Bugzilla – Bug 1044692
VUL-0: CVE-2017-1000369: exim: Qualys new root/setuid privilege escalation method 05-2017
Last modified: 2024-07-15 17:05:02 UTC
Created attachment 729304 [details] diff Heiko Schlittermann <hs@schlittermann.de> (Do 15 Jun 2017 00:00:04 CEST): > Hello packagers of Exim, … > We got CVE-2017-1000369 for a vulnerability that can be exploited > through Exim. As Exim itself is not exploitable, and as we do not > understand the fix as a security issue in Exim itself, we do not see a > reason for a point release. > > We have a small patch already. As soon as possible I'll publish an > exim-4_89+fixes branch. I'll put there some additional backported > (from devel branch) minor security enhancements and send you an > notification as soon as the +fixes branch is available. As we are somewhat delayed with creating a new (point?) release, I'd kindly ask you to include tis commit into your packaged versions of Exim: 65e061b76867a9ea7aeeb535341b790b90ae6c21 There should be no impact for ordninary users of Exim. It prevents the multiple use of '-p <protocol>' option for the command line invocation. (There is probably no use case for doing so.) By this small patch we can help improving the security of the underlying system. This commit is part of the current, but not yet released master branch. We'll prepare a new Exim version, or do a point release, including this commit. Until this is done, please include this patch manually. In case you do not have access to the Git repo, the patch is attached to this message. It should apply cleanly. Thank you for your understanding.
CRD: 2017-06-19 15:00 UTC
This issue is now public https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt
submitted exim for 42.2 and factory. 42.2 released. factory is waiting for package / project maitnainer acceptance.
openSUSE-SU-2017:1625-1: An update that fixes one vulnerability is now available. Category: security (important) Bug References: 1044692 CVE References: CVE-2017-1000369 Sources used: openSUSE Leap 42.2 (src): exim-4.86.2-10.3.1
openSUSE-SU-2017:2289-1: An update that fixes three vulnerabilities is now available. Category: security (important) Bug References: 1015930,1044692,1046971 CVE References: CVE-2016-1531,CVE-2016-9963,CVE-2017-1000369 Sources used: openSUSE Leap 42.3 (src): exim-4.86.2-14.1 openSUSE Leap 42.2 (src): exim-4.86.2-10.6.1
This is an autogenerated message for OBS integration: This bug (1044692) was mentioned in https://build.opensuse.org/request/show/1187597 Backports:SLE-15-SP6 / exim