Alert GCSA-23126 - Vulnerabilita' in Exim mail transfer agent
******************************************************************
alert ID: GCSA-23126
data: 02 ottobre 2023
titolo: Vulnerabilita' in Exim mail transfer agent
******************************************************************
:: Descrizione del problema
Il mail transfer agent Exim e' affetto da alcune vulnerabilita' di sicurezza,
tra le quali una di livello critico e due di livello alto.
Maggiori informazioni sono disponibili alla sezione "Riferimenti".
:: Software interessato
Exim, tutte le versioni
:: Impatto
Esecuzione remota di codice arbitrario (RCE)
Accesso a dati riservati (ID)
:: Soluzione
Gli sviluppatori di Exim in un messaggio condiviso sulla mailing list
Open Source Security (oss-security) hanno affermato che le correzioni per
CVE-2023-42114, CVE-2023-42115 e CVE-2023-42116 sono
"disponibili in un repository protetto e sono pronte per essere essere
applicate dai manutentori della distribuzione. I problemi rimanenti
sono discutibili o mancano le informazioni necessarie per risolverli."
:: Riferimenti
Exim4 MTA CVEs assigned from ZDI
https://seclists.org/oss-sec/2023/q3/259
https://seclists.org/oss-sec/2023/q3/254
https://www.openwall.com/lists/oss-security/2023/09/29/5
https://www.openwall.com/lists/oss-security/2023/09/29/10
https://www.exim.org/
Bleeping Computer
https://www.bleepingcomputer.com/news/security/millions-of-exim-mail-servers-exposed-to-zero-day-rce-attacks/
The Hacker News
https://thehackernews.com/2023/09/new-critical-security-flaws-expose-exim.html
Zero Day Initiative - Advisories
https://www.zerodayinitiative.com/advisories/ZDI-23-1468/
https://www.zerodayinitiative.com/advisories/ZDI-23-1469/
https://www.zerodayinitiative.com/advisories/ZDI-23-1470/
https://www.zerodayinitiative.com/advisories/ZDI-23-1471/
https://www.zerodayinitiative.com/advisories/ZDI-23-1472/
https://www.zerodayinitiative.com/advisories/ZDI-23-1473/
Mitre CVE
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-42114
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-42115
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-42116
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-42117
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-42118
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-42119
GARR CERT Security Alert - subscribe/unsubscribe:
http://www.cert.garr.it/alert/ricevi-gli-alert-di-cert
-----BEGIN PGP SIGNATURE-----
iGsEAREIACsWIQTGpdiR5MqstacBGHbBnEyTZRJgQgUCZRqHrQ0cY2VydEBnYXJy
Lml0AAoJEMGcTJNlEmBC6W4AniaCv6YJNGgqikQUAw2UXplBgeQSAJ0YkqYvmtqh
ScfhZTnt4xQzTXiKpA==
=m146
-----END PGP SIGNATURE-----