Synopsis

exim security update

Type/Severity

Security Advisory: Moderate

Topic

Updated exim packages that resolve security issues are now available for Red
Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red Hat
Security Response Team.

Description

Exim is a mail transport agent (MTA) developed at the University of
Cambridge for use on Unix systems connected to the Internet.

A buffer overflow was discovered in the spa_base64_to_bits function in
Exim, as originally obtained from Samba code. If SPA authentication is
enabled, a remote attacker may be able to exploit this vulnerability to
execute arbitrary code as the 'exim' user. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CAN-2005-0022 to
this issue. Please note that SPA authentication is not enabled by default
in Red Hat Enterprise Linux 4.

Buffer overflow flaws were discovered in the host_aton and
dns_build_reverse functions in Exim. A local user can trigger these flaws
by executing exim with carefully crafted command line arguments and may be
able to gain the privileges of the 'exim' account. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name
CAN-2005-0021 to this issue.

Users of Exim are advised to update to these erratum packages which contain
backported patches to correct these issues.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:

up2date

For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:

http://www.redhat.com/docs/manuals/enterprise/

Affected Products

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc

Fixes

• BZ - 144099 - CAN-2005-0021 exim security issues (CAN-2005-0022)

CVEs

• CVE-2005-0021
• CVE-2005-0022

References

• http://www.exim.org/mail-archives/exim-users/Week-of-Mon-20050103/msg00028.html

Red Hat Enterprise Linux Server 4

SRPM
exim-4.43-1.RHEL4.3.src.rpm	SHA-256: af4cc1086de7ccd5ef53ab06dd3b347ac4a11b5d09587738eec66e0aa3417057
x86_64
exim-4.43-1.RHEL4.3.x86_64.rpm	SHA-256: 037889a5b66a5492c02a9f2e2d5086a5cfd22dcb4e7ced3c776e7615520f26b5
exim-4.43-1.RHEL4.3.x86_64.rpm	SHA-256: 037889a5b66a5492c02a9f2e2d5086a5cfd22dcb4e7ced3c776e7615520f26b5
exim-doc-4.43-1.RHEL4.3.x86_64.rpm	SHA-256: c28c5603168ed84174ab2635b9730cef54bad16e7eb89ef7d55fd37a757554ce
exim-doc-4.43-1.RHEL4.3.x86_64.rpm	SHA-256: c28c5603168ed84174ab2635b9730cef54bad16e7eb89ef7d55fd37a757554ce
exim-mon-4.43-1.RHEL4.3.x86_64.rpm	SHA-256: 8ac90311b68f02c7ce5efc8904289167f0a832ba9f23cfb444280f97699f8811
exim-mon-4.43-1.RHEL4.3.x86_64.rpm	SHA-256: 8ac90311b68f02c7ce5efc8904289167f0a832ba9f23cfb444280f97699f8811
exim-sa-4.43-1.RHEL4.3.x86_64.rpm	SHA-256: b85976cc35708ecfe6b3978e8f3c95d506e9ae6148cd38e08d71b2a042d818ce
exim-sa-4.43-1.RHEL4.3.x86_64.rpm	SHA-256: b85976cc35708ecfe6b3978e8f3c95d506e9ae6148cd38e08d71b2a042d818ce
ia64
exim-4.43-1.RHEL4.3.ia64.rpm	SHA-256: 916467a5ff6111773b1791c23160f751dd0a9efb47701234ea91bcc1d26a2b51
exim-4.43-1.RHEL4.3.ia64.rpm	SHA-256: 916467a5ff6111773b1791c23160f751dd0a9efb47701234ea91bcc1d26a2b51
exim-doc-4.43-1.RHEL4.3.ia64.rpm	SHA-256: 5fcf9d8acc1910b9de8794ac658a99ca0c5f42a6319c7f410a48d044b91aa992
exim-doc-4.43-1.RHEL4.3.ia64.rpm	SHA-256: 5fcf9d8acc1910b9de8794ac658a99ca0c5f42a6319c7f410a48d044b91aa992
exim-mon-4.43-1.RHEL4.3.ia64.rpm	SHA-256: ea82d90bbe4f0c3eff85bdc1c70fbdd20d525414767b67b8387048e701a8b3b2
exim-mon-4.43-1.RHEL4.3.ia64.rpm	SHA-256: ea82d90bbe4f0c3eff85bdc1c70fbdd20d525414767b67b8387048e701a8b3b2
exim-sa-4.43-1.RHEL4.3.ia64.rpm	SHA-256: ac67470ab653804e105431b66218131d3de2c2e39866e1b21632d4b7d306b5bc
exim-sa-4.43-1.RHEL4.3.ia64.rpm	SHA-256: ac67470ab653804e105431b66218131d3de2c2e39866e1b21632d4b7d306b5bc
i386
exim-4.43-1.RHEL4.3.i386.rpm	SHA-256: 41b833289e2a9cbf41fd3fcf421dd9824996666d942a5ed3e8fd31ddccafaa7e
exim-4.43-1.RHEL4.3.i386.rpm	SHA-256: 41b833289e2a9cbf41fd3fcf421dd9824996666d942a5ed3e8fd31ddccafaa7e
exim-doc-4.43-1.RHEL4.3.i386.rpm	SHA-256: 3ed30c922ef8d155d5fe2b5574073858f0205e13a0b2ad54b4666050de00e048
exim-doc-4.43-1.RHEL4.3.i386.rpm	SHA-256: 3ed30c922ef8d155d5fe2b5574073858f0205e13a0b2ad54b4666050de00e048
exim-mon-4.43-1.RHEL4.3.i386.rpm	SHA-256: 8afbaae06bccd0e176a6c886d4bf4af6b3d8dff664825abf962aa04534dd69c5
exim-mon-4.43-1.RHEL4.3.i386.rpm	SHA-256: 8afbaae06bccd0e176a6c886d4bf4af6b3d8dff664825abf962aa04534dd69c5
exim-sa-4.43-1.RHEL4.3.i386.rpm	SHA-256: f82c977a1ad821417edaa06e9d0f42c1d3648c09f878c57c10c1085b3328cab9
exim-sa-4.43-1.RHEL4.3.i386.rpm	SHA-256: f82c977a1ad821417edaa06e9d0f42c1d3648c09f878c57c10c1085b3328cab9

Red Hat Enterprise Linux Workstation 4

SRPM
exim-4.43-1.RHEL4.3.src.rpm	SHA-256: af4cc1086de7ccd5ef53ab06dd3b347ac4a11b5d09587738eec66e0aa3417057
x86_64
exim-4.43-1.RHEL4.3.x86_64.rpm	SHA-256: 037889a5b66a5492c02a9f2e2d5086a5cfd22dcb4e7ced3c776e7615520f26b5
exim-doc-4.43-1.RHEL4.3.x86_64.rpm	SHA-256: c28c5603168ed84174ab2635b9730cef54bad16e7eb89ef7d55fd37a757554ce
exim-mon-4.43-1.RHEL4.3.x86_64.rpm	SHA-256: 8ac90311b68f02c7ce5efc8904289167f0a832ba9f23cfb444280f97699f8811
exim-sa-4.43-1.RHEL4.3.x86_64.rpm	SHA-256: b85976cc35708ecfe6b3978e8f3c95d506e9ae6148cd38e08d71b2a042d818ce
ia64
exim-4.43-1.RHEL4.3.ia64.rpm	SHA-256: 916467a5ff6111773b1791c23160f751dd0a9efb47701234ea91bcc1d26a2b51
exim-doc-4.43-1.RHEL4.3.ia64.rpm	SHA-256: 5fcf9d8acc1910b9de8794ac658a99ca0c5f42a6319c7f410a48d044b91aa992
exim-mon-4.43-1.RHEL4.3.ia64.rpm	SHA-256: ea82d90bbe4f0c3eff85bdc1c70fbdd20d525414767b67b8387048e701a8b3b2
exim-sa-4.43-1.RHEL4.3.ia64.rpm	SHA-256: ac67470ab653804e105431b66218131d3de2c2e39866e1b21632d4b7d306b5bc
i386
exim-4.43-1.RHEL4.3.i386.rpm	SHA-256: 41b833289e2a9cbf41fd3fcf421dd9824996666d942a5ed3e8fd31ddccafaa7e
exim-doc-4.43-1.RHEL4.3.i386.rpm	SHA-256: 3ed30c922ef8d155d5fe2b5574073858f0205e13a0b2ad54b4666050de00e048
exim-mon-4.43-1.RHEL4.3.i386.rpm	SHA-256: 8afbaae06bccd0e176a6c886d4bf4af6b3d8dff664825abf962aa04534dd69c5
exim-sa-4.43-1.RHEL4.3.i386.rpm	SHA-256: f82c977a1ad821417edaa06e9d0f42c1d3648c09f878c57c10c1085b3328cab9

Red Hat Enterprise Linux Desktop 4

SRPM
exim-4.43-1.RHEL4.3.src.rpm	SHA-256: af4cc1086de7ccd5ef53ab06dd3b347ac4a11b5d09587738eec66e0aa3417057
x86_64
exim-4.43-1.RHEL4.3.x86_64.rpm	SHA-256: 037889a5b66a5492c02a9f2e2d5086a5cfd22dcb4e7ced3c776e7615520f26b5
exim-doc-4.43-1.RHEL4.3.x86_64.rpm	SHA-256: c28c5603168ed84174ab2635b9730cef54bad16e7eb89ef7d55fd37a757554ce
exim-mon-4.43-1.RHEL4.3.x86_64.rpm	SHA-256: 8ac90311b68f02c7ce5efc8904289167f0a832ba9f23cfb444280f97699f8811
exim-sa-4.43-1.RHEL4.3.x86_64.rpm	SHA-256: b85976cc35708ecfe6b3978e8f3c95d506e9ae6148cd38e08d71b2a042d818ce
i386
exim-4.43-1.RHEL4.3.i386.rpm	SHA-256: 41b833289e2a9cbf41fd3fcf421dd9824996666d942a5ed3e8fd31ddccafaa7e
exim-doc-4.43-1.RHEL4.3.i386.rpm	SHA-256: 3ed30c922ef8d155d5fe2b5574073858f0205e13a0b2ad54b4666050de00e048
exim-mon-4.43-1.RHEL4.3.i386.rpm	SHA-256: 8afbaae06bccd0e176a6c886d4bf4af6b3d8dff664825abf962aa04534dd69c5
exim-sa-4.43-1.RHEL4.3.i386.rpm	SHA-256: f82c977a1ad821417edaa06e9d0f42c1d3648c09f878c57c10c1085b3328cab9

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
exim-4.43-1.RHEL4.3.src.rpm	SHA-256: af4cc1086de7ccd5ef53ab06dd3b347ac4a11b5d09587738eec66e0aa3417057
s390x
exim-4.43-1.RHEL4.3.s390x.rpm	SHA-256: ecbe0108c2b5f5c53b8e7e5eeb6a91daae8e3cc47000b2c2e25a75b882e928c8
exim-doc-4.43-1.RHEL4.3.s390x.rpm	SHA-256: c3e085c45d1ce2773a3c8cd3a89a80976c70186941d61e35720163990ec9d474
exim-mon-4.43-1.RHEL4.3.s390x.rpm	SHA-256: ad4cc1e3fff686e309afdce539cd65dc3e02bde7e55b88303c959a610bc2c50b
exim-sa-4.43-1.RHEL4.3.s390x.rpm	SHA-256: 43b6b74c5b2338e22a629e1af34c397b1ce9828d47c7313578a47da33506f716
s390
exim-4.43-1.RHEL4.3.s390.rpm	SHA-256: e17c96639c19180d95ae57a79ddb7e6057f4f12714676d573fa49ecb6974bd89
exim-doc-4.43-1.RHEL4.3.s390.rpm	SHA-256: 5737ac70e76cd845bb2538a94ac41ca010fb935a171fa162900b9911c8ed29dc
exim-mon-4.43-1.RHEL4.3.s390.rpm	SHA-256: 317c2926ba4965d1934ac2b429d43a9b3311d71538203d085d0de0a65bb3e470
exim-sa-4.43-1.RHEL4.3.s390.rpm	SHA-256: 1617886928e8df0e989b83e8a47689d514ea916b06744cb47c3f638aaf4110ac

Red Hat Enterprise Linux for Power, big endian 4

SRPM
exim-4.43-1.RHEL4.3.src.rpm	SHA-256: af4cc1086de7ccd5ef53ab06dd3b347ac4a11b5d09587738eec66e0aa3417057
ppc
exim-4.43-1.RHEL4.3.ppc.rpm	SHA-256: 7e73e5346be13ebf3e81fa0931588993b33c897dfaaa257fd2010bf71f59e93c
exim-doc-4.43-1.RHEL4.3.ppc.rpm	SHA-256: 194f16b71f415c19e64efc90761e2d331ca674993cb87e911410d8a9993b6f2d
exim-mon-4.43-1.RHEL4.3.ppc.rpm	SHA-256: eaaefb6585163f6d2ae1a170910a08789e34610c319f5ed900f5ddfb6e970856
exim-sa-4.43-1.RHEL4.3.ppc.rpm	SHA-256: d55bbb6b2d35823a02fb096e9b97ff4a4be48c2e9eb7aae187d9750c36bd0be3