Slashdot Mirror
Remote Exim Exploit In the Wild
An anonymous reader sends word of a remote exploit in the wild against the Exim mail agent. The news comes on the exim mailing list, where a user posted that he had his exim install hacked via remote exploit giving the attacker the privilege of the mailnull user, which can lead to other possible attacks. A note up at the Internet Storm Center reminds exim users how to set up to run in unprivileged mode, and a commenter includes recompile instructions for Debian exim for added safety. The security press hasn't picked up on this story so far.
This isn't FUD. http://www.exim.org/lurker/message/20101209.150448.ee9f5ce6.en.html
http://www.exim.org/lurker/message/20101210.071922.233697ac.en.html
"Paul Fisher and I have successfully run the exploit against a copy of
Exim running in a debugger on debian lenny, and we believe it utilizes
this bug:
http://bugs.exim.org/show_bug.cgi?id=787
It was fixed in 4.70, but not in the version currently in debian
stable.
James E. Blair
UC Berkeley"
It is to the four people who actually succeeded at getting exim to run.
Caveat Utilitor
Exim is the MTA that cPanel-enabled servers use, so there is quite a large install base, particularly in the consumer-oriented web hosting space. Except a brief run of ha-ha before the mail spools get moved off to their own partition which is mounted no-exec.
Debian released patches this morning for it.
exim4 (4.69-9+lenny1) stable-security; urgency=high
* Non-maintainer upload by the Security Team.
* Fix SMTP file descriptors being leaked to processes invoked with ${run...}
* Fix memory corruption issue in string_format(). CVE-2010-4344
* Fix potential memory pool corruption issue in internal_lsearch_find().
-- Stefan Fritsch Fri, 10 Dec 2010 13:25:07 +0100
Yeah but the people who use Debian know they've got it rough enough and don't need to rub it in using Exim.
Stop whining about your karma, and learn to format paragraphs.
I use Exim. I have great clanking balls.
Fascism trolls keeping me up every night. When I starts a preachin', he HITS ME WITH HIS REICH!
Welcome to the early 1990's of memory debugging.
That string_format problem is incredibly shameful this day and age, too.
You know what? I think I'm going to run my exim4 installation under Valgrind, set to terminate at the first memory error.
(Will I still get any e-mail?)
I don't really get all the hate for Exim. I've been using it exclusively on mail servers for about 10 years, and I've never had a problem. I do remember going through a lot of reading and learning (and sometimes experimenting) the first few times I set it up (and of course when implementing a major feature change). But, for me, the task was less daunting than the alternatives. I don't really remember whether postfix was one of those alternatives I explored at the time, but now that I'm familiar with Exim, I see no reason to change.
"Somebody has to do something. It's just incredibly pathetic it has to be us."
--- Jerry Garcia
Whereas Exim doesn't *need* milters because it's sufficiently capable all by itself.
I once had a Postfix advocate look over my Exim config to see if he make Postfix do what Exim can do. He gave up.
Bet you never thought you'd read that in response to a security announcement. :)