CVE-2003-0743: Buffer Overflow

Published Sep 6, 2003

Updated

Heap-based buffer overflow in smtpin.c for Exim 3 (exim3) before 3.36 and Exim 4 (exim4) before 4.21 may allow remote attackers to execute arbitrary code via an invalid (1) HELO or (2) EHLO argument with a large number of spaces followed by a NULL character and a newline, which is not properly trimmed before the "(no argument given)" string is appended to the buffer.

Affected Software

25 affected components

University Of Cambridge Exim=3.21

University Of Cambridge Exim=3.19

University Of Cambridge Exim=3.34

University Of Cambridge Exim=3.15

University Of Cambridge Exim=3.11

University Of Cambridge Exim=3.18

University Of Cambridge Exim=3.12

University Of Cambridge Exim=3.13

University Of Cambridge Exim=3.17

University Of Cambridge Exim=3.16

University Of Cambridge Exim=3.3.1

University Of Cambridge Exim=3.3.2

University Of Cambridge Exim=3.36

University Of Cambridge Exim=4.10

University Of Cambridge Exim=3.20

University Of Cambridge Exim=3.32

University Of Cambridge Exim=3.33

University Of Cambridge Exim=3.0

University Of Cambridge Exim=3.30

University Of Cambridge Exim=3.31

University Of Cambridge Exim=4.20

University Of Cambridge Exim=3.14

University Of Cambridge Exim=3.22

University Of Cambridge Exim=3.3

University Of Cambridge Exim=3.35

Remediation

Patch Available

http://www.debian.org/security/2003/dsa-376

Event History

Sep 6, 2003

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Oct 20, 2003

Data Sourced

via NVD·04:00 AM

RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of CVE-2003-0743?

CVE-2003-0743 is classified as a high severity vulnerability due to its potential to allow remote code execution.

How do I fix CVE-2003-0743?

To fix CVE-2003-0743, upgrade to Exim version 3.36 or later, or 4.21 or later.

Which versions of Exim are affected by CVE-2003-0743?

CVE-2003-0743 affects Exim versions prior to 3.36 and 4.21.

What type of vulnerability is CVE-2003-0743?

CVE-2003-0743 is a heap-based buffer overflow vulnerability.

Can CVE-2003-0743 be exploited remotely?

Yes, CVE-2003-0743 can be exploited remotely through specially crafted HELO or EHLO arguments.