Home page logo

bugtraq logo Bugtraq mailing list archives

Re: lil' exim format bug
From: Peter Radcliffe <pir () pir net>
Date: Wed, 6 Jun 2001 13:05:04 -0400

Some side bits of information.

Megyer Laszlo <lez () sch bme hu> probably said:
accept.c, line 2506:
      else if (smtp_reply != NULL) moan_smtp_batch(NULL, smtp_reply);

while moan_smtp_batch is like this:
      moan_smtp_batch(char *cmd_buffer, char *format, ...)

So when smtp_reply contains format strings, it get transformed by

Why, thank you for letting Philip Hazel (who is on holiday right now)
get a patched version out before announcing this to bugtraq.

/etc/exim.conf should have an option set:

This is not the default name or location for the exim config file.

lez:~$ /usr/sbin/exim -bS

This is not the default location for exim.

get root out of this bug.

and no one with sense runs an MTA as root, and the exim security
information strongly suggests you do not. On my relays the MTA runs as
root only once at boot time to bind to port 25 and is not suid root.

Yes, this looks like a real problem but it should also serve as a good
time to check that as little as possible runs as root.


pir                  pir () pir net                    pir () net tufts edu

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]