CVE-2020-28007

Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. Because Exim operates as root in the log directory (owned by a non-root user), a symlink or hard link attack allows overwriting critical root-owned files anywhere on the filesystem.

Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. Because Exim operates as root in the log directory (owned by a non-root user), a symlink or hard link attack allows overwriting critical root-owned files anywhere on the filesystem.

• SECURITY UPDATE: Multiple security issues
  • debian/patches/CVE-2020-28007.patch
  • debian/patches/CVE-2020-28008.patch
  • debian/patches/CVE-2020-28009.patch
  • debian/patches/CVE-2020-28011.patch
  • debian/patches/CVE-2020-28012.patch
  • debian/patches/CVE-2020-28013.patch
  • debian/patches/CVE-2020-28014+CVE-2021-27216.patch
  • debian/patches/CVE-2020-28015+28021.patch
  • debian/patches/CVE-2020-28017.patch
  • debian/patches/CVE-2020-28020.patch
  • debian/patches/CVE-2020-28022.patch
  • debian/patches/CVE-2020-28024.patch
  • debian/patches/CVE-2020-28025.patch
  • debian/patches/CVE-2020-28026.patch: backport patches from upstream to correct issues.
  • CVE-2020-28007, CVE-2020-28008, CVE-2020-28009, CVE-2020-28011, CVE-2020-28012, CVE-2020-28013, CVE-2020-28014, CVE-2020-28015, CVE-2020-28017, CVE-2020-28020, CVE-2020-28021, CVE-2020-28022, CVE-2020-28024, CVE-2020-28025, CVE-2020-28026, CVE-2021-27216

This update for exim fixes the following issues:

Exim was updated to exim-4.94.2

security update (boo#1185631)

• CVE-2020-28007: Link attack in Exim's log directory
• CVE-2020-28008: Assorted attacks in Exim's spool directory
• CVE-2020-28014: Arbitrary PID file creation
• CVE-2020-28011: Heap buffer overflow in queue_run()
• CVE-2020-28010: Heap out-of-bounds write in main()
• CVE-2020-28013: Heap buffer overflow in parse_fix_phrase()
• CVE-2020-28016: Heap out-of-bounds write in parse_fix_phrase()
• CVE-2020-28015: New-line injection into spool header file (local)
• CVE-2020-28012: Missing close-on-exec flag for privileged pipe
• CVE-2020-28009: Integer overflow in get_stdinput()
• CVE-2020-28017: Integer overflow in receive_add_recipient()
• CVE-2020-28020: Integer overflow in receive_msg()
• CVE-2020-28023: Out-of-bounds read in smtp_setup_msg()
• CVE-2020-28021: New-line injection into spool header file (remote)
• CVE-2020-28022: Heap out-of-bounds read and write in extract_option()
• CVE-2020-28026: Line truncation and injection in spool_read_header()
• CVE-2020-28019: Failure to reset function pointer after BDAT error
• CVE-2020-28024: Heap buffer underflow in smtp_ungetc()
• CVE-2020-28018: Use-after-free in tls-openssl.c
• CVE-2020-28025: Heap out-of-bounds read in pdkim_finish_bodyhash()

update to exim-4.94.1

• Fix security issue in BDAT state confusion. Ensure we reset known-good where we know we need to not be reading BDAT data, as a general case fix, and move the places where we switch to BDAT mode until after various protocol state checks. Fixes CVE-2020-BDATA reported by Qualys.
• Fix security issue in SMTP verb option parsing (CVE-2020-EXOPT)
• Fix security issue with too many recipients on a message (to remove a known security problem if someone does set recipients_max to unlimited, or if local additions add to the recipient list). Fixes CVE-2020-RCPTL reported by Qualys.
• Fix CVE-2020-28016 (PFPZA): Heap out-of-bounds write in parse_fix_phrase()
• Fix security issue CVE-2020-PFPSN and guard against cmdline invoker providing a particularly obnoxious sender full name.
• Fix Linux security issue CVE-2020-SLCWD and guard against PATH_MAX better.

• bring back missing exim_db.8 manual page (fixes boo#1173693)

• bring in changes from current +fixes (lots of taint check fixes)

  • Bug 1329: Fix format of Maildir-format filenames to match other mail- related applications. Previously an 'H' was used where available info says that 'M' should be, so change to match.
  • Bug 2587: Fix pam expansion condition. Tainted values are commonly used as arguments, so an implementation trying to copy these into a local buffer was taking a taint-enforcement trap. Fix by using dynamically created buffers.
  • Bug 2586: Fix listcount expansion operator. Using tainted arguments is reasonable, eg. to count headers. Fix by using dynamically created buffers rather than a local. Do similar fixes for ACL actions 'dcc', 'log_reject_target', 'malware' and 'spam'; the arguments are expanded so could be handling tainted values.
  • Bug 2590: Fix -bi (newaliases). A previous code rearrangement had broken the (no-op) support for this sendmail command. Restore it to doing nothing, silently, and returning good status.

• update to exim 4.94

  • some transports now refuse to use tainted data in constructing their delivery location this WILL BREAK configurations which are not updated accordingly. In particular: any Transport use of $local_user which has been relying upon check_local_user far away in the Router to make it safe, should be updated to replace $local_user with $local_part_data.
  • Attempting to remove, in router or transport, a header name that ends with an asterisk (which is a standards-legal name) will now result in all headers named starting with the string…

This update for exim fixes the following issues:

exim was updated to 4.94.2:

security update (boo#1185631)

• CVE-2020-28007: Link attack in Exim's log directory
• CVE-2020-28008: Assorted attacks in Exim's spool directory
• CVE-2020-28014: Arbitrary PID file creation
• CVE-2020-28011: Heap buffer overflow in queue_run()
• CVE-2020-28010: Heap out-of-bounds write in main()
• CVE-2020-28013: Heap buffer overflow in parse_fix_phrase()
• CVE-2020-28016: Heap out-of-bounds write in parse_fix_phrase()
• CVE-2020-28015: New-line injection into spool header file (local)
• CVE-2020-28012: Missing close-on-exec flag for privileged pipe
• CVE-2020-28009: Integer overflow in get_stdinput()
• CVE-2020-28017: Integer overflow in receive_add_recipient()
• CVE-2020-28020: Integer overflow in receive_msg()
• CVE-2020-28023: Out-of-bounds read in smtp_setup_msg()
• CVE-2020-28021: New-line injection into spool header file (remote)
• CVE-2020-28022: Heap out-of-bounds read and write in extract_option()
• CVE-2020-28026: Line truncation and injection in spool_read_header()
• CVE-2020-28019: Failure to reset function pointer after BDAT error
• CVE-2020-28024: Heap buffer underflow in smtp_ungetc()
• CVE-2020-28018: Use-after-free in tls-openssl.c
• CVE-2020-28025: Heap out-of-bounds read in pdkim_finish_bodyhash()

update to exim-4.94.1

• Fix security issue in BDAT state confusion. Ensure we reset known-good where we know we need to not be reading BDAT data, as a general case fix, and move the places where we switch to BDAT mode until after various protocol state checks. Fixes CVE-2020-BDATA reported by Qualys.
• Fix security issue in SMTP verb option parsing (CVE-2020-EXOPT)
• Fix security issue with too many recipients on a message (to remove a known security problem if someone does set recipients_max to unlimited, or if local additions add to the recipient list). Fixes CVE-2020-RCPTL reported by Qualys.
• Fix CVE-2020-28016 (PFPZA): Heap out-of-bounds write in parse_fix_phrase()
• Fix security issue CVE-2020-PFPSN and guard against cmdline invoker providing a particularly obnoxious sender full name.
• Fix Linux security issue CVE-2020-SLCWD and guard against PATH_MAX better.

• bring back missing exim_db.8 manual page (fixes boo#1173693)

• bring in changes from current +fixes (lots of taint check fixes)

  • Bug 1329: Fix format of Maildir-format filenames to match other mail- related applications. Previously an 'H' was used where available info says that 'M' should be, so change to match.
  • Bug 2587: Fix pam expansion condition. Tainted values are commonly used as arguments, so an implementation trying to copy these into a local buffer was taking a taint-enforcement trap. Fix by using dynamically created buffers.
  • Bug 2586: Fix listcount expansion operator. Using tainted arguments is reasonable, eg. to count headers. Fix by using dynamically created buffers rather than a local. Do similar fixes for ACL actions 'dcc', 'log_reject_target', 'malware' and 'spam'; the arguments are expanded so could be handling tainted values.
  • Bug 2590: Fix -bi (newaliases). A previous code rearrangement had broken the (no-op) support for this sendmail command. Restore it to doing nothing, silently, and returning good status.

update to exim 4.94

• some transports now refuse to use tainted data in constructing their delivery location this WILL BREAK configurations which are not updated accordingly. In particular: any Transport use of $local_user which has been relying upon check_local_user far away in the Router to make it safe, should be updated to replace $local_user with $local_part_data.
• Attempting to remove, in router or transport, a header name that ends with an asterisk (which is a standards-legal name) will now result in all headers named starting with the string before…

This update for exim fixes the following issues:

Exim was updated to exim-4.94.2

security update (boo#1185631)

• CVE-2020-28007: Link attack in Exim's log directory
• CVE-2020-28008: Assorted attacks in Exim's spool directory
• CVE-2020-28014: Arbitrary PID file creation
• CVE-2020-28011: Heap buffer overflow in queue_run()
• CVE-2020-28010: Heap out-of-bounds write in main()
• CVE-2020-28013: Heap buffer overflow in parse_fix_phrase()
• CVE-2020-28016: Heap out-of-bounds write in parse_fix_phrase()
• CVE-2020-28015: New-line injection into spool header file (local)
• CVE-2020-28012: Missing close-on-exec flag for privileged pipe
• CVE-2020-28009: Integer overflow in get_stdinput()
• CVE-2020-28017: Integer overflow in receive_add_recipient()
• CVE-2020-28020: Integer overflow in receive_msg()
• CVE-2020-28023: Out-of-bounds read in smtp_setup_msg()
• CVE-2020-28021: New-line injection into spool header file (remote)
• CVE-2020-28022: Heap out-of-bounds read and write in extract_option()
• CVE-2020-28026: Line truncation and injection in spool_read_header()
• CVE-2020-28019: Failure to reset function pointer after BDAT error
• CVE-2020-28024: Heap buffer underflow in smtp_ungetc()
• CVE-2020-28018: Use-after-free in tls-openssl.c
• CVE-2020-28025: Heap out-of-bounds read in pdkim_finish_bodyhash()

update to exim-4.94.1

• Fix security issue in BDAT state confusion. Ensure we reset known-good where we know we need to not be reading BDAT data, as a general case fix, and move the places where we switch to BDAT mode until after various protocol state checks. Fixes CVE-2020-BDATA reported by Qualys.
• Fix security issue in SMTP verb option parsing (CVE-2020-EXOPT)
• Fix security issue with too many recipients on a message (to remove a known security problem if someone does set recipients_max to unlimited, or if local additions add to the recipient list). Fixes CVE-2020-RCPTL reported by Qualys.
• Fix CVE-2020-28016 (PFPZA): Heap out-of-bounds write in parse_fix_phrase()
• Fix security issue CVE-2020-PFPSN and guard against cmdline invoker providing a particularly obnoxious sender full name.
• Fix Linux security issue CVE-2020-SLCWD and guard against PATH_MAX better.

• bring back missing exim_db.8 manual page (fixes boo#1173693)

• bring in changes from current +fixes (lots of taint check fixes)

  • Bug 1329: Fix format of Maildir-format filenames to match other mail- related applications. Previously an 'H' was used where available info says that 'M' should be, so change to match.
  • Bug 2587: Fix pam expansion condition. Tainted values are commonly used as arguments, so an implementation trying to copy these into a local buffer was taking a taint-enforcement trap. Fix by using dynamically created buffers.
  • Bug 2586: Fix listcount expansion operator. Using tainted arguments is reasonable, eg. to count headers. Fix by using dynamically created buffers rather than a local. Do similar fixes for ACL actions 'dcc', 'log_reject_target', 'malware' and 'spam'; the arguments are expanded so could be handling tainted values.
  • Bug 2590: Fix -bi (newaliases). A previous code rearrangement had broken the (no-op) support for this sendmail command. Restore it to doing nothing, silently, and returning good status.

• update to exim 4.94

  • some transports now refuse to use tainted data in constructing their delivery location this WILL BREAK configurations which are not updated accordingly. In particular: any Transport use of $local_user which has been relying upon check_local_user far away in the Router to make it safe, should be updated to replace $local_user with $local_part_data.
  • Attempting to remove, in router or transport, a header name that ends with an asterisk (which is a standards-legal name) will now result in all headers named starting with the string…

These are all security issues fixed in the exim-4.94.2-4.2 package on the GA media of openSUSE Tumbleweed.

It was discovered that Exim contained multiple security issues. An attacker could use these issues to cause a denial of service, execute arbitrary code remotely, obtain sensitive information, or escalate local privileges.

USN-4934-1 fixed several vulnerabilities in Exim. This update provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. CVE-2020-28026 only affected Ubuntu 16.04 ESM.

Original advisory details:

It was discovered that Exim contained multiple security issues. An attacker could use these issues to cause a denial of service, execute arbitrary code remotely, obtain sensitive information, or escalate local privileges.