CVE-2023-42114

NameCVE-2023-42114
DescriptionExim NTLM Challenge Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Exim. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of NTLM challenge requests. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated data structure. An attacker can leverage this vulnerability to disclose information in the context of the service account. Was ZDI-CAN-17433.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3599-1, DSA-5512-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
exim4 (PTS)buster4.92-8+deb10u6vulnerable
buster (security)4.92-8+deb10u9fixed
bullseye (security), bullseye4.94.2-7+deb11u2fixed
bookworm, bookworm (security)4.96-15+deb12u4fixed
sid, trixie4.97-8fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
exim4sourcebuster4.92-8+deb10u8DLA-3599-1
exim4sourcebullseye4.94.2-7+deb11u1DSA-5512-1
exim4sourcebookworm4.96-15+deb12u2DSA-5512-1
exim4source(unstable)4.97~RC1-2

Notes

https://www.zerodayinitiative.com/advisories/ZDI-23-1468/
https://bugs.exim.org/show_bug.cgi?id=3001
https://git.exim.org/exim.git/log/refs/heads/exim-4.96%20security/exim.git/commit/ccf9816f54fb04ab5508eb8c7f00b08bc3531297
https://www.openwall.com/lists/oss-security/2023/09/29/5
https://www.openwall.com/lists/oss-security/2023/10/01/4
https://exim.org/static/doc/security/CVE-2023-zdi.txt

Search for package or bug name: Reporting problems