DSA-4456: -1 exim4 -- security update
Published Jun 5, 2019
·Updated
exim4 - security update
Other sources
The Qualys Research Labs reported a flaw in Exim, a mail transport agent. Improper validation of the recipient address in the delivermessage() function may result in the execution of arbitrary commands.
Affected Software
2 affected components
debian/exim4
debian/exim4
Event History
Jun 5, 2019
Advisory Published
12:00 AM
Frequently Asked Questions
1
What access or input does an attacker need to exploit this issue?
The flaw is triggered through improper validation of a recipient address in Exim's deliver_message() function. An attacker would need to cause Exim to process a crafted recipient address.
2
What is the potential impact if exploitation succeeds?
Successful exploitation may allow execution of arbitrary commands on the affected system.
3
Which Debian software package should be prioritized for remediation?
Systems using the Debian exim4 package should be prioritized, because the advisory identifies exim4 as affected.