CVE-2010-4344

critical-risk
Published 2010-12-14

Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session that includes two MAIL commands in conjunction with a large message containing crafted headers, leading to improper rejection logging.

Do I need to act?

!
61.5% chance of exploitation in next 30 days
EPSS score — higher than 39% of all CVEs
!
CISA KEV: actively exploited in the wild
On the Known Exploited Vulnerabilities catalog — federal agencies must patch
!
2 public exploits available
15725, 16925
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (8)

Affected Vendors

Exim Debian Canonical Opensuse

References (67)

Broken Link ftp://ftp.exim.org/pub/exim/ChangeLogs/ChangeLog-4.70
Broken Link http://atmail.com/blog/2010/atmail-6204-now-available/
Issue Tracking http://bugs.exim.org/show_bug.cgi?id=787
Mailing List http://git.exim.org/exim.git/commit/24c929a27415c7cfc7126c47e4cad39acf3efa6b
Mailing List http://lists.exim.org/lurker/message/20101210.164935.385e04d0.en.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00003.html
Mailing List http://openwall.com/lists/oss-security/2010/12/10/1
Broken Link http://secunia.com/advisories/40019
Broken Link http://secunia.com/advisories/42576
Broken Link http://secunia.com/advisories/42586
Broken Link http://secunia.com/advisories/42587
Broken Link http://secunia.com/advisories/42589
Broken Link http://www.cpanel.net/2010/12/exim-remote-memory-corruption-vulnerability-notifi...
Mailing List http://www.debian.org/security/2010/dsa-2131
Exploit http://www.exim.org/lurker/message/20101207.215955.bb32d4f2.en.html
Third Party Advisory http://www.kb.cert.org/vuls/id/682457
Third Party Advisory http://www.metasploit.com/modules/exploit/unix/smtp/exim4_string_format
Exploit http://www.openwall.com/lists/oss-security/2021/05/04/7
Broken Link http://www.osvdb.org/69685
Broken Link http://www.redhat.com/support/errata/RHSA-2010-0970.html
and 47 more references
79
/ 100
critical-risk
Severity 32/34 · Critical
Exploitability 33/34 · Critical
Exposure 14/34 · Moderate