The remote host is affected by the vulnerability described in GLSA-200501-23 (Exim: Two buffer overflows)

    Buffer overflows have been found in the host_aton() function     (CAN-2005-0021) as well as in the spa_base64_to_bits() function     (CAN-2005-0022), which is part of the SPA authentication code.
  Impact :

    A local attacker could trigger the buffer overflow in host_aton()     by supplying an illegal IPv6 address with more than 8 components, using     a command line option. The second vulnerability could be remotely     exploited during SPA authentication, if it is enabled on the server.
    Both buffer overflows can potentially lead to the execution of     arbitrary code.
  Workaround :

    There is no known workaround at this time.

リモートホストは、メッセージ転送エージェント（SMTP）であるEximを実行しています。

Eximは、IPv6アドレスと、SPA認証バッファオーバーフローに脆弱であると報告されています。攻撃者がこの問題を悪用して、リモートホストで任意のコードを実行する可能性があります。

Eximは、これらの欠陥を悪用するために、SPA AuthenticationまたはIPv6サポートで構成する必要があります。

さらに、Eximはコマンドラインオプション処理における2つのローカルオーバーフローに対して脆弱です。しかし、Nessusはそれについてテストしていません。

このエラータは、2つの比較的マイナーなセキュリティ問題を修正します。これは、過去数週間において、Exim で発見されました。Common Vulnerabilities and Exposures プロジェクト（cve.mitre.org）は、これらに対して、それぞれ CVE-2005-0021 および CVE-2005-0022 という名前を割り当てています。

1.host_aton() 関数は、9 つ以上のコンポーネントを持つ不正な IPv6 アドレスで存在する場合、バッファオーバーフローが発生する可能性があります。

2.第 2 のレポートでは、spa_base64_to_bits() 関数におけるバッファオーバーフローを説明しています。これは、SPA 認証のコードの一部です。このコードは、Samba プロジェクトから発生しています。このオーバーフローは、SPA 認証が使用されている場合にのみ悪用可能です。

注意：Tenable Network Security は、前述の記述ブロックを Fedora セキュリティアドバイザリから直接抽出しています。Tenable では、できる限り新たな問題を持ち込まないように、自動的に整理して書式設定するようにしています。

遠端主機正在執行訊息傳輸代理程式 Exim (SMTP)。

據報告，Exim 容易受到 IPv6 位址和 SPA 驗證緩衝區溢位弱點影響。攻擊者可利用此問題，在遠端主機上執行任意程式碼。

必須將 Exim 設定為使用 SPA 驗證或 IPv6 支援才能利用這些缺陷。

此外，Exim 容易受到命令行選項處理中兩個本機溢位弱點影響。但 Nessus 尚未測試這些弱點。

此勘误表修复了过去几周内在 Exim 中发现的两个相对次要的安全问题。通用漏洞和暴露计划 (cve.mitre.org) 已分别为这些问题分配了名称 CVE-2005-0021 和 CVE-2005-0022。

1.如果为其提供具有超过 8 个组件的非法 IPv6 地址，host_aton() 函数可造成缓冲区溢出。

2.第二份报告说明了函数 spa_base64_to_bits() 中的缓冲区溢出，该函数是 SPA 认证代码的一部分。此代码来源于 Samba 项目。仅当您使用 SPA 认证时，该溢出才能被加以利用。

请注意，Tenable Network Security 已直接从 Fedora 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下尽可能进行了自动整理和排版。

远程主机正在运行消息传输代理 Exim (SMTP)。

据报告，Exim 容易受到 IPv6 地址和 SPA 身份验证缓冲区溢出漏洞的影响。利用此问题的攻击者可能会在远程主机上执行任意代码。

Exim 必须配置有 SPA 身份验证或 IPv6 支持才能利用这些缺陷。

此外，Exim 在处理命令行选项时容易受到两个本地溢出漏洞的影响。但 Nessus 未对其进行测试。

The remote host is running Exim, a message transfer agent (SMTP).

It is reported that Exim is prone to an IPv6 Address and an SPA authentication buffer overflow. An attacker, exploiting this issue, may be able to execute arbitrary code on the remote host.

Exim must be configured with SPA Authentication or with IPv6 support to exploit those flaws.

In addition, Exim is vulnerable to two local overflows in command line option handling. However, Nessus has not tested for these.

This erratum fixes two relatively minor security issues which were discovered in Exim in the last few weeks. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2005-0021 and CVE-2005-0022 to these, respectively.

1. The function host_aton() can overflow a buffer if it is presented with an illegal IPv6 address that has more than 8 components.

2. The second report described a buffer overflow in the function spa_base64_to_bits(), which is part of the code for SPA authentication. This code originated in the Samba project. The overflow can be exploited only if you are using SPA authentication.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Philip Hazel announced a buffer overflow in the host_aton function in exim, the default mail-transport-agent in Debian, which can lead to the execution of arbitrary code via an illegal IPv6 address.

Philip Hazel announced a buffer overflow in the host_aton function in exim-tls, the SSL-enabled version of the default mail-transport-agent in Debian, which can lead to the execution of arbitrary code via an illegal IPv6 address.

此錯字勘誤表可修正兩個相對次要的安全性問題，這兩個問題於幾星期前在 Exim 中發現。Common Vulnerabilities and Exposures 專案 (cve.mitre.org) 已將名稱 CVE-2005-0021 和 CVE-2005-0022 分別指派給這些問題。

1。如果 host_aton() 函式與具有超過 8 個元件的非法 IPv6 位址一起呈現，其可造成緩衝區溢位。

2。第二份報告說明函式 spa_base64_to_bits() (SPA 驗證程式碼的一部分) 中有一個緩衝區溢位問題。此程式碼源自於 Samba 專案。只有使用 SPA 驗證的使用者可惡意利用該溢位問題。

請注意，Tenable Network Security 已直接從 Fedora 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2005:025 advisory.

  - security flaw (CVE-2005-0021, CVE-2005-0022)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A flaw has been found in the host_aton() function, which can overflow a buffer if it is presented with an illegal IPv6 address that has more than 8 components. When supplying certain command line parameters, the input was not checked, so that a local attacker could possibly exploit the buffer overflow to run arbitrary code with the privileges of the Exim mail server. (CAN-2005-0021)

Additionally, the BASE64 decoder in the SPA authentication handler did not check the size of its output buffer. By sending an invalid BASE64 authentication string, a remote attacker could overflow the buffer, which could possibly be exploited to run arbitrary code with the privileges of the Exim mail server. (CAN-2005-0022).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

1. The function host_aton() can overflow a buffer if it is presented with an illegal IPv6 address that has more than 8 components.

2. The second report described a buffer overflow in the function spa_base64_to_bits(), which is part of the code for SPA authentication.

ID	名稱	產品	系列	已發布	已更新	嚴重性
16414	GLSA-200501-23 : Exim: Two buffer overflows	Nessus	Gentoo Local Security Checks	2005/2/14	2021/1/6	high
16111	Exim < 4.44複数のオーバーフロー	Nessus	SMTP problems	2005/1/7	2018/7/10	high
62248	Fedora Core 3：exim-4.43-1.FC3.1（2005-002）	Nessus	Fedora Local Security Checks	2012/9/24	2021/1/11	high
16111	Exim < 4.44 多個溢位弱點	Nessus	SMTP problems	2005/1/7	2018/7/10	high
62248	Fedora Core 3：exim-4.43-1.FC3.1 (2005-002)	Nessus	Fedora Local Security Checks	2012/9/24	2021/1/11	high
16111	Exim < 4.44 多个溢出	Nessus	SMTP problems	2005/1/7	2018/7/10	high
16111	Exim < 4.44 Multiple Overflows	Nessus	SMTP problems	2005/1/7	2018/7/10	high
16113	Fedora Core 2 : exim-4.43-1.FC2.1 (2005-001)	Nessus	Fedora Local Security Checks	2005/1/7	2021/1/11	high
16132	Debian DSA-635-1 : exim - buffer overflow	Nessus	Debian Local Security Checks	2005/1/12	2021/1/4	high
16155	Debian DSA-637-1 : exim-tls - buffer overflow	Nessus	Debian Local Security Checks	2005/1/13	2021/1/4	high
62248	Fedora Core 3 : exim-4.43-1.FC3.1 (2005-002)	Nessus	Fedora Local Security Checks	2012/9/24	2021/1/11	high
17165	RHEL 4 : exim (RHSA-2005:025)	Nessus	Red Hat Local Security Checks	2005/2/22	2024/4/27	critical
20674	Ubuntu 4.10 : exim4 vulnerabilities (USN-56-1)	Nessus	Ubuntu Local Security Checks	2006/1/15	2021/1/19	high
19118	FreeBSD : exim -- two buffer overflow vulnerabilities (ca9ce879-5ebb-11d9-a01c-0050569f0001)	Nessus	FreeBSD Local Security Checks	2005/7/13	2021/1/6	high
62248	Fedora Core 3 : exim-4.43-1.FC3.1 (2005-002)	Nessus	Fedora Local Security Checks	2012/9/24	2021/1/11	high

偵測

搜尋 Plugin

high

high

high

high

high

high

high

high

high

high

high

critical

high

high

high