgsql-4.72-6.6.amzn1.x86_64 \n exim-mon-4.72-6.6.amzn1.x86_64 \n exim-greylist-4.72-6.6.amzn1.x86_64 \n exim-4.72-6.6.amzn1.x86_64 \n exim-debuginfo-4.72-6.6.amzn1.x86_64 \n exim-mysql-4.72-6.6.amzn1.x86_64 \n \n \n", "modified": "2014-09-19T11:48:00", "published": "2014-09-19T11:48:00", "id": "ALAS-2014-395", "href": "https://alas.aws.amazon.com/ALAS-2014-395.html", "title": "Low: exim", "type": "amazon", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}}], "ubuntu": [{"lastseen": "2019-05-29T19:21:08", "bulletinFamily": "unix", "description": "It was discovered that Exim incorrectly filtered environment variables when used with the perl_startup configuration option. If the perl_startup option was enabled, a local attacker could use this issue to escalate their privileges to the root user. This issue has been fixed by having Exim clean the complete execution environment by default on startup, including any subprocesses such as transports that call other programs. This change in behaviour may break existing installations and can be adjusted by using two new configuration options, keep_environment and add_environment. (CVE-2016-1531)\n\nPatrick William discovered that Exim incorrectly expanded mathematical comparisons twice. A local attacker could possibly use this issue to perform arbitrary file operations as the Exim user. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-2972)", "modified": "2016-03-15T00:00:00", "published": "2016-03-15T00:00:00", "id": "USN-2933-1", "href": "https://usn.ubuntu.com/2933-1/", "title": "Exim vulnerabilities", "type": "ubuntu", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}}]}