Heap-based buffer overflow in exim (Alpine package)

1) Heap-based buffer overflow

EUVDB-ID: #VU21399

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-16928

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the string_vformat() function in string.c when processing an overly long argument for EHLO command. A remote non-authenticated attacker can send a very long string as an argument for the EHLO command, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

exim (Alpine package): 4.92-r0 - 4.92.2-r0

CPE2.3

• cpe:2.3:o:alpine:exim_alpine_package:4.92.1-r0:*:*:*:*:alpine_linux:*:
• cpe:2.3:o:alpine:exim_alpine_package:4.92.2-r0:*:*:*:*:alpine_linux:*:
• cpe:2.3:o:alpine:exim_alpine_package:4.92-r0:*:*:*:*:alpine_linux:*:

External links

http://git.alpinelinux.org/aports/commit/?id=d2335b4e04dccdf04c50a64f5d284ca624f43782
http://git.alpinelinux.org/aports/commit/?id=88668001388ee76944d6ae7493665e620a1f4a57
http://git.alpinelinux.org/aports/commit/?id=b18f2d1006a7b58b45db8d4af133926aad7826ab
http://git.alpinelinux.org/aports/commit/?id=f7d89f85688c8091ee157cb2350c0ed40ba8346e

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.