CVE-2011-1407

Technical details about CVE-2011-1407 are not publicly provided in the connected documents. Exim is mentioned as affected in multiple advisories, but specific root cause, affected versions, and fixes are not disclosed here. Monitor for updates.

CVE-2011-1407

The DKIM implementation in Exim 4.7x before 4.76 permits matching for DKIM identities to apply to lookup items, instead of only strings, which allows remote attackers to execute arbitrary code or access a filesystem via a crafted identity...

CVE-2011-1407: Improper Input Validation

The DKIM implementation in Exim 4.7x before 4.76 permits matching for DKIM identities to apply to lookup items, instead of only strings, which allows remote attackers to execute arbitrary code or access a filesystem via a crafted identity...

CVE-2011-1407

The DKIM implementation in Exim 4.7x before 4.76 permits matching for DKIM identities to apply to lookup items, instead of only strings, which allows remote attackers to execute arbitrary code or access a filesystem via a crafted identity...

PT-2011-3105

Name of the Vulnerable Software and Affected Versions Exim versions 4.7x through 4.75 Description The issue concerns the DKIM implementation, which incorrectly allows matching for DKIM identities to apply to lookup items instead of only strings. This flaw enables remote attackers to execute...

FreeBSD : Exim -- remote code execution and information disclosure (36594c54-7be7-11e0-9838-0022156e8794)

Release notes for Exim 4.76 says : Bugzilla 1106: CVE-2011-1764 - DKIM log line was subject to a format-string attack -- SECURITY: remote arbitrary code execution. DKIM signature header parsing was double-expanded, second time unintentionally subject to list matching rules, letting the header cau...

[BSA-036] Security Update for exim4

Andreas Metzler uploaded new packages for exim4 which fixed the following security problems: CVE-2011-1407 command injection attack in DKIM processing code For the lenny-backports distribution the problems have been fixed in version 4.72-6+squeeze2bpo50+1. For the stable distribution squeeze, thi...

Debian DSA-2236-1 : exim4 - command injection

It was discovered that Exim, Debian's default mail transfer agent, is vulnerable to command injection attacks in its DKIM processing code, leading to arbitrary code execution. CVE-2011-1407 The default configuration supplied by Debian does not expose this vulnerability. The oldstable distribution...

DSA-2236-1 exim4 - command injection

Bulletin has no description...

[BSA-035] Security Update for exim4

Andreas Metzler uploaded new packages for exim4 which fixed the following security problems: CVE-2011-1764 DKIM related format string vulnerability For the lenny-backports distribution the problems have been fixed in version 4.72-6+squeeze1bpo50+1. For the stable distribution squeeze, this proble...

USN-1130-1: Exim vulnerability

It was discovered that the Exim daemon did not correctly handle format strings in DKIM headers. An unauthenticated remote attacker could send specially crafted email to run arbitrary code as the Exim user. The default compiler options for affected releases reduces the vulnerability to a denial of...

Exim -- remote code execution and information disclosure

Release notes for Exim 4.76 says: Bugzilla 1106: CVE-2011-1764 - DKIM log line was subject to a format-string attack -- SECURITY: remote arbitrary code execution. DKIM signature header parsing was double-expanded, second time unintentionally subject to list matching rules, letting the header caus...

Exim < 4.76 dkim_exim_verify_finish() DKIM-Signature Header Format String

Based on its response to a specially formatted mail message, the Exim mail server listening on this port appears to be affected by a format string vulnerability. The vulnerability is due to a failure in the dkimeximverifyfinish function to properly sanitize format string specifiers in the...

CVE-2011-1764

Format string vulnerability in the dkimeximverifyfinish function in src/dkim.c in Exim before 4.76 might allow remote attackers to execute arbitrary code or cause a denial of service daemon crash via format string specifiers in data used in DKIM logging, as demonstrated by an identity field...

Debian DSA-2232-1 : exim4 - format string vulnerability

It was discovered that Exim, the default mail transport agent in Debian, uses DKIM data obtain from DNS directly in a format string, potentially allowing malicious mail senders to execute arbitrary code. CVE-2011-1764 The oldstable distribution lenny is not affected by this problem because it doe...

[SECURITY] [DSA 2232-1] exim4 security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2232-1 [email protected] http://www.debian.org/security/ Florian Weimer May 06, 2011 http://www.debian.org/security/faq -...

exim format string vulnerability

Format string vulnerability on DKIM data obtained from DNS...

[SECURITY] [DSA 2232-1] exim4 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2232-1 [email protected] http://www.debian.org/security/ Florian Weimer May 06, 2011 http://www.debian.org/security/faq -...

DSA-2232-1 exim4 - format string vulnerability

Bulletin has no description...

Debian Security Advisory DSA 1728-1 (dkim-milter)

The remote host is missing an update to dkim-milter announced via advisory DSA 1728-1. OpenVAS Vulnerability Test $Id: deb17281.nasl 6615 2017-07-07 12:09:52Z cfischer $ Description: Auto-generated from advisory DSA 1728-1 dkim-milter Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft Inc...