| VID |
18117 |
| Severity |
20 |
| Port |
25 |
| Protocol |
TCP |
| Class |
SMTP |
| Detailed Description |
The Exim SMTP server, according to its version number, is potentially affected by a data insertion vulnerability.
Exim, developed by the University of Cambridge, is an open-source Mail Transfer Agent for various Unix platforms.
According to its banner, the version of Exim running on the remote host is prior to 4.83. It is, therefore, potentially affected by a data insertion vulnerability. A flaw exists in the expansion of arguments to math comparison functions which can cause values to be expanded twice. This could permit a local attacker to insert arbitrary data.
* Note: This check solely relied on the banner of the remote SMTP server to assess this vulnerability, so this might be a false positive.
* References:
ftp://ftp.exim.org/pub/exim/exim4/
https://lists.exim.org/lurker/message/20140722.160524.be7e58a9.en.html
* Platforms Affected:
Cambridge University, Exim versions prior to 4.83
Unix Any version
Linux Any version |
| Recommendation |
Upgrade to the latest exim package (4.83 or later), available from the Exim Internet Mailer Web site at http://www.exim.org/ |
| Related URL |
CVE-2014-2972 (CVE) |
| Related URL |
68857 (SecurityFocus) |
| Related URL |
(ISS) |
|
