CVE-2010-4344

Published: Dec 14, 2010Modified: Apr 21, 2026CISA KEV

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session that includes two MAIL commands in conjunction with a large message containing crafted headers, leading to improper rejection logging.

Affected (8)

Products: Exim: Exim · Opensuse: Opensuse · Debian: Debian Linux · +1 more

Show all products

Exim: Exim · Opensuse: Opensuse · Debian: Debian Linux · Canonical: Ubuntu Linux

1 product

1 product

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Exim Exim	Before 4.70

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Opensuse Opensuse	Version 11.1
Opensuse Opensuse	Version 11.2
Opensuse Opensuse	Version 11.3

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 5.0

Configuration D

3 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 6.06
Canonical Ubuntu Linux	Version 8.04
Canonical Ubuntu Linux	Version 9.10

Related CWEs

CWE-787

Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

References (67)

ftp://ftp.exim.org/pub/exim/ChangeLogs/ChangeLog-4.70 (unsafe URL)

Source: secalert@redhat.com

Broken Link

http://atmail.com/blog/2010/atmail-6204-now-available/

Source: secalert@redhat.com

Broken Link

http://bugs.exim.org/show_bug.cgi?id=787

Source: secalert@redhat.com

Issue TrackingPatch

http://git.exim.org/exim.git/commit/24c929a27415c7cfc7126c47e4cad39acf3efa6b

Source: secalert@redhat.com

Mailing ListPatch

http://lists.exim.org/lurker/message/20101210.164935.385e04d0.en.html

Source: secalert@redhat.com

Mailing ListPatch

http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00003.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://openwall.com/lists/oss-security/2010/12/10/1

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://secunia.com/advisories/40019

Source: secalert@redhat.com

Broken LinkVendor Advisory

http://secunia.com/advisories/42576

Source: secalert@redhat.com

Broken LinkVendor Advisory

http://secunia.com/advisories/42586

Source: secalert@redhat.com

Broken LinkVendor Advisory

http://secunia.com/advisories/42587

Source: secalert@redhat.com

Broken LinkVendor Advisory

http://secunia.com/advisories/42589

Source: secalert@redhat.com

Broken LinkVendor Advisory

http://www.cpanel.net/2010/12/exim-remote-memory-corruption-vulnerability-notification-cve-2010-4344.html

Source: secalert@redhat.com

Broken Link

http://www.debian.org/security/2010/dsa-2131

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://www.exim.org/lurker/message/20101207.215955.bb32d4f2.en.html

Source: secalert@redhat.com

ExploitMailing List

http://www.kb.cert.org/vuls/id/682457

Source: secalert@redhat.com

Third Party AdvisoryUS Government Resource

http://www.metasploit.com/modules/exploit/unix/smtp/exim4_string_format

Source: secalert@redhat.com

Third Party Advisory

http://www.openwall.com/lists/oss-security/2021/05/04/7

Source: secalert@redhat.com

ExploitMailing List

http://www.osvdb.org/69685

Source: secalert@redhat.com

Broken LinkExploitPatch

http://www.redhat.com/support/errata/RHSA-2010-0970.html

Source: secalert@redhat.com

Broken Link

http://www.securityfocus.com/archive/1/515172/100/0/threaded

Source: secalert@redhat.com

Broken LinkThird Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/45308

Source: secalert@redhat.com

Broken LinkThird Party AdvisoryVDB Entry

http://www.securitytracker.com/id?1024858

Source: secalert@redhat.com

Broken LinkThird Party AdvisoryVDB Entry

http://www.theregister.co.uk/2010/12/11/exim_code_execution_peril/

Source: secalert@redhat.com

Press/Media Coverage

http://www.ubuntu.com/usn/USN-1032-1

Source: secalert@redhat.com

Third Party Advisory

http://www.vupen.com/english/advisories/2010/3171

Source: secalert@redhat.com

Broken LinkVendor Advisory

http://www.vupen.com/english/advisories/2010/3172

Source: secalert@redhat.com

Broken LinkVendor Advisory

http://www.vupen.com/english/advisories/2010/3181

Source: secalert@redhat.com

Broken LinkVendor Advisory

http://www.vupen.com/english/advisories/2010/3186

Source: secalert@redhat.com

Broken LinkVendor Advisory

http://www.vupen.com/english/advisories/2010/3204

Source: secalert@redhat.com

Broken LinkVendor Advisory

http://www.vupen.com/english/advisories/2010/3246

Source: secalert@redhat.com

Broken LinkVendor Advisory

http://www.vupen.com/english/advisories/2010/3317

Source: secalert@redhat.com

Broken Link

https://bugzilla.redhat.com/show_bug.cgi?id=661756

Source: secalert@redhat.com

ExploitIssue Tracking

ftp://ftp.exim.org/pub/exim/ChangeLogs/ChangeLog-4.70 (unsafe URL)