LinuxSecurity.com
Share your story
The central voice for Linux and Open Source security news
Home News Topics Advisories HOWTOs Features Newsletters About Register

Welcome!
Sign up!
EnGarde Community
Login
Polls
What is the most important Linux security technology?
 
Advisories
Community
Linux Events
Linux User Groups
Link to Us
Security Center
Book Reviews
Security Dictionary
Security Tips
SELinux
White Papers
Featured Blogs
All About Linux
DanWalsh LiveJournal
Securitydistro
Latest Newsletters
Linux Advisory Watch: September 26th, 2014
Linux Security Week: September 22nd, 2014
Subscribe
LinuxSecurity Newsletters
E-mail:
Choose Lists:
About our Newsletters
RSS Feeds
Get the LinuxSecurity news you want faster with RSS
Powered By

  
Fedora: exim-4.43-1.FC2.1 update Print E-mail
User Rating:      How can I rate this item?
Posted by Joe Shakespeare   
Fedora This erratum fixes two relatively minor security issues which were discovered in Exim in the last few weeks. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CAN-2005-0021 and CAN-2005-0022 to these, respectively.

---------------------------------------------------------------------
Fedora Update Notification
FEDORA-2005-001
2005-01-06
---------------------------------------------------------------------

Product     : Fedora Core 2
Name        : exim
Version     : 4.43
Release     : 1.FC2.1
Summary     : The exim mail transfer agent
Description :
Exim is a mail transport agent (MTA) developed at the University of
Cambridge for use on Unix systems connected to the Internet. In style
it is similar to Smail 3, but its facilities are more extensive, and
in particular it has options for verifying incoming sender and
recipient addresses, for refusing mail from specified hosts, networks,
or senders, and for controlling mail relaying. Exim is in production
use at quite a few sites, some of which move hundreds of thousands of
messages per day.

Exiscan is compiled in to allow inbuilt scanning capability. See
        http://duncanthrax.net/exiscan-acl/

---------------------------------------------------------------------
Update Information:

This erratum fixes two relatively minor security issues which were discovered
in Exim in the last few weeks. The Common Vulnerabilities and Exposures
project (cve.mitre.org) has assigned the names CAN-2005-0021 and CAN-2005-0022
to these, respectively.

1. The function host_aton() can overflow a buffer if it is presented with an
   illegal IPv6 address that has more than 8 components.

2. The second report described a buffer overflow in the function
   spa_base64_to_bits(), which is part of the code for SPA authentication. This
   code originated in the Samba project. The overflow can be exploited only if
   you are using SPA authentication.

---------------------------------------------------------------------
* Tue Jan 04 2005 David Woodhouse  4.43-1.FC2.1

- Fix buffer overflows (CAN-2005-0021, CAN-2005-0022)
- Demonstrate SASL auth configuration in default config file
- Enable TLS and provide certificate if necessary
- Don't reject all GB2312 charset mail by default

* Thu Oct 07 2004 Thomas Woerner  4.43-1

- new version 4.43 with sasl support
- new exiscan-acl-4.43-28
- new config.samples and FAQ-html (added publication date)
- new BuildRequires for cyrus-sasl-devel openldap-devel openssl-devel
  and PreReq for cyrus-sasl openldap openssl

* Mon Sep 13 2004 Thomas Woerner  4.42-2

- update to sa-exim-4.1: fixes spamassassin's new score= string (#131796)

* Fri Aug 27 2004 Thomas Woerner  4.42-1

- new version 4.42

* Mon Aug 02 2004 Thomas Woerner  4.41-1

- new version 4.41

* Fri Jul 02 2004 Thomas Woerner  4.34-3

- added pre-definition of local_delivery using Cyrus-IMAP (#122912)
- added BuildRequires for pam-devel (#124555)
- fixed format string bugs (#125117)
- fixed sa-exim code placed wrong in spec file (#127102)
- extended postun with alternatives call

* Tue Jun 15 2004 Elliot Lee 

- rebuilt

* Wed May 12 2004 David Woodhouse  4.34-1

- Update to Exim 4.34, exiscan-acl 4.34-21


---------------------------------------------------------------------
This update can be downloaded from:
  http://download.fedora.redhat.com/pub/fedora/linux/core/updates/2/

c962c75145017206cde8c67fd7a56eb7  SRPMS/exim-4.43-1.FC2.1.src.rpm
a533e222f4ff2beb0536daf177def1b8  x86_64/exim-4.43-1.FC2.1.x86_64.rpm
c0639fcca5b8bbca2e753155a2c34532  x86_64/exim-mon-4.43-1.FC2.1.x86_64.rpm
7fe11efcfb57bf044d0bf2f09c53f6f2  x86_64/exim-doc-4.43-1.FC2.1.x86_64.rpm
b28149b3e7e2fed0dee72e30ad39a52b  x86_64/exim-sa-4.43-1.FC2.1.x86_64.rpm
283a93d612b65e2a514ba6fc8131677d  x86_64/debug/exim-debuginfo-4.43-1.FC2.1.x86_64.rpm
f2d1181933fa6f6b34cd1ae71bee16a4  i386/exim-4.43-1.FC2.1.i386.rpm
628be45b2a947f7579c4dd068ac45bf1  i386/exim-mon-4.43-1.FC2.1.i386.rpm
16f125efa84916c076586c01ba6d4e8c  i386/exim-doc-4.43-1.FC2.1.i386.rpm
c94d60d7d71b6dffe3a06967c45ce79f  i386/exim-sa-4.43-1.FC2.1.i386.rpm
e7233593925bf8a0003a9ca7c74c2bdd  i386/debug/exim-debuginfo-4.43-1.FC2.1.i386.rpm

This update can also be installed with the Update Agent; you can
launch the Update Agent with the 'up2date' command.
---------------------------------------------------------------------

--
fedora-announce-list mailing list
fedora-announce-list@redhat.com
http://www.redhat.com/mailman/listinfo/fedora-announce-list

 
< Prev   Next >
    
Partner

 

Latest Features
Peter Smith Releases Linux Network Security Online
Securing a Linux Web Server
Password guessing with Medusa 2.0
Password guessing as an attack vector
Squid and Digest Authentication
Squid and Basic Authentication
Demystifying the Chinese Hacking Industry: Earning 6 Million a Night
Free Online security course (LearnSIA) - A Call for Help
What You Need to Know About Linux Rootkits
Review: A Practical Guide to Fedora and Red Hat Enterprise Linux - Fifth Edition
Yesterday's Edition
Honeypot Snares Two Bots Exploiting Bash Vulnerability
CloudFlare Rolls Out Free SSL
Partner Sponsor

Community | HOWTOs | Blogs | Features | Book Reviews | Networking
 Security Projects |  Latest News |  Newsletters |  SELinux |  Privacy |  Home
 Hardening |   About Us |   Advertise |   Legal Notice |   RSS |   Guardian Digital
(c)Copyright 2014 Guardian Digital, Inc. All rights reserved.