CVE-2014-2957: Input Validation
Published Sep 4, 2014
·Updated
The dmarcprocess function in dmarc.c in Exim before 4.82.1, when EXPERIMENTALDMARC is enabled, allows remote attackers to execute arbitrary code via the From header in an email, which is passed to the expandstring function.
Affected Software
51 affected components
Exim Exim<=4.82
Exim Exim=4.00
Exim Exim=4.01
Exim Exim=4.02
Exim Exim=4.03
Exim Exim=4.04
Exim Exim=4.05
Exim Exim=4.10
Exim Exim=4.11
Exim Exim=4.12
Exim Exim=4.14
Exim Exim=4.20
Exim Exim=4.21
Exim Exim=4.22
Exim Exim=4.23
Exim Exim=4.24
Exim Exim=4.30
Exim Exim=4.31
Exim Exim=4.32
Exim Exim=4.33
Exim Exim=4.34
Exim Exim=4.40
Exim Exim=4.41
Exim Exim=4.42
Exim Exim=4.43
Exim Exim=4.44
Exim Exim=4.50
Exim Exim=4.51
Exim Exim=4.52
Exim Exim=4.53
Exim Exim=4.54
Exim Exim=4.60
Exim Exim=4.61
Exim Exim=4.62
Exim Exim=4.63
Exim Exim=4.64
Exim Exim=4.65
Exim Exim=4.66
Exim Exim=4.67
Exim Exim=4.68
Exim Exim=4.69
Exim Exim=4.70
Exim Exim=4.71
Exim Exim=4.72
Exim Exim=4.73
Exim Exim=4.74
Exim Exim=4.75
Exim Exim=4.76
Exim Exim=4.77
Exim Exim=4.80
Exim Exim=4.80.1
Remediation
Event History
Sep 4, 2014
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-2957?
CVE-2014-2957 is considered high severity due to its potential for remote code execution through email headers.
2
How do I fix CVE-2014-2957?
To fix CVE-2014-2957, upgrade Exim to version 4.82.1 or later.
3
Which versions of Exim are affected by CVE-2014-2957?
CVE-2014-2957 affects Exim versions prior to 4.82.1.
4
What type of vulnerability is CVE-2014-2957?
CVE-2014-2957 is a remote code execution vulnerability that exploits how email headers are processed.
5
Can CVE-2014-2957 be exploited without user interaction?
Yes, CVE-2014-2957 can be exploited by sending a malicious email, requiring no user interaction to trigger the vulnerability.