headers
Dr Andrew C Aitchison | 7 Nov 2007 09:41
Picon
Picon

PCRE vunerability and Exim ?


[ Sorry for spamming exim-dev but I believe that the
   PCRE maintainer lurks there and not on exim-users  :-]

RedHat have released an update to pcre 6.6
http://www.linuxcompatible.org/RHSA-20070967-01_Critical_pcre_security_update_p99769.html
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/pcre-6.6-2.el5_0.1.src.rpm
The redhat bugzilla for one of thesre flaws
   https://bugzilla.redhat.com/show_bug.cgi?id=315871
suggests that
    another case of a lone \E inside a character class remained,
    this has been fixed in 7.3

exim-4.68 includes pcre 7.2, which is presumably vunerable.

I suspect that within exim pcre does not parse user-supplied
expressions, so this is not a major vunerability, but is anyone
in a position to confirm this, or do we need to release an updated
version of exim ?

-- 
Dr. Andrew C. Aitchison		Computer Officer, DPMMS, Cambridge
A.C.Aitchison <at> dpmms.cam.ac.uk	http://www.dpmms.cam.ac.uk/~werdna

--

-- 
## List details at http://lists.exim.org/mailman/listinfo/exim-users 
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/
(Continue reading)

Permalink | Reply | 5 comments |
headers
Michael Haardt | 7 Nov 2007 10:54

Re: PCRE vunerability and Exim ?

> I suspect that within exim pcre does not parse user-supplied
> expressions, so this is not a major vunerability, but is anyone
> in a position to confirm this, or do we need to release an updated
> version of exim ?

Exim does parse user-supplied expressions in filters, but usually they
run with user privileges.  I can imagine setups that are concerned by
this problem, but very few.

Michael

--

-- 
## List details at http://lists.exim.org/mailman/listinfo/exim-dev Exim details at
http://www.exim.org/ ##
Permalink | Reply | 0 comments |
headers
Mike Dixson | 8 Nov 2007 18:09
Picon
Favicon

[Bug 627] New: /var/run/exim4 directory not create so pid file not created

------- You are receiving this mail because: -------
You are on the CC list for the bug.

http://bugs.exim.org/show_bug.cgi?id=627
           Summary: /var/run/exim4 directory not create so pid file not
                    created
           Product: Exim
           Version: 4.60
          Platform: Other
        OS/Version: All
            Status: NEW
          Severity: bug
          Priority: medium
         Component: General execution
        AssignedTo: ph10 <at> hermes.cam.ac.uk
        ReportedBy: m.dixson <at> rave.ac.uk
                CC: exim-dev <at> exim.org

Hi all,

On Ubuntu 6.06LTS with Exim 4.60 installed using apt-get I encountered a
problem whereby the config was not reloading even when stopping and starting
exim via the init.d script.

Upon investigation it seems that the /var/run/exim4 directory had not been
created and so the pid file could not be written and subsequently exim could
not stop, restart or reload the config automatically.

Creating the exim4 directory resolved this issue.
(Continue reading)

Permalink | Reply | 2 comments |
headers
Ted Cooper | 9 Nov 2007 09:54
Favicon

Re: [Bug 627] New: /var/run/exim4 directory not create so pid file not created

Mike Dixson wrote:
> ------- You are receiving this mail because: -------
> You are on the CC list for the bug.
> 
> http://bugs.exim.org/show_bug.cgi?id=627
>            Summary: /var/run/exim4 directory not create so pid file not
>                     created
>            Product: Exim
>            Version: 4.60
>           Platform: Other
>         OS/Version: All
>             Status: NEW
>           Severity: bug
>           Priority: medium
>          Component: General execution
>         AssignedTo: ph10 <at> hermes.cam.ac.uk
>         ReportedBy: m.dixson <at> rave.ac.uk
>                 CC: exim-dev <at> exim.org
> 
> 
> Hi all,
> 
> On Ubuntu 6.06LTS with Exim 4.60 installed using apt-get I encountered a
> problem whereby the config was not reloading even when stopping and starting
> exim via the init.d script.
> 
> Upon investigation it seems that the /var/run/exim4 directory had not been
> created and so the pid file could not be written and subsequently exim could
> not stop, restart or reload the config automatically.
>
(Continue reading)

Permalink | Reply | 0 comments |
headers
Nigel Metheringham | 9 Nov 2007 10:03
Favicon
Gravatar

[Bug 627] /var/run/exim4 directory not create so pid file not created

------- You are receiving this mail because: -------
You are on the CC list for the bug.

http://bugs.exim.org/show_bug.cgi?id=627

Nigel Metheringham <nigel <at> exim.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |nigel <at> exim.org
             Status|NEW                         |RESOLVED
         Resolution|                            |INVALID

--- Comment #1 from Nigel Metheringham <nigel <at> exim.org>  2007-11-09 09:03:47 ---
This is an issue with the support (specifically the startup/shutdown) scripts
and/or the packaging - both of which are under the control of the packager (so
Ubuntu in this case).

This report seems somewhat odd in that Ubuntu is Debian based and their
packaging
is normally exemplary. 

Please resubmit up to the distribution bug tracking system.

-- 
Configure bugmail: http://bugs.exim.org/userprefs.cgi?tab=email

--

-- 
## List details at http://lists.exim.org/mailman/listinfo/exim-dev Exim details at
http://www.exim.org/ ##
(Continue reading)

Permalink | Reply | 0 comments |
headers
Jan Srzednicki | 9 Nov 2007 15:40
Picon

Re: PCRE vunerability and Exim ?

On Wed, Nov 07, 2007 at 08:41:00AM +0000, Dr Andrew C Aitchison wrote:
> 
> [ Sorry for spamming exim-dev but I believe that the
>    PCRE maintainer lurks there and not on exim-users  :-]
[..]
> exim-4.68 includes pcre 7.2, which is presumably vunerable.
> 
> I suspect that within exim pcre does not parse user-supplied
> expressions, so this is not a major vunerability, but is anyone
> in a position to confirm this, or do we need to release an updated
> version of exim ?

Well, that depends on site's setup. Exim can put user-supplied data into
the regex value (there's a string expansion target "rxquote" for that),
so I can imagine there are quite many of potentially vulnerable systems
out there.

-- 
  Jan Srzednicki  ::  http://wrzask.pl/
  "Remember, remember, the fifth of November"
                                     -- V for Vendetta

--

-- 
## List details at http://lists.exim.org/mailman/listinfo/exim-dev Exim details at
http://www.exim.org/ ##
Permalink | Reply | 2 comments |
headers
Nigel Metheringham | 12 Nov 2007 13:53
Favicon
Gravatar

[Bug 628] New: PCRE package is outdated and has known security issues

------- You are receiving this mail because: -------
You are on the CC list for the bug.

http://bugs.exim.org/show_bug.cgi?id=628
           Summary: PCRE package is outdated and has known security issues
           Product: Exim
           Version: 4.68
          Platform: Other
        OS/Version: All
            Status: NEW
          Severity: security
          Priority: high
         Component: General execution
        AssignedTo: nigel <at> exim.org
        ReportedBy: nigel <at> exim.org
                CC: exim-dev <at> exim.org

PCRE packaged in exim 4.68 is version 7.2

This has 2 known CVE issues within it:-
   CVE-2007-1659
   CVE-2007-1660

See
   http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-1659
   http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-1660

--

-- 
Configure bugmail: http://bugs.exim.org/userprefs.cgi?tab=email
(Continue reading)

Permalink | Reply | 1 comment |
headers
Nigel Metheringham | 12 Nov 2007 14:02
Favicon
Gravatar

[Bug 628] PCRE package is outdated and has known security issues

------- You are receiving this mail because: -------
You are on the CC list for the bug.

http://bugs.exim.org/show_bug.cgi?id=628

Nigel Metheringham <nigel <at> exim.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |FIXED

--- Comment #1 from Nigel Metheringham <nigel <at> exim.org>  2007-11-12 13:02:21 ---
CVS commit by nm4:

Updated embedded PCRE to version 7.4 to avoid 2 CVE issues:-
   CVE-2007-1659
   CVE-2007-1660

Fixes: bug # 628

--- CVS commit summary ---
1.535  1.536  +6 -0      -  exim/exim-doc/doc-txt/ChangeLog
1.11   1.12   +1 -1      -  exim/exim-src/OS/Makefile-Base
1.6    1.7    +241 -1    -  exim/exim-src/src/pcre/ChangeLog
1.3    1.4    +5 -0      -  exim/exim-src/src/pcre/config.h
1.6    1.7    +9 -2      -  exim/exim-src/src/pcre/dftables.c
1.6    1.7    +28 -9     -  exim/exim-src/src/pcre/pcre.h
1.1    1.2    +5 -1      -  exim/exim-src/src/pcre/pcre_chartables.c
1.5    1.6    +500 -167  -  exim/exim-src/src/pcre/pcre_compile.c
(Continue reading)

Permalink | Reply | 0 comments |
headers
Nigel Metheringham | 14 Nov 2007 13:49
Picon
Gravatar

Re: PCRE vunerability and Exim ?

This issue has taken much longer to resolve than I would like, but  
unfortunately on a volunteer project you are subject to the vagaries  
of time that people have available - and I'm currently rather heavily  
loaded and I guess other people have been too.

The current state of CVS is that an update of PCRE to 7.4 has been  
checked in.  Other changes since 4.68 are either minor bug fixes or  
should be restricted to special installations only (DKIM changes  
require an experimental compile option).  So other than an overall  
version update the CVS tree should be releasable....

The reason I haven't moved to that is that I haven't been able to  
properly test it at present.  I have not previously had the exim test  
rig running (lack of time again) and am having trouble getting that  
into action.

I'll work on that as I can, but if other people could test the current  
CVS copy - and even better push it through the test suite and report  
back, that would be very useful.

	Nigel.

--
[ Nigel Metheringham           Nigel.Metheringham <at> InTechnology.co.uk ]
[ - Comments in this message are my own and not ITO opinion/policy - ]

--

-- 
## List details at http://lists.exim.org/mailman/listinfo/exim-dev Exim details at
http://www.exim.org/ ##
(Continue reading)

Permalink | Reply | 1 comment |
headers
Daniel Tiefnig | 14 Nov 2007 19:06
Picon

Re: PCRE vunerability and Exim ?

Nigel Metheringham wrote:
> I'll work on that as I can, but if other people could test the
> current CVS copy - and even better push it through the test suite and
> report back, that would be very useful.

Hej,

I gave it a try. I don't have time to debug things at the moment, so I
just list what I have found. If anyone feels like fixing things and
needs some further information and investigation, please just contact me
via the list or PM.

Attention, lots of debug output ahead.

Here's how i ran the testsuite:
--------------------------------------------------------------------
$ ./runtest
Exim tester 4.68 (23-Aug-07)
You need to have sudo access to root to run these tests. Checking ...
Test for sudo OK
Exim binary found in ./../exim-snapshot/build-Linux-x86_64/exim
--------------------------------------------------------------------
Exim version 4.68 #2 built 14-Nov-2007 14:50:06
Support for: iconv() Content_Scanning Old_Demime
Lookups: lsearch wildlsearch nwildlsearch iplsearch dbm dbmnz
Routers: accept dnslookup ipliteral manualroute queryprogram redirect
Transports: appendfile/maildir autoreply pipe smtp
--------------------------------------------------------------------
The spamc command failed: assume SpamAssassin (spamd) is not running
Program caller is dtiefnig, whose group is dtiefnig
(Continue reading)

Permalink | Reply | 0 comments |

Gmane