CVE-2011-1407

Published: May 16, 2011Modified: Apr 29, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

The DKIM implementation in Exim 4.7x before 4.76 permits matching for DKIM identities to apply to lookup items, instead of only strings, which allows remote attackers to execute arbitrary code or access a filesystem via a crafted identity.

Affected (6)

Products: Exim: Exim

Exim

1 product

Exim

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Exim Exim	Version 4.70
Exim Exim	Version 4.71
Exim Exim	Version 4.72
Exim Exim	Version 4.73
Exim Exim	Version 4.74
Exim Exim	Version 4.75

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (10)

http://www.debian.org/security/2011/dsa-2236

Source: cve@mitre.org

http://www.securityfocus.com/bid/47836

Source: cve@mitre.org

http://www.ubuntu.com/usn/USN-1135-1

Source: cve@mitre.org

https://lists.exim.org/lurker/message/20110509.091632.daed0206.en.html

Source: cve@mitre.org

Patch

https://lists.exim.org/lurker/message/20110512.102909.8136175a.en.html

Source: cve@mitre.org

Patch

http://www.debian.org/security/2011/dsa-2236