On Fri, Oct 26, 2012 at 04:35:48AM -0400, Phil Pennock wrote: > Folks, > > During internal code review on Wednesday, I uncovered a remote code > execution hole in Exim, affecting releases 4.70 to 4.80, in the DKIM > handling. This can be triggered by anyone who can send you email from a > domain for which they control the DNS, and gets them the Exim run-time > user. > > Thanks to a certain Wired article, I decided this area of the codebase > (of many MTAs) would be likely to be reviewed by more than just me, so > it would be sheer hubris to hope that this remained undiscovered by > blackhats. > > So Exim 4.80.1 has been cut, which has no new features, none of the > other changes, and is "4.80 plus security fix"; the patch and > notification were available to vendors from late Wednesday, and I sucked > it up and accepted that I would be deeply unpopular with a Friday > release, after the vendors had Thursday to prep. > > At 8am UTC, I released Exim 4.80.1. The patch should apply cleanly to > any affected version of Exim, so your vendor should have a clean patch > for you. > > For those who build/maintain their own Exim releases, but have not kept > up-to-date on Exim and are not ready to move to 4.80/4.80.1, you will > wish to study: > > http://git.exim.org/exim.git/commit/4263f395efd136dece52d765dfcff3c96f17506e > > Regards, > -Phil >
Phil when will exim.org be up? I notice problems getting to the site. > -- > ## List details at https://lists.exim.org/mailman/listinfo/exim-users > ## Exim details at http://www.exim.org/ > ## Please use the Wiki with this list - http://wiki.exim.org/ -- Member - Liberal International This is [email protected] Ici [email protected] God,Queen and country!Never Satan President Republic!Beware AntiChrist rising! http://www.fullyfollow.me/rootnl2k USA petition to dissolve the Republic and vote to disoolve it in November 2012 -- ## List details at https://lists.exim.org/mailman/listinfo/exim-users ## Exim details at http://www.exim.org/ ## Please use the Wiki with this list - http://wiki.exim.org/
