[exim-dev] [Bug 2449] Heap Overflow

2019-09-28 Thread admin--- via Exim-dev
https://bugs.exim.org/show_bug.cgi?id=2449

Git Commit  changed:

   What|Removed |Added

 CC||g...@exim.org

--- Comment #8 from Git Commit  ---
Git commit:
https://git.exim.org/exim.git/commitdiff/a9f4f5d741fa0414a4a3e30aabde179dba3fb1ef

commit a9f4f5d741fa0414a4a3e30aabde179dba3fb1ef
Author: Jeremy Harris 
AuthorDate: Fri Sep 27 12:21:49 2019 +0100
Commit: Jeremy Harris 
CommitDate: Fri Sep 27 15:44:36 2019 +0100

Testsuite: regression-test for bug.  Bug 2449
---
 test/scripts/-Basic/0214 | 11 +++
 test/stdout/0214 |  7 +++
 2 files changed, 18 insertions(+)

diff --git a/test/scripts/-Basic/0214 b/test/scripts/-Basic/0214
index fa2a533..7a58a62 100644
--- a/test/scripts/-Basic/0214
+++ b/test/scripts/-Basic/0214
@@ -41,4 +41,15 @@ To:
bad@address;bad@address;bad@address;bad@address;bad@address;bad@address;
 quit
 ??? 221
 
+#
+#
+#
+client 127.0.0.1 PORT_D
+??? 220
+EHLO

[exim-dev] [Bug 2449] Heap Overflow

2019-09-28 Thread admin--- via Exim-dev
https://bugs.exim.org/show_bug.cgi?id=2449

Heiko Schlittermann  changed:

   What|Removed |Added

  Group|exim-security   |

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-- 
## List details at https://lists.exim.org/mailman/listinfo/exim-dev Exim 
details at http://www.exim.org/ ##


[exim-dev] [Bug 2449] Heap Overflow

2019-09-28 Thread admin--- via Exim-dev
https://bugs.exim.org/show_bug.cgi?id=2449

Heiko Schlittermann  changed:

   What|Removed |Added

 Status|ASSIGNED|RESOLVED
   Severity|bug |security
   Priority|high|critical
 Resolution|--- |FIXED

--- Comment #7 from Heiko Schlittermann  ---
exim-4.92.3 released

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-- 
## List details at https://lists.exim.org/mailman/listinfo/exim-dev Exim 
details at http://www.exim.org/ ##


[exim-dev] [Bug 2449] Heap Overflow

2019-09-28 Thread admin--- via Exim-dev
https://bugs.exim.org/show_bug.cgi?id=2449

--- Comment #6 from ar...@outlook.com ---
Thank you!

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-- 
## List details at https://lists.exim.org/mailman/listinfo/exim-dev Exim 
details at http://www.exim.org/ ##


[exim-dev] [Bug 2449] Heap Overflow

2019-09-28 Thread admin--- via Exim-dev
https://bugs.exim.org/show_bug.cgi?id=2449

--- Comment #5 from Heiko Schlittermann  ---
(In reply to areuu from comment #4)
> Please credit my team QAX A-TEAM.

The statement in the source will start as shown below.

CVE ID: CVE-2019-16928
Date:   2019-09-27 (CVE assigned)
Version(s): from 4.92 up to and including 4.92.2
Reporter:   QAX-A-TEAM 
Reference:  https://bugs.exim.org/show_bug.cgi?id=2449
Issue:  Heap-based buffer overflow in string_vformat,
remote code execution seems to be possible

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-- 
## List details at https://lists.exim.org/mailman/listinfo/exim-dev Exim 
details at http://www.exim.org/ ##


Re: [exim-dev] Debugging SMTP transport crash

2019-09-28 Thread Florian Weimer via Exim-dev
* Jeremy Harris via Exim-dev:

>> Alternatively, I guess I could capture a coredump somehow, but that
>> might prove difficult as well due to the use of setuid etc.
>
> Yup.  The /proc setuid-dump things.  One to set the dumpability,
> one to set the filename.  And also, ulimit -c.

Thanks.  This is the backtrace:

#0  retry_add_item (addr=addr@entry=0x0, 
key=0x55f7e124fba0 "T:mx03.t-online.de:194.25.134.73", flags=flags@entry=3)
at retry.c:298
#1  0x55f7e0277362 in smtp_transport_entry (tblock=0x55f7e124d630, 
addrlist=0x55f7e124ee08) at smtp.c:4121
#2  0x55f7e01fda0c in do_remote_deliveries (fallback=fallback@entry=0)
at deliver.c:4655
#3  0x55f7e02026f5 in deliver_message (
id=0x7ffecfa358d3 "1iDwv6-iH-FV", forced=, 
give_up=) at deliver.c:7014
#4  0x55f7e01ea661 in main (argc=, cargv=0x7ffecfa346a8)
at exim.c:4659

It looks like first_addr is NULL in smtp_transport_entry, so I assume
PREPARE_ADDRESSES return NULL.  addr_list points to:

$1 = {next = 0x0, parent = 0x0, first = 0x0, dupof = 0x0, start_router = 0x0, 
  router = 0x55f7e124b3f0, transport = 0x55f7e124d630, 
  host_list = 0x55f7e124f6c0, host_used = 0x55f7e124f6c0, 
  fallback_hosts = 0x0, reply = 0x0, retries = 0x55f7e124fa90, 
  address = 0x55f7e124e738 "@t-online.de", 
  unique = 0x55f7e124efa8 "@t-online.de", 
  cc_local_part = 0x55f7e124efd8 "", 
  lc_local_part = 0x55f7e124efe8 "", 
  local_part = 0x55f7e124efe8 "", prefix = 0x0, suffix = 0x0, 
  domain = 0x55f7e124efc8 "t-online.de", 
  address_retry_key = 0x55f7e124f008 "R:@t-online.de", 
  domain_retry_key = 0x55f7e124eff8 "R:t-online.de", current_dir = 0x0, 
  home_dir = 0x0, 
  message = 0x55f7e124f9d0 "SMTP error from remote mail server after initial 
connection: 554 IP=37.24.231.21 - A problem occurred. (Ask your postmaster for 
help or to contact t...@rx.t-online.de to clarify.) (BL)", user_message = 0x0, 
  onetime_parent = 0x0, pipe_expandn = 0x0, return_filename = 0x0, 
  self_hostname = 0x0, shadow_message = 0x0, cipher = 0x0, ourcert = 0x0, 
  peercert = 0x0, peerdn = 0x0, ocsp = 0, authenticator = 0x0, auth_id = 0x0, 
  auth_sndr = 0x0, dsn_orcpt = 0x0, dsn_flags = 0, dsn_aware = 0, 
  uid = 4294967295, gid = 4294967295, flags = 33554432, domain_cache = {15}, 
  localpart_cache = {0}, mode = -1, more_errno = 77, basic_errno = 0, 
  child_count = 0, return_file = -1, special_action = 0, transport_return = 2, 
  prop = {address_data = 0x0, domain_data = 0x0, localpart_data = 0x0, 
errors_address = 0x0, extra_headers = 0x0, remove_headers = 0x0}}

transport_return == 2 (FAIL?) is consistent with a NULL return value
from prepare_addresses.

Not sure if this relevant, but there is an expired database entry:

27-Sep-2019 20:32:52  27-Sep-2019 20:56:11  27-Sep-2019 21:11:11 
  T:mx03.t-online.de:194.25.134.73 111 77 Connection refused

Since this is with Exim 4.89 in Debian, I went through the commit log,
and found this:

commit e69636bc9ddf3617be688b07941d7d659d50eaa7
Author: Jeremy Harris 
Date:   Sat Jun 3 13:39:18 2017 +0100

Fix crash in transport, on second smtp-connect fail for a list of target 
hosts

Reported as the sequence:
  1MX: 554 on connect (banner)
  2MX: TCP conn timeout

Could this be relevant?

I can probably upgrade to the latest Debian version and see if the
issue goes away.

-- 
## List details at https://lists.exim.org/mailman/listinfo/exim-dev Exim 
details at http://www.exim.org/ ##