Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 50217 - <=net-mail/exim-4.33- - buffer overflow (When headers_check_syntax is configured in exim.conf)
Summary: <=net-mail/exim-4.33- - buffer overflow (When headers_check_syntax is configu...
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: GLSA Errors (show other bugs)
Hardware: All All
: Highest blocker (vote)
Assignee: Gentoo Security
: 50492 (view as bug list)
Depends on:
Reported: 2004-05-06 06:18 UTC by Carsten Lohrke (RETIRED)
Modified: 2004-05-14 13:23 UTC (History)
4 users (show)

See Also:
Package list:
Runtime testing required: ---
koon: Assigned_To? (koon)


Note You need to log in before you can comment on or make changes to this bug.
Description Carsten Lohrke (RETIRED) gentoo-dev 2004-05-06 06:18:59 UTC
two bugs in exim 3.35, one of them present in exim 4.32
Comment 1 Thierry Carrez (RETIRED) gentoo-dev 2004-05-07 12:07:52 UTC
Confirmed :

CAN-2004-0400 :
    When headers_check_syntax is configured in exim.conf a buffer
    overflow can happen during the header check.

CAN-2004-0399 only applies to exim3, which disappeared from the tree since Nov 2002.

Apparently version 4.33 does not include the fix, Debian seems to have applied a patch to it to fix, see :
Comment 2 Rajiv Aaron Manglani (RETIRED) gentoo-dev 2004-05-09 00:32:45 UTC
*** Bug 50492 has been marked as a duplicate of this bug. ***
Comment 3 Kurt Lieber (RETIRED) gentoo-dev 2004-05-09 04:59:50 UTC
adding peitolm to the bug sine he's not on the net-mail alias, but is the maintainer of exim.
Comment 4 Thierry Carrez (RETIRED) gentoo-dev 2004-05-09 11:06:36 UTC
OK I cleared this up :
4.33 is not sufficient to fix, we need 4.33 + Philip Hazel patch at :
Comment 5 Colin Morey (RETIRED) gentoo-dev 2004-05-09 11:36:02 UTC
I've added this patch to the exim 4.33-r1 ebuild that's been in portage for 3 hours or so (forgot to update this bug to say). I personally don't use headers_check_syntax, so I've not immediatly bumped it to stable, but it does appear to work, and If I can get independant confirmation from someone that uses headers_check_syntax, then I'll bump, if not I'll bump it tomorrow.
Comment 6 solar (RETIRED) gentoo-dev 2004-05-09 13:53:01 UTC
Arch maintainers please read this bug then test/(stable?) if you can.
Comment 7 solar (RETIRED) gentoo-dev 2004-05-09 19:14:47 UTC
Arch maintainer ignore the previous test request. Peti says he can test for all arches.
Comment 8 Colin Morey (RETIRED) gentoo-dev 2004-05-10 01:20:23 UTC
Some confusion here, I can test and will mark a stable for both x86 and sparc, however I've never tested exim on any other arch, even though they've got previous stable flags,
could hppa, ppc, amd64 and alpha please test.

Arch           Last Stable Revision
x86            exim-4.32-r1
sparc          exim-4.32-r1
ppc            exim-4.24-r3
hppa           exim-4.21
amd64          exim-4.21
alpha          None in Portage

Arch-maintainers, I'll leave it up to you to let me know if exim-4.33-r1 is stable for you, (minimum of being able to compile, start and send an email through it). I'm happy to do the testing myself, I just don't have access to these archs yet.
Comment 9 Thierry Carrez (RETIRED) gentoo-dev 2004-05-10 02:34:20 UTC
Adding in the relevant arch-maintainers
Comment 10 Colin Morey (RETIRED) gentoo-dev 2004-05-10 09:13:13 UTC
Philip Hazel (Exim author), has release 4.34, which includes a fix for this, so If you haven't tested 4.31-r1, or indeed if you have and haven't told me, can you test 4.34 please, I'll add this to portage within the next few hours. (I'll update this bug when it's in). 
Comment 11 Colin Morey (RETIRED) gentoo-dev 2004-05-10 11:17:18 UTC
exim 4.34 now in cvs, would the relevant archs please test.
Comment 12 Thierry Carrez (RETIRED) gentoo-dev 2004-05-11 06:21:55 UTC
GLSA drafted, waiting for stable on 4.33-r1 and/or 4.34
Comment 13 Jon Portnoy (RETIRED) gentoo-dev 2004-05-11 10:14:32 UTC
Fixed on amd64
Comment 14 Guy Martin (RETIRED) gentoo-dev 2004-05-11 15:59:38 UTC
Marked 4.34 stable on hppa.
Comment 15 Thierry Carrez (RETIRED) gentoo-dev 2004-05-12 02:17:33 UTC
Obviously I forgot a few arches,

Target keywords are : x86 ppc sparc ~alpha hppa amd64
We currently have : ~x86 ~sparc alpha hppa amd64

x86, sparc, ppc : please test and mark net-mail/exim-4.34 stable
Comment 16 Colin Morey (RETIRED) gentoo-dev 2004-05-12 06:05:00 UTC
Koon, please read back through my previous comments, specifically " I can test and will mark a stable for both x86 and sparc". so I'm removing those archs again, and we're just waiting for ppc to respond.
Comment 17 Colin Morey (RETIRED) gentoo-dev 2004-05-13 03:09:01 UTC
Well, I've marked Exim 4.34 stable on x86 and sparc, so we're just waiting for ppc to confirm then we can go ahead and start to mask the old versions
Comment 18 Kurt Lieber (RETIRED) gentoo-dev 2004-05-13 10:07:42 UTC
ppc folks -- can you please test/mark stable? 
Comment 19 Luca Barbato gentoo-dev 2004-05-13 15:14:41 UTC
marked ppc sorry for the delay
Comment 20 Thierry Carrez (RETIRED) gentoo-dev 2004-05-14 00:55:49 UTC
GLSA drafted
Comment 21 Thierry Carrez (RETIRED) gentoo-dev 2004-05-14 13:23:30 UTC
GLSA 200405-07