| Vulnerability Name: | CVE-2012-5671 (CCN-79615) | ||||||||||||||||||||||||||||
| Assigned: | 2012-10-26 | ||||||||||||||||||||||||||||
| Published: | 2012-10-26 | ||||||||||||||||||||||||||||
| Updated: | 2017-08-29 | ||||||||||||||||||||||||||||
| Summary: | Heap-based buffer overflow in the dkim_exim_query_dns_txt function in dkim.c in Exim 4.70 through 4.80, when DKIM support is enabled and acl_smtp_connect and acl_smtp_rcpt are not set to "warn control = dkim_disable_verify," allows remote attackers to execute arbitrary code via an email from a malicious DNS server. | ||||||||||||||||||||||||||||
| CVSS v3 Severity: | 7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
| ||||||||||||||||||||||||||||
| CVSS v2 Severity: | 6.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P) 5.0 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
5.5 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
| ||||||||||||||||||||||||||||
| Vulnerability Type: | CWE-119 | ||||||||||||||||||||||||||||
| Vulnerability Consequences: | Gain Access | ||||||||||||||||||||||||||||
| References: | Source: MITRE Type: CNA CVE-2012-5671 Source: FEDORA Type: UNKNOWN FEDORA-2012-16899 Source: FEDORA Type: UNKNOWN FEDORA-2012-17044 Source: FEDORA Type: UNKNOWN FEDORA-2012-17085 Source: SUSE Type: UNKNOWN openSUSE-SU-2012:1404 Source: OSVDB Type: UNKNOWN 86616 Source: CCN Type: SA51098 Exim DKIM DNS Decoding Buffer Overflow Vulnerability Source: SECUNIA Type: Vendor Advisory 51098 Source: SECUNIA Type: UNKNOWN 51115 Source: SECUNIA Type: UNKNOWN 51153 Source: SECUNIA Type: UNKNOWN 51155 Source: CCN Type: SA51339 Sophos UTM Cross-Site Scripting and Buffer Overflow Vulnerabilities Source: DEBIAN Type: UNKNOWN DSA-2566 Source: DEBIAN Type: DSA-2566 exim4 -- heap-based buffer overflow Source: MLIST Type: UNKNOWN [oss-security] 20121027 CVE-2012-5671: Exim <= 4.80 DKIM heap-based buffer overflow Source: CCN Type: OSVDB ID: 86616 Exim src/dkim.c dkim_exim_query_dns_txt() Function DNS Record Parsing Remote Overflow Source: BID Type: UNKNOWN 56285 Source: CCN Type: BID-56285 Exim DKIM DNS Decoding CVE-2012-5671 Remote Buffer Overflow Vulnerability Source: CCN Type: Sophos Web site Sophos UTM Source: UBUNTU Type: UNKNOWN USN-1618-1 Source: XF Type: UNKNOWN exim-dkimeximquerydnstxt-bo(79615) Source: XF Type: UNKNOWN exim-dkimeximquerydnstxt-bo(79615) Source: CCN Type: Exim Web site Exim 4.80.1 Security Release Source: MLIST Type: UNKNOWN [exim-announce] 20121026 Exim 4.80.1 Security Release | ||||||||||||||||||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||||||||||||||||||||||
| Oval Definitions | |||||||||||||||||||||||||||||
| |||||||||||||||||||||||||||||
| BACK | |||||||||||||||||||||||||||||