doc/doc-txt/cve-2019-16928/cve.txt

   1 CVE ID:     CVE-2019-16928
   2 Date:       2019-09-27 (CVE assigned)
   3 Version(s): from 4.92 up to and including 4.92.2
   4 Reporter:   QAX-A-TEAM <areuu@outlook.com>
   5 Reference:  https://bugs.exim.org/show_bug.cgi?id=2449
   6 Issue:      Heap-based buffer overflow in string_vformat,
   7             remote code execution seems to be possible
   8
   9 Conditions to be vulnerable
  10 ===========================
  11
  12 All versions from (and including) 4.92 up to (and including) 4.92.2 are
  13 vulnerable.
  14
  15 Details
  16 =======
  17
  18 There is a heap-based buffer overflow in string_vformat (string.c).
  19 The currently known exploit uses a extraordinary long EHLO string to
  20 crash the Exim process that is receiving the message. While at this
  21 mode of operation Exim already dropped its privileges, other paths to
  22 reach the vulnerable code may exist.
  23
  24 Mitigation
  25 ==========
  26
  27 There is - beside updating the server - no known mitigation.
  28
  29 Fix
  30 ===
  31
  32 We plan to publish a new security release (*will* be 4.92.3) of Exim
  33 during the next 48 hours, ideally before monday 8.00 UTC. (We're still
  34 running regression tests.)
  35
  36 Distros may have already picked the patch mentioned below and may have
  37 already released a fixed version. Please check your distribution's
  38 changelogs.
  39
  40 If you can't wait, please use use our git repository http://git.exim.org/exim.git,
  41 checkout the branch exim-4.92.2+fixes and use the commit 478effbfd9c3cc5a627fc671d4bf94d13670d65f
  42
  43 A direct link to the commit is:
  44 https://git.exim.org/exim.git/patch/478effbfd9c3cc5a627fc671d4bf94d13670d65f
  45
  46 which basically does:
  47
  48 --- a/src/src/string.c
  49 +++ b/src/src/string.c
  50 @@ -1132,7 +1132,7 @@ store_reset(g->s + (g->size = g->ptr + 1));
  51  Arguments:
  52    g            the growable-string
  53    p            current end of data
  54 -  count                amount to grow by
  55 +  count                amount to grow by, offset from p
  56  */
  57
  58  static void
  59 @@ -1590,7 +1590,7 @@ while (*fp)
  60         }
  61        else if (g->ptr >= lim - width)
  62         {
  63 -       gstring_grow(g, g->ptr, width - (lim - g->ptr));
  64 +       gstring_grow(g, g->ptr, width);
  65         lim = g->size - 1;
  66         gp = CS g->s + g->ptr;
  67         }
  68
  69
  70 We thank you for using Exim.