Share your story
The central voice for Linux and Open Source security news
Home News Topics Advisories HOWTOs Features Newsletters About Register

Sign up!
EnGarde Community
What is the most important Linux security technology?
Linux Events
Linux User Groups
Link to Us
Security Center
Book Reviews
Security Dictionary
Security Tips
White Papers
Featured Blogs
All About Linux
DanWalsh LiveJournal
Latest Newsletters
Linux Advisory Watch: March 27th, 2015
Linux Security Week: March 23rd, 2015
LinuxSecurity Newsletters
Choose Lists:
About our Newsletters
RSS Feeds
Get the LinuxSecurity news you want faster with RSS
Powered By

Fedora Core 3 Update: exim-4.43-1.FC3.1 Print E-mail
User Rating:      How can I rate this item?
Posted by Joe Shakespeare   
Fedora This erratum fixes two relatively minor security issues which were discovered in Exim in the last few weeks. The Common Vulnerabilities and Exposures project ( has assigned the names CAN-2005-0021 and CAN-2005-0022 to these, respectively.


Product     : Fedora Core 3
Name        : exim
Version     : 4.43                     =20
Release     : 1.FC3.1                 =20
Summary     : The exim mail transfer agent
Description :
Exim is a mail transport agent (MTA) developed at the University of
Cambridge for use on Unix systems connected to the Internet. In style
it is similar to Smail 3, but its facilities are more extensive, and
in particular it has options for verifying incoming sender and
recipient addresses, for refusing mail from specified hosts, networks,
or senders, and for controlling mail relaying. Exim is in production
use at quite a few sites, some of which move hundreds of thousands of
messages per day.

Exiscan is compiled in to allow inbuilt scanning capability. See

Update Information:

This erratum fixes two relatively minor security issues which were discover=
in Exim in the last few weeks. The Common Vulnerabilities and Exposures
project ( has assigned the names CAN-2005-0021 and CAN-2005-0=
to these, respectively.

1. The function host_aton() can overflow a buffer if it is presented with a=
   illegal IPv6 address that has more than 8 components.

2. The second report described a buffer overflow in the function=20
   spa_base64_to_bits(), which is part of the code for SPA authentication. =
   code originated in the Samba project. The overflow can be exploited only=
   you are using SPA authentication.

* Tue Jan 04 2005 David Woodhouse  4.43-1.FC3.1

- Fix buffer overflows (CAN-2005-0021, CAN-2005-0022)
- Demonstrate SASL auth configuration in default config file
- Enable TLS and provide certificate if necessary
- Don't reject all GB2312 charset mail by default

This update can be downloaded from:

f4cafadca104a85ff5f31cbf5ca4c4f1  SRPMS/exim-4.43-1.FC3.1.src.rpm
3412f5b4cf40ad504dbaf2b7e2fffa62  x86_64/exim-4.43-1.FC3.1.x86_64.rpm
1446c41e65cfd6f15ae60b969ab3d20c  x86_64/exim-mon-4.43-1.FC3.1.x86_64.rpm
e71be8446d9e4d250ca40a41c2d7b49a  x86_64/exim-doc-4.43-1.FC3.1.x86_64.rpm
1d515c5be494e657333549f72f4621e2  x86_64/exim-sa-4.43-1.FC3.1.x86_64.rpm
bcd320d0c2f88911a3ccc02b95cb2843  x86_64/debug/exim-debuginfo-4.43-1.FC3.1.=
7c2205113fe3285a76b797748845548b  i386/exim-4.43-1.FC3.1.i386.rpm
8227e5701319639057b951bc45bbecf8  i386/exim-mon-4.43-1.FC3.1.i386.rpm
3b7e2741f4208757e92ab2d228b1fe8a  i386/exim-doc-4.43-1.FC3.1.i386.rpm
4e5cbfea028184d6710443a3c0e79c29  i386/exim-sa-4.43-1.FC3.1.i386.rpm
9c2c6e5d633104ca71bf80b062e9f0a2  i386/debug/exim-debuginfo-4.43-1.FC3.1.i3=

This update can also be installed with the Update Agent; you can
launch the Update Agent with the 'up2date' command. =20

Updates for the PowerPC architecture are also available from the yum
repository at the following address:


Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part

Version: GnuPG v1.2.6 (GNU/Linux)



Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

fedora-announce-list mailing list

< Prev   Next >


Latest Features
Peter Smith Releases Linux Network Security Online
Securing a Linux Web Server
Password guessing with Medusa 2.0
Password guessing as an attack vector
Squid and Digest Authentication
Squid and Basic Authentication
Demystifying the Chinese Hacking Industry: Earning 6 Million a Night
Free Online security course (LearnSIA) - A Call for Help
What You Need to Know About Linux Rootkits
Review: A Practical Guide to Fedora and Red Hat Enterprise Linux - Fifth Edition
Yesterday's Edition
Partner Sponsor

Community | HOWTOs | Blogs | Features | Book Reviews | Networking
 Security Projects |  Latest News |  Newsletters |  SELinux |  Privacy |  Home
 Hardening |   About Us |   Advertise |   Legal Notice |   RSS |   Guardian Digital
(c)Copyright 2015 Guardian Digital, Inc. All rights reserved.