Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 7 Sep 2019 08:23:33 +0200
From: Heiko Schlittermann <hs@...marc.schlittermann.de>
To: exim-users@...m.org
Cc: oss-security@...ts.openwall.com
Subject: Re: Sv: [exim] CVE-2019-15846: Exim - local or remote
 attacker can execute programs with root privileges

Phil Pennock <pdp@...m.org> (Sa 07 Sep 2019 02:52:56 CEST):
> The connect ACL won't protect you against STARTTLS usage, which is far
> more common for email than TLS-on-connect.
>
> I myself use the HELO ACL.

This doesn't seem to be sufficient, you can start "submitting" a message to
a remote Exim with the following sequence

    connect
        <-- 250
    EHLO …
        <-- 250
    STARTTLS
        <-- 220
    MAIL
        <-- 250

The client is free to skip the 2nd EHLO/HELO. Tested with OpenSSL
s_client -servername 'foobar\' -starttls smtp -connect …

    Best regards from Dresden/Germany
    Viele Grüße aus Dresden
    Heiko Schlittermann
--
 SCHLITTERMANN.de ---------------------------- internet & unix support -
 Heiko Schlittermann, Dipl.-Ing. (TU) - {fon,fax}: +49.351.802998{1,3} -
 gnupg encrypted messages are welcome --------------- key ID: F69376CE -
 ! key id 7CBF764A and 972EAC9F are revoked since 2015-01 ------------ -

Download attachment "signature.asc" of type "application/pgp-signature" (489 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.