製品・ソフトウェアに関する情報

JVN脆弱性詳細

Exim における認可・権限・アクセス制御に関する脆弱性

Title	Exim における認可・権限・アクセス制御に関する脆弱性
Summary	Exim には、認可・権限・アクセス制御に関する脆弱性が存在します。
Possible impacts	情報を改ざんされる可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	June 19, 2017, midnight
Registration Date	July 21, 2017, 3:33 p.m.
Last Update	July 21, 2017, 3:33 p.m.

Affected System

Exim Development

Exim 4.89 およびそれ以前

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2017-1000369	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000369
National Vulnerability Database (NVD)
2	CVE-2017-1000369	https://nvd.nist.gov/vuln/detail/CVE-2017-1000369
Red Hat Customer Portal
3	CVE-2017-1000369	https://access.redhat.com/security/cve/CVE-2017-1000369

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-264	https://jvndb.jvn.jp/ja/cwe/CWE-264.html

ベンダー情報

No	Name	URL
Exim
1	Top Page	http://www.exim.org/
GitHub
2	Cleanup (prevent repeated use of -p/-oMr to avoid mem leak)	https://github.com/Exim/exim/commit/65e061b76867a9ea7aeeb535341b790b90ae6c21

Change Log

No	Changed Details	Date of change
0	[2017年07月21日] 掲載	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2017-1000369

Summary	Exim supports the use of multiple "-p" command line arguments which are malloc()'ed and never free()'ed, used in conjunction with other issues allows attackers to cause arbitrary code execution. This affects exim version 4.89 and earlier. Please note that at this time upstream has released a patch (commit 65e061b76867a9ea7aeeb535341b790b90ae6c21), but it is not known if a new point release is available that addresses this issue at this time.
Publication Date	June 20, 2017, 1:29 a.m.
Registration Date	Jan. 26, 2021, 1:11 p.m.
Last Update	Nov. 21, 2024, 12:04 p.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	http://www.debian.org/security/2017/dsa-3888	Third Party Advisory
2	http://www.debian.org/security/2017/dsa-3888	Third Party Advisory
3	http://www.securityfocus.com/bid/99252	Third Party Advisory VDB Entry
4	http://www.securityfocus.com/bid/99252	Third Party Advisory VDB Entry
5	http://www.securitytracker.com/id/1038779	Third Party Advisory VDB Entry
6	http://www.securitytracker.com/id/1038779	Third Party Advisory VDB Entry
7	https://access.redhat.com/security/cve/CVE-2017-1000369	Vendor Advisory
8	https://access.redhat.com/security/cve/CVE-2017-1000369	Vendor Advisory
9	https://github.com/Exim/exim/commit/65e061b76867a9ea7aeeb535341b790b90ae6c21	Mitigation Third Party Advisory
10	https://github.com/Exim/exim/commit/65e061b76867a9ea7aeeb535341b790b90ae6c21	Mitigation Third Party Advisory
11	https://security.gentoo.org/glsa/201709-19	Third Party Advisory
12	https://security.gentoo.org/glsa/201709-19	Third Party Advisory
13	https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt	Third Party Advisory
14	https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt	Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-404	リソースの不適切なシャットダウンおよびリリース	https://cwe.mitre.org/data/definitions/404.html