CVE-2011-1407: Input Validation
Published May 16, 2011
·Updated
The DKIM implementation in Exim 4.7x before 4.76 permits matching for DKIM identities to apply to lookup items, instead of only strings, which allows remote attackers to execute arbitrary code or access a filesystem via a crafted identity.
Affected Software
6 affected components
Exim Exim=4.70
Exim Exim=4.71
Exim Exim=4.74
Exim Exim=4.72
Exim Exim=4.75
Exim Exim=4.73
Remediation
Event History
May 16, 2011
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2011-1407?
CVE-2011-1407 is classified as a critical vulnerability that allows remote code execution.
2
How do I fix CVE-2011-1407?
To fix CVE-2011-1407, upgrade Exim to version 4.76 or later.
3
What are the affected versions in CVE-2011-1407?
CVE-2011-1407 affects Exim versions 4.70 to 4.75.
4
Can CVE-2011-1407 allow unauthorized file access?
Yes, CVE-2011-1407 can allow remote attackers to access the filesystem.
5
What is the main issue caused by CVE-2011-1407?
The main issue with CVE-2011-1407 is the improper handling of DKIM identities which can lead to arbitrary code execution.