Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!

Remote code execution flaw in exim <=4.80

Discussion in 'Security' started by jerrybell, Oct 26, 2012.

  1. jerrybell

    jerrybell Well-Known Member

    Joined:
    Nov 27, 2006
    Messages:
    90
    Likes Received:
    0
    Trophy Points:
    156
    Exim has been updated to fix a remote code execution flaw. Here is the announcement: https://lists.exim.org/lurker/message/20121026.080330.74b9147b.en.html

    No details on whether it's being actively exploited.

    I would recommend disabling dkim in the exim configuration editor until 4.82 is pushed to your servers. RCE is nothing to mess around with.
     
    #1 jerrybell, Oct 26, 2012
    Last edited: Oct 26, 2012
  2. eperdeme

    eperdeme Well-Known Member

    Joined:
    Oct 15, 2003
    Messages:
    58
    Likes Received:
    0
    Trophy Points:
    156
    Location:
    Manchester, UK
    cPanel Access Level:
    DataCenter Provider
    We have updated our exim estate which runs Debian to fix this exploit.

    Seeing as Debian pushed it out so rapid(normally they take ages) we need cPanel to be following shortly.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #2 eperdeme, Oct 26, 2012
  3. cPanelNick

    cPanelNick Administrator
    Staff Member

    Joined:
    Mar 9, 2015
    Messages:
    3,480
    Likes Received:
    30
    Trophy Points:
    158
    cPanel Access Level:
    DataCenter Provider
    By default in 11.32 and 11.34 we add

    warn control = dkim_disable_verify

    to exim.conf so this shouldn't be a problem. New rpms are being testing and will be forthcoming shortly.

    Just make this this option is disabled in the Basic Exim Editor inside of WHM:
    Screen Shot 2012-10-26 at 11.34.08 AM.png
     
    #3 cPanelNick, Oct 26, 2012
  4. chposter

    chposter Active Member

    Joined:
    May 9, 2011
    Messages:
    39
    Likes Received:
    1
    Trophy Points:
    58
    So, 11.30 LTS version is not affected, right? (exim-4.69-30)
     
    #4 chposter, Oct 26, 2012
  5. cPanelNick

    cPanelNick Administrator
    Staff Member

    Joined:
    Mar 9, 2015
    Messages:
    3,480
    Likes Received:
    30
    Trophy Points:
    158
    cPanel Access Level:
    DataCenter Provider
    11.30 did not have DKIM support so it should not be affected.
     
    #5 cPanelNick, Oct 26, 2012
  6. nospa

    nospa Well-Known Member

    Joined:
    Apr 23, 2012
    Messages:
    110
    Likes Received:
    0
    Trophy Points:
    66
    cPanel Access Level:
    Reseller Owner
    Why you wrote "SHOULD" ? How we can be sure that we are on the safe side with exim-4.69-30?
     
    #6 nospa, Oct 26, 2012
    Last edited: Oct 26, 2012
  7. cPanelNick

    cPanelNick Administrator
    Staff Member

    Joined:
    Mar 9, 2015
    Messages:
    3,480
    Likes Received:
    30
    Trophy Points:
    158
    cPanel Access Level:
    DataCenter Provider
    Some people have installed custom exim rpms which may support DKIM in 11.30. There are a few third party howtos floating around like : http://www.thecpaneladmin.com/using-dkim-with-exim-and-cpanel/
     
    #7 cPanelNick, Oct 26, 2012
  8. nospa

    nospa Well-Known Member

    Joined:
    Apr 23, 2012
    Messages:
    110
    Likes Received:
    0
    Trophy Points:
    66
    cPanel Access Level:
    Reseller Owner
    Is Exim-4.69-30 from cPanel - not installed as custom but installed by default with cPanel - not affected? I read that there were experimental add for DKIM in 4.69, but I'm unsure if cPanel implemented this in default install. Article you've provided describes how to install DKIM with 4.70.
     
    #8 nospa, Oct 26, 2012
  9. cPanelNick

    cPanelNick Administrator
    Staff Member

    Joined:
    Mar 9, 2015
    Messages:
    3,480
    Likes Received:
    30
    Trophy Points:
    158
    cPanel Access Level:
    DataCenter Provider
    4.69-30 is not affected by this CVE.
     
    #9 cPanelNick, Oct 26, 2012
  10. _aitor_

    _aitor_ Registered
    PartnerNOC

    Joined:
    Oct 26, 2012
    Messages:
    2
    Likes Received:
    0
    Trophy Points:
    1
    cPanel Access Level:
    DataCenter Provider
    Hi Nick,

    Could you confirm me that on 11.32 (with no custom RPMs) disabling "Allow DKIM verification for incoming messages" option is enough to be secure?

    Thanks


     
    #10 _aitor_, Oct 26, 2012
  11. cPanelNick

    cPanelNick Administrator
    Staff Member

    Joined:
    Mar 9, 2015
    Messages:
    3,480
    Likes Received:
    30
    Trophy Points:
    158
    cPanel Access Level:
    DataCenter Provider
    That should be sufficient. However, you should also update 11.32.5.13 or 11.34.0.6 as soon as they are published.

    Once you update, you can validate the new rpm is installed by running

    # rpm -q exim --changelog|grep CVE-2012-5671

    You should see '-Fixes CVE-2012-5671' returned (at least once)
     
    #11 cPanelNick, Oct 26, 2012
  12. _aitor_

    _aitor_ Registered
    PartnerNOC

    Joined:
    Oct 26, 2012
    Messages:
    2
    Likes Received:
    0
    Trophy Points:
    1
    cPanel Access Level:
    DataCenter Provider
    Thanks Nick.
     
    #12 _aitor_, Oct 26, 2012
  13. mtindor

    mtindor Well-Known Member

    Joined:
    Sep 14, 2004
    Messages:
    1,344
    Likes Received:
    58
    Trophy Points:
    178
    Location:
    inside a catfish
    cPanel Access Level:
    Root Administrator
    Nick,

    I see the changelog says 11.32.5.13 is the latest version and that it resolves the CVE in question. But you mentioned 11.32.5.16. Is there going to be some additional update pushed related to this with a version update to 11.32.5.16, or was 11.32.5.16 simply a mistype on your part?

    Mike
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #13 mtindor, Oct 26, 2012
  14. cPanelNick

    cPanelNick Administrator
    Staff Member

    Joined:
    Mar 9, 2015
    Messages:
    3,480
    Likes Received:
    30
    Trophy Points:
    158
    cPanel Access Level:
    DataCenter Provider
    Sorry, I just pasted in the latest internal version. The published version with the fix is .13. Sorry for the confusion.
     
    #14 cPanelNick, Oct 26, 2012
  15. sodapopinski

    sodapopinski Well-Known Member

    Joined:
    Aug 13, 2001
    Messages:
    90
    Likes Received:
    2
    Trophy Points:
    308
    #15 sodapopinski, Oct 26, 2012
  16. cPanelNick

    cPanelNick Administrator
    Staff Member

    Joined:
    Mar 9, 2015
    Messages:
    3,480
    Likes Received:
    30
    Trophy Points:
    158
    cPanel Access Level:
    DataCenter Provider
    #16 cPanelNick, Oct 26, 2012
  17. FleroviumUranus

    FleroviumUranus Registered

    Joined:
    Aug 28, 2012
    Messages:
    4
    Likes Received:
    0
    Trophy Points:
    1
    cPanel Access Level:
    Root Administrator
    #17 FleroviumUranus, Oct 27, 2012
  18. cPanelNick

    cPanelNick Administrator
    Staff Member

    Joined:
    Mar 9, 2015
    Messages:
    3,480
    Likes Received:
    30
    Trophy Points:
    158
    cPanel Access Level:
    DataCenter Provider
    4.80-XX is not the same as 4.80.1-XX
     
    #18 cPanelNick, Oct 27, 2012
  19. d'argo

    d'argo Active Member

    Joined:
    Jul 4, 2012
    Messages:
    36
    Likes Received:
    0
    Trophy Points:
    6
    cPanel Access Level:
    Root Administrator
    The class of attack is known as a "heap-based buffer overflow"; your OS might be built with protections to mitigate against these attacks.

    we use grsecurity kernel. glad we did this because it stops buffer overflows. patching is important but its not proactive.
     
    #19 d'argo, Oct 30, 2012
(You must log in or sign up to post here.)
Loading...
Similar Threads - Remote code execution
  1. fuzzylogic

    Drupal core - Remote Code Execution - SA-CORE-2018-002 modsec rules

    fuzzylogic, Apr 1, 2018, in forum: Security
    Replies:
    7
    Views:
    838
    DamienMcKenna
    May 9, 2018
  2. Malagana

    Remote server can't resolve email sender domain

    Malagana, Oct 5, 2018, in forum: E-mail Discussion
    Replies:
    5
    Views:
    116
    cPanelLauren
    Oct 10, 2018 at 7:51 AM
  3. Henry Aspden

    Email routing if not found locally try remote

    Henry Aspden, Sep 28, 2018, in forum: E-mail Discussion
    Replies:
    2
    Views:
    89
    cPanelLauren
    Oct 4, 2018
  4. Tornado

    SPAM from -Remote- user

    Tornado, Sep 28, 2018, in forum: E-mail Discussion
    Replies:
    17
    Views:
    262
    cPanelLauren
    Oct 5, 2018
  5. Augusto Will

    Remote Only Incremental Backup

    Augusto Will, Sep 14, 2018, in forum: Data Protection
    Replies:
    1
    Views:
    84
    cPanelLauren
    Sep 17, 2018

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...
    Dismiss Notice