2280 matches found
RHEL 4 : exim (RHSA-2005:025)
The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2005:025 advisory. Exim is a mail transport agent MTA developed at the University of Cambridge for use on Unix systems connected to the Internet. A buffer...
security flaw
Multiple buffer overflows in Exim before 4.43 may allow attackers to execute arbitrary code via 1 an IPv6 address with more than 8 components, as demonstrated using the -be command line option, which triggers an overflow in the hostaton function, or 2 the -bh command line option or dnsdb PTR...
security flaw
Buffer overflow in the spabase64tobits function in Exim before 4.43, as originally obtained from Samba code, and as called by the authspaclient function, may allow attackers to execute arbitrary code during SPA authentication...
Moderate: Red Hat Security Advisory: exim security update
Updated exim packages that resolve security issues are now available for Red Hat Enterprise Linux 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Exim is a mail transport agent MTA developed at the University of Cambridge for use on Unix...
GLSA-200501-23 : Exim: Two buffer overflows
The remote host is affected by the vulnerability described in GLSA-200501-23 Exim: Two buffer overflows Buffer overflows have been found in the hostaton function CAN-2005-0021 as well as in the spabase64tobits function CAN-2005-0022, which is part of the SPA authentication code. Impact : A local...
Exim <= 4.43 auth_spa_server() Remote PoC Exploit
No description provided by source. / ecl-eximspa.c Yuri Gushin [email protected] Howdy : This is pretty straightforward, an exploit for the recently discovered vulnerability in Exim's all versions prior to and including 4.43 SPA authentication code - spabase64tobits will overflow a fixed-size...
Exim <= 4.43 auth_spa_server() Remote PoC Exploit
Exploit for linux platform in category remote exploits ================================================= Exim Howdy : This is pretty straightforward, an exploit for the recently discovered vulnerability in Exim's all versions prior to and including 4.43 SPA authentication code - spabase64tobits...
Exim 4.43 - 'auth_spa_server()' Remote
/ ecl-eximspa.c Yuri Gushin Howdy : This is pretty straightforward, an exploit for the recently discovered vulnerability in Exim's all versions prior to and including 4.43 SPA authentication code - spabase64tobits will overflow a fixed-size buffer since there's no decent boundary checks before it...
Exim 4.43 - auth_spa_server() Remote
Exim 4.43 - authspaserver Remote / ecl-eximspa.c Yuri Gushin Howdy : This is pretty straightforward, an exploit for the recently discovered vulnerability in Exim's all versions prior to and including 4.43 SPA authentication code - spabase64tobits will overflow a fixed-size buffer since there's no...
Exim <= 4.42 Local Root Exploit
Exploit for linux platform in category local exploits =============================== Exim include int mainint argc, char argv char addrptr; addrptr = getenvargv1; printf"%s @ %p\n", argv1, addrptr; return 0; gcc @env.c -o @env cp @env /usr/bin cd /usr/exim/bin CODE=perl -e 'print...
Exim 4.42 - Local Privilege Escalation
Exim 4.42 - Local Privilege Escalation !/bin/sh Local Lame R00T sploit for exim include int mainint argc, char argv char addrptr; addrptr = getenvargv1; printf"%s @ %p\n", argv1, addrptr; return 0; gcc @env.c -o @env cp @env /usr/bin cd /usr/exim/bin CODE=perl -e 'print...
Exim <= 4.42 Local Root Exploit
No description provided by source. !/bin/sh Local Lame R00T sploit for exim = 4.42 by Dark Eagle My First Coding Release In bash Unl0ck Research Team More Effective than C-code. @env.c content: include stdio.h include string.h int mainint argc, char argv char addrptr; addrptr = getenvargv1;...
Exim 4.42 - Local Privilege Escalation
!/bin/sh Local Lame R00T sploit for exim include int mainint argc, char argv char addrptr; addrptr = getenvargv1; printf"%s @ %p\n", argv1, addrptr; return 0; gcc @env.c -o @env cp @env /usr/bin cd /usr/exim/bin CODE=perl -e 'print...
Exim vulnerable to buffer overflow via the dns_build_reverse() routine
Overview The Exim Mail Transfer Agent MTA contains a buffer overflow that allows a local attacker to execute arbitrary code. Description Exim MTA is an open-source mail transport agent distributed by the University of Cambridge. A lack of input validation on user supplied data may allow a buffer...
exim.pl.txt
This proof-of-concept demonstrates the existence of the vulnerability reported by iDEFENSE iDEFENSE Security Advisory 01.14.05. In this report it was explained that a sequence like the one below did overflowed some internal buffer: /usr/bin/exim -bh ::%Aperl -e 'print pack'L',0xdeadbeef x 256' It...
Exim buffer overflows
Buffer overflows on SPA-authentications and IPv6 names resolution...
iDEFENSE Security Advisory 01.14.05: Exim dns_buld_reverse() Buffer Overflow Vulnerability
Exim dnsbuldreverse Buffer Overflow Vulnerability iDEFENSE Security Advisory 01.14.05 www.idefense.com/application/poi/display?id=183&type=vulnerabilities January 14, 2005 I. BACKGROUND Exim is a mail transfer agent MTA for Unix systems similar to sendmail. More information is available at the...
Exim 4.41 - 'dns_build_reverse' Local Buffer Overflow
/ This proof-of-concept demonstrates the existence of the vulnerability reported by iDEFENSE iDEFENSE Security Advisory 01.14.05. It has been tested against exim-4.41 under Debian GNU/Linux. Note that setuid is not included in the shellcode to avoid script-kidding. My RET is 0xbffffae4, but fb.pl...
Exim 4.41 - dns_build_reverse Local Buffer Overflow
Exim 4.41 - dnsbuildreverse Local Buffer Overflow / This proof-of-concept demonstrates the existence of the vulnerability reported by iDEFENSE iDEFENSE Security Advisory 01.14.05. It has been tested against exim-4.41 under Debian GNU/Linux. Note that setuid is not included in the shellcode to avo...
Exim <= 4.41 dns_build_reverse Local Exploit PoC
Exploit for linux platform in category local exploits ================================================ Exim int main int argc, char argv static char shellcode= "\xeb\x17\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b\x89"...