Vulnerability Description
Exim supports the use of multiple "-p" command line arguments which are malloc()'ed and never free()'ed, used in conjunction with other issues allows attackers to cause arbitrary code execution. This affects exim version 4.89 and earlier. Please note that at this time upstream has released a patch (commit 65e061b76867a9ea7aeeb535341b790b90ae6c21), but it is not known if a new point release is available that addresses this issue at this time.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Exim | Exim | <= 4.87.1 |
| Debian | Debian Linux | 8.0 |
Related Weaknesses (CWE)
References
- http://www.debian.org/security/2017/dsa-3888Third Party Advisory
- http://www.securityfocus.com/bid/99252Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1038779Third Party AdvisoryVDB Entry
- https://access.redhat.com/security/cve/CVE-2017-1000369Vendor Advisory
- https://github.com/Exim/exim/commit/65e061b76867a9ea7aeeb535341b790b90ae6c21MitigationThird Party Advisory
- https://security.gentoo.org/glsa/201709-19Third Party Advisory
- https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txtThird Party Advisory
- http://www.debian.org/security/2017/dsa-3888Third Party Advisory
- http://www.securityfocus.com/bid/99252Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1038779Third Party AdvisoryVDB Entry
- https://access.redhat.com/security/cve/CVE-2017-1000369Vendor Advisory
- https://github.com/Exim/exim/commit/65e061b76867a9ea7aeeb535341b790b90ae6c21MitigationThird Party Advisory
- https://security.gentoo.org/glsa/201709-19Third Party Advisory
- https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txtThird Party Advisory
FAQ
What is CVE-2017-1000369?
CVE-2017-1000369 is a vulnerability with a CVSS score of 4.0 (MEDIUM). Exim supports the use of multiple "-p" command line arguments which are malloc()'ed and never free()'ed, used in conjunction with other issues allows attackers to cause arbitrary code execution. This ...
How severe is CVE-2017-1000369?
CVE-2017-1000369 has been rated MEDIUM with a CVSS base score of 4.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2017-1000369?
Check the references section above for vendor advisories and patch information. Affected products include: Exim Exim, Debian Debian Linux.