oss-security - Re: Exim CVE-2019-16928 RCE using a heap-based buffer overflow

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <5C33B233-181D-45E1-8982-7ED07AD858B1@stablepoint.com>
Date: Sat, 28 Sep 2019 01:56:11 +0100
From: Dominic Taylor <dom@...blepoint.com>
To: oss-security@...ts.openwall.com
Subject: Re: Exim CVE-2019-16928 RCE using a heap-based buffer
 overflow

Hi Heiko,

Good find, but why no embargo?

Presumably because privs are dropped so this is maybe not as bad as previous?

Regards

Dom

> On 28 Sep 2019, at 01:34, Heiko Schlittermann <hs@...marc.schlittermann.de> wrote:
> 
> CVE ID:     CVE-2019-16928
> Date:       2019-09-27 (CVE assigned)
> Version(s): from 4.92 up to and including 4.92.2
> Reporter:   areuu@...look.com
> Reference:  https://bugs.exim.org/show_bug.cgi?id=2449
> Issue:      Heap-based buffer overflow in string_vformat,
>            remote code execution seems to be possible
> 
> Conditions to be vulnerable
> ===========================
> 
> All versions from (and including) 4.92 up to (and including) 4.92.2 are
> vulnerable.
> 
> Details
> =======
> 
> There is a heap-based buffer overflow in string_vformat (string.c).
> The currently known exploit uses a extraordinary long EHLO string to
> crash the Exim process that is receiving the message. While at this
> mode of operation Exim already dropped its privileges, other paths to
> reach the vulnerable code may exist.
> 
> Mitigation
> ==========
> 
> There is - beside updating the server - no known mitigation.
> 
> Fix
> ===
> 
> We plan to publish a new security release (*will* be 4.92.3) of Exim
> during the next 48 hours, ideally before monday 8.00 UTC. (We're still
> running regression tests.) We'll send another notification as soon as
> the new release is available.
> 
> Distros may have already picked the patch mentioned below and may have
> already released a fixed version. Please check your distribution's
> changelogs.
> 
> If you can't wait, please use use our git repository http://git.exim.org/exim.git,
> checkout the branch exim-4.92.2+fixes and use the commit 478effbfd9c3cc5a627fc671d4bf94d13670d65f
> 
> A direct link to the commit is:
> https://git.exim.org/exim.git/patch/478effbfd9c3cc5a627fc671d4bf94d13670d65f
> 
> which basically does:
> 
> --- a/src/src/string.c
> +++ b/src/src/string.c
> @@ -1132,7 +1132,7 @@ store_reset(g->s + (g->size = g->ptr + 1));
> Arguments:
>   g            the growable-string
>   p            current end of data
> -  count                amount to grow by
> +  count                amount to grow by, offset from p
> */
> 
> static void
> @@ -1590,7 +1590,7 @@ while (*fp)
>        }
>       else if (g->ptr >= lim - width)
>        {
> -       gstring_grow(g, g->ptr, width - (lim - g->ptr));
> +       gstring_grow(g, g->ptr, width);
>        lim = g->size - 1;
>        gp = CS g->s + g->ptr;
>        }
> 
> We thank you for using Exim.
> 
>    Best regards from Dresden/Germany
>    Viele Grüße aus Dresden
>    Heiko Schlittermann
> --
> SCHLITTERMANN.de ---------------------------- internet & unix support -
> Heiko Schlittermann, Dipl.-Ing. (TU) - {fon,fax}: +49.351.802998{1,3} -
> gnupg encrypted messages are welcome --------------- key ID: F69376CE -
> ! key id 7CBF764A and 972EAC9F are revoked since 2015-01 ------------ -

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.