Exim Mail Transfer Agent (MTA) 远程命令执行漏洞

详细信息

漏洞类型

输入验证错误

漏洞描述

Exim是一个运行于Unix系统中的开源消息传送代理（MTA），它主要负责邮件的路由、转发和投递。Exim版本4.87至4.91（含）中发现了一个缺陷。/src/deliver.c的deliver_message（）函数中的收件人地址验证不正确。可能导致远程命令执行。

修复建议

升级至Exim网站上提供的最新版本（4.92或更高版本）： https://exim.org/static/doc/security/CVE-2019-10149.txt

参考链接

• https://www.debian.org/security/2019/dsa-4456

  OSV · vendor-advisory

• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00020.html

  OSV · vendor-advisory

• https://usn.ubuntu.com/4010-1/

  OSV · vendor-advisory

• http://packetstormsecurity.com/files/153218/Exim-4.9.1-Remote-Command-Execution.html

  OSV · VDB Entry · Exploit · Third Party Advisory

• http://seclists.org/fulldisclosure/2019/Jun/16

  OSV · mailing-list

• https://exim.org/static/doc/security/CVE-2019-10149.txt

  CVE · Vendor Advisory

• https://access.redhat.com/security/cve/cve-2019-10149
• https://bugzilla.redhat.com/show_bug.cgi?id=1715237
• http://www.exim.org/
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10149

  OSV · Third Party Advisory · Issue Tracking

• https://www.exim.org/static/doc/security/CVE-2019-10149.txt

  OSV · Vendor Advisory

• http://www.openwall.com/lists/oss-security/2019/06/05/4

  OSV · mailing-list

• http://www.openwall.com/lists/oss-security/2019/06/05/3

  OSV · mailing-list

• http://www.openwall.com/lists/oss-security/2019/06/05/2

  OSV · mailing-list

• http://www.openwall.com/lists/oss-security/2019/06/06/1

  OSV · mailing-list

• https://security.gentoo.org/glsa/201906-01

  OSV · vendor-advisory

• https://seclists.org/bugtraq/2019/Jun/5

  OSV · mailing-list

• https://www.auscert.org.au/bulletins/ESB-2019.2020/
• https://packetstormsecurity.com/files/153312/Exim-4.91-Local-Privilege-Escalation.html

  CVE · VDB Entry · Exploit · Third Party Advisory

• https://nvd.nist.gov/vuln/detail/CVE-2019-10149
• https://www.exploit-db.com/exploits/46996
• https://vigilance.fr/vulnerability/Exim-code-execution-29463
• https://www.exploit-db.com/exploits/47307
• https://packetstormsecurity.com/files/154198/Exim-4.91-Local-Privilege-Escalation.html

  CVE · VDB Entry · Exploit · Third Party Advisory

• http://www.openwall.com/lists/oss-security/2021/05/04/7

  OSV · mailing-list

• http://packetstormsecurity.com/files/153312/Exim-4.91-Local-Privilege-Escalation.html

  OSV · VDB Entry · Exploit · Third Party Advisory

• http://www.openwall.com/lists/oss-security/2019/07/25/7

  OSV · mailing-list

• http://packetstormsecurity.com/files/154198/Exim-4.91-Local-Privilege-Escalation.html

  OSV · VDB Entry · Exploit · Third Party Advisory

• http://www.openwall.com/lists/oss-security/2019/07/25/6

  OSV · mailing-list

• http://www.openwall.com/lists/oss-security/2019/07/26/4

  OSV · mailing-list

• http://www.securityfocus.com/bid/108679

  OSV

• https://osv.dev/vulnerability/CVE-2019-10149

  OSV

• https://osv.dev/vulnerability/DSA-4456-1

  OSV

• https://security-tracker.debian.org/tracker/CVE-2019-10149

  OSV

• https://ubuntu.com/security/CVE-2019-10149

  OSV

• http://www.exim.org/static/doc/security/CVE-2019-10149.txt

  OSV · Vendor Advisory

• https://ubuntu.com/security/notices/USN-4010-1

  OSV

• https://www.cve.org/CVERecord?id=CVE-2019-10149

  OSV

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog

  OSV

• https://osv.dev/vulnerability/UBUNTU-CVE-2019-10149

  OSV

• https://osv.dev/vulnerability/DEBIAN-CVE-2019-10149

  OSV

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-10149

  NVD · US Government Resource