CVE-2017-16943

Опубликовано: 25 нояб. 2017

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Высокий

Описание

The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via vectors involving BDAT commands.

Ссылки

http://openwall.com/lists/oss-security/2017/11/25/1
Mailing List
http://openwall.com/lists/oss-security/2017/11/25/2
Mailing List
http://openwall.com/lists/oss-security/2017/11/25/3
Mailing List
http://www.openwall.com/lists/oss-security/2021/05/04/7
http://www.securitytracker.com/id/1039872
Third Party Advisory
VDB Entry
https://bugs.exim.org/show_bug.cgi?id=2199
Exploit
Issue Tracking
https://git.exim.org/exim.git/commit/4090d62a4b25782129cc1643596dc2f6e8f63bde
Patch
https://git.exim.org/exim.git/commitdiff/4e6ae6235c68de243b1c2419027472d7659aa2b4
Patch
https://github.com/LetUsFsck/PoC-Exploit-Mirror/tree/master/CVE-2017-16944
Exploit
https://lists.exim.org/lurker/message/20171125.034842.d1d75cac.en.html
Mailing List
https://www.debian.org/security/2017/dsa-4053
Third Party Advisory
http://openwall.com/lists/oss-security/2017/11/25/1
Mailing List
http://openwall.com/lists/oss-security/2017/11/25/2
Mailing List
http://openwall.com/lists/oss-security/2017/11/25/3
Mailing List
http://www.openwall.com/lists/oss-security/2021/05/04/7
http://www.securitytracker.com/id/1039872
Third Party Advisory
VDB Entry
https://bugs.exim.org/show_bug.cgi?id=2199
Exploit
Issue Tracking
https://git.exim.org/exim.git/commit/4090d62a4b25782129cc1643596dc2f6e8f63bde
Patch
https://git.exim.org/exim.git/commitdiff/4e6ae6235c68de243b1c2419027472d7659aa2b4
Patch
https://github.com/LetUsFsck/PoC-Exploit-Mirror/tree/master/CVE-2017-16944
Exploit

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:exim:exim:4.88:-:*:*:*:*:*:*

cpe:2.3:a:exim:exim:4.89:-:*:*:*:*:*:*

Конфигурация 2

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

EPSS

Процентиль: 99%

0.745

Высокий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-416

Связанные уязвимости

CVE-2017-16943

CVSS3: 9.8

ubuntu

около 8 лет назад

CVE-2017-16943

CVSS3: 9.8

redhat

около 8 лет назад

CVE-2017-16943

CVSS3: 9.8

debian

около 8 лет назад

The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 ...

openSUSE-SU-2017:3220-1

suse-cvrf

около 8 лет назад

Security update for exim

GHSA-6pmg-h497-cq5q

CVSS3: 9.8

github

больше 3 лет назад

EPSS

Процентиль: 99%

0.745

Высокий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-416