製品・ソフトウェアに関する情報

JVN脆弱性詳細

Exim におけるリソースの枯渇に関する脆弱性

Title	Exim におけるリソースの枯渇に関する脆弱性
Summary	Exim には、リソースの枯渇に関する脆弱性が存在します。
Possible impacts	サービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	Nov. 24, 2017, midnight
Registration Date	Dec. 15, 2017, 4:46 p.m.
Last Update	Dec. 15, 2017, 4:46 p.m.

Affected System

Debian

Debian GNU/Linux

Exim Development

Exim 4.88

Exim 4.89

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2017-16944	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16944
National Vulnerability Database (NVD)
2	CVE-2017-16944	https://nvd.nist.gov/vuln/detail/CVE-2017-16944

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-400	https://cwe.mitre.org/data/definitions/400.html

ベンダー情報

No	Name	URL
Bugzilla
1	Bug 2201	https://bugs.exim.org/show_bug.cgi?id=2201
Debian Security Advisory
2	DSA-4053	https://www.debian.org/security/2017/dsa-4053
Exim
3	[exim-announce] Critical Exim Security Vulnerability: disable chunking	https://lists.exim.org/lurker/message/20171125.034842.d1d75cac.en.html

Change Log

No	Changed Details	Date of change
0	[2017年12月15日] 掲載	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2017-16944

Summary	The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service (infinite loop and stack exhaustion) via vectors involving BDAT commands and an improper check for a '.' character signifying the end of the content, related to the bdat_getc function.
Publication Date	Nov. 26, 2017, 2:29 a.m.
Registration Date	Jan. 26, 2021, 1:18 p.m.
Last Update	Nov. 21, 2024, 12:17 p.m.

Affected software configurations

Configuration2		or higher	or less	more than	less than
cpe:2.3:o:debian:debian_linux:9.0:::::::*

Related information, measures and tools

No	URL	タグ
1	http://openwall.com/lists/oss-security/2017/11/25/1	Mailing List
2	http://openwall.com/lists/oss-security/2017/11/25/1	Mailing List
3	http://openwall.com/lists/oss-security/2017/11/25/2	Mailing List
4	http://openwall.com/lists/oss-security/2017/11/25/2	Mailing List
5	http://openwall.com/lists/oss-security/2017/11/25/3	Mailing List
6	http://openwall.com/lists/oss-security/2017/11/25/3	Mailing List
7	http://www.openwall.com/lists/oss-security/2021/05/04/7
8	http://www.openwall.com/lists/oss-security/2021/05/04/7
9	http://www.securitytracker.com/id/1039873	Third Party Advisory VDB Entry
10	http://www.securitytracker.com/id/1039873	Third Party Advisory VDB Entry
11	https://bugs.exim.org/show_bug.cgi?id=2201	Exploit Issue Tracking
12	https://bugs.exim.org/show_bug.cgi?id=2201	Exploit Issue Tracking
13	https://lists.exim.org/lurker/message/20171125.034842.d1d75cac.en.html	Mailing List
14	https://lists.exim.org/lurker/message/20171125.034842.d1d75cac.en.html	Mailing List
15	https://www.debian.org/security/2017/dsa-4053	Third Party Advisory
16	https://www.debian.org/security/2017/dsa-4053	Third Party Advisory
17	https://www.exploit-db.com/exploits/43184/	Third Party Advisory VDB Entry
18	https://www.exploit-db.com/exploits/43184/	Third Party Advisory VDB Entry

Common Vulnerabilities List