Vulnerabilities > CVE-2012-5671 - Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Exim

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Fedora Security Advisory 2012-17044.
#

include("compat.inc");

if (description)
{
  script_id(62754);
  script_version("1.10");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/12");

  script_cve_id("CVE-2012-5671");
  script_bugtraq_id(56146, 56285);
  script_xref(name:"FEDORA", value:"2012-17044");

  script_name(english:"Fedora 17 : exim-4.76-9.fc17 (2012-17044)");
  script_summary(english:"Checks rpm output for the updated package.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Fedora host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"This update protect DKIM DNS decoding from remote exploit,
CVE-2012-5671.

Note that Tenable Network Security has extracted the preceding
description block directly from the Fedora security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.redhat.com/show_bug.cgi?id=870347"
  );
  # https://lists.fedoraproject.org/pipermail/package-announce/2012-October/090900.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?e45159ee"
  );
  script_set_attribute(attribute:"solution", value:"Update the affected exim package.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:ND/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:exim");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:17");

  script_set_attribute(attribute:"patch_publication_date", value:"2012/10/28");
  script_set_attribute(attribute:"plugin_publication_date", value:"2012/10/30");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2012-2020 Tenable Network Security, Inc.");
  script_family(english:"Fedora Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
os_ver = os_ver[1];
if (! ereg(pattern:"^17([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 17.x", "Fedora " + os_ver);

if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);

flag = 0;
if (rpm_check(release:"FC17", reference:"exim-4.76-9.fc17")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "exim");
}

#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(62734);
  script_version("1.6");
  script_cvs_date("Date: 2019/12/04");

  script_cve_id("CVE-2012-5671");
  script_bugtraq_id(56285);

  script_name(english:"Exim 4.70 - 4.80 DKIM DNS Record Parsing Remote Buffer Overflow");
  script_summary(english:"Checks version of SMTP banner");

  script_set_attribute(attribute:"synopsis", value:
"The remote mail server is potentially affected by a buffer overflow
vulnerability.");
  script_set_attribute(attribute:"description", value:
"According to its banner, the version of Exim running on the remote host
is between 4.70 and 4.80 inclusive.  It therefore is potentially
affected by a remote, heap-based buffer overflow vulnerability when
decoding DKIM (DomainKeys Identified Mail) DNS records that can be
triggered by a specially crafted email sent from a domain under the
attacker's control. 

By exploiting this flaw, a remote, unauthenticated attacker could
execute arbitrary code on the remote host subject to the privileges of
the user running the affected application.

Note that this issue is only exploitable when exim is built with DKIM
support, which is true by default, and has not been disabled.  Note too
that Nessus has not checked whether either condition is true.");
  script_set_attribute(attribute:"see_also", value:"ftp://ftp.exim.org/pub/exim/ChangeLogs/ChangeLog-4.80.1");
  script_set_attribute(attribute:"see_also", value:"https://lists.exim.org/lurker/message/20121026.080330.74b9147b.en.html");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Exim 4.80.1 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2012-5671");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2012/10/26");
  script_set_attribute(attribute:"patch_publication_date", value:"2012/10/26");
  script_set_attribute(attribute:"plugin_publication_date", value:"2012/10/29");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:exim:exim");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"SMTP problems");

  script_copyright(english:"This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("smtpserver_detect.nasl");
  script_require_keys("Settings/ParanoidReport");
  script_require_ports("Services/smtp", 25);

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("smtp_func.inc");

if (report_paranoia < 2) audit(AUDIT_PARANOID);

port = get_service(svc:"smtp", default:25, exit_on_fail:TRUE);

banner = get_smtp_banner(port:port);
if (!banner) exit(1, "Failed to retrieve the banner from the SMTP server listening on port "+port+".");
if ("Exim" >!< banner) exit(0, "The banner from the SMTP server listening on port "+port+" is not from Exim.");

matches = eregmatch(pattern:"220.*Exim ([0-9\.]+)", string:banner);
if (isnull(matches)) exit(1, "Failed to determine the version of Exim based on the banner from the SMTP server listening on port "+port+".");

version = matches[1];
if (ereg(pattern:'^(4\\.(7[0-9]([^0-9]|$)|80$))', string:version))
{
  if (report_verbosity > 0)
  {
    report =
      '\n  Banner            : ' + banner +
      '\n  Installed version : ' + version +
      '\n  Fixed version     : 4.80.1';
    security_warning(port:port, extra:report);
  }
  else security_warning(port);
  exit(0);
}
else audit(AUDIT_LISTEN_NOT_VULN, 'Exim', port, version);

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from the FreeBSD VuXML database :
#
# Copyright 2003-2018 Jacques Vidrine and contributors
#
# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,
# HTML, PDF, PostScript, RTF and so forth) with or without modification,
# are permitted provided that the following conditions are met:
# 1. Redistributions of source code (VuXML) must retain the above
#    copyright notice, this list of conditions and the following
#    disclaimer as the first lines of this file unmodified.
# 2. Redistributions in compiled form (transformed to other DTDs,
#    published online in any format, converted to PDF, PostScript,
#    RTF and other formats) must reproduce the above copyright
#    notice, this list of conditions and the following disclaimer
#    in the documentation and/or other materials provided with the
#    distribution.
# 
# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS"
# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS
# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,
# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#

include("compat.inc");

if (description)
{
  script_id(62706);
  script_version("1.5");
  script_cvs_date("Date: 2018/11/10 11:49:43");

  script_cve_id("CVE-2012-5671");

  script_name(english:"FreeBSD : Exim -- remote code execution (b0f3ab1f-1f3b-11e2-8fe9-0022156e8794)");
  script_summary(english:"Checks for updated package in pkg_info output");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote FreeBSD host is missing a security-related update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"This vulnerability affects Exim instances built with DKIM enabled
(this is the default for FreeBSD Exim port) and running verification
of DKIM signatures on the incoming mail messages.

Phil Penncock reports :

This is a SECURITY release, addressing a CRITICAL remote code
execution flaw in versions of Exim between 4.70 and 4.80 inclusive,
when built with DKIM support (the default).

This security vulnerability can be exploited by anyone who can send
email from a domain for which they control the DNS.

You are not vulnerable if you built Exim with DISABLE_DKIM or if you
put this at the start of an ACL plumbed into acl_smtp_connect or
acl_smtp_rcpt : warn control = dkim_disable_verify"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://lists.exim.org/lurker/message/20121026.080330.74b9147b.en.html"
  );
  # https://vuxml.freebsd.org/freebsd/b0f3ab1f-1f3b-11e2-8fe9-0022156e8794.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?88fadba2"
  );
  script_set_attribute(attribute:"solution", value:"Update the affected package.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:exim");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:freebsd:freebsd");

  script_set_attribute(attribute:"vuln_publication_date", value:"2012/10/25");
  script_set_attribute(attribute:"patch_publication_date", value:"2012/10/26");
  script_set_attribute(attribute:"plugin_publication_date", value:"2012/10/26");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2012-2018 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"FreeBSD Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/FreeBSD/release", "Host/FreeBSD/pkg_info");

  exit(0);
}


include("audit.inc");
include("freebsd_package.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/FreeBSD/release")) audit(AUDIT_OS_NOT, "FreeBSD");
if (!get_kb_item("Host/FreeBSD/pkg_info")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;

if (pkg_test(save_report:TRUE, pkg:"exim>=4.70<4.80.1")) flag++;

if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:pkg_report_get());
  else security_warning(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Debian Security Advisory DSA-2566. The text 
# itself is copyright (C) Software in the Public Interest, Inc.
#

include("compat.inc");

if (description)
{
  script_id(62721);
  script_version("1.9");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/12");

  script_cve_id("CVE-2012-5671");
  script_xref(name:"DSA", value:"2566");

  script_name(english:"Debian DSA-2566-1 : exim4 - heap-based buffer overflow");
  script_summary(english:"Checks dpkg output for the updated package");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Debian host is missing a security-related update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"It was discovered that Exim, a mail transport agent, is not properly
handling the decoding of DNS records for DKIM. Specifically, crafted
records can yield to a heap-based buffer overflow. An attacker can
exploit this flaw to execute arbitrary code."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://packages.debian.org/source/squeeze/exim4"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.debian.org/security/2012/dsa-2566"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"Upgrade the exim4 packages.

For the stable distribution (squeeze), this problem has been fixed in
version 4.72-6+squeeze3."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:exim4");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:6.0");

  script_set_attribute(attribute:"patch_publication_date", value:"2012/10/25");
  script_set_attribute(attribute:"plugin_publication_date", value:"2012/10/29");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Debian Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}


include("audit.inc");
include("debian_package.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;
if (deb_check(release:"6.0", prefix:"exim4", reference:"4.72-6+squeeze3")) flag++;
if (deb_check(release:"6.0", prefix:"exim4-base", reference:"4.72-6+squeeze3")) flag++;
if (deb_check(release:"6.0", prefix:"exim4-config", reference:"4.72-6+squeeze3")) flag++;
if (deb_check(release:"6.0", prefix:"exim4-daemon-heavy", reference:"4.72-6+squeeze3")) flag++;
if (deb_check(release:"6.0", prefix:"exim4-daemon-heavy-dbg", reference:"4.72-6+squeeze3")) flag++;
if (deb_check(release:"6.0", prefix:"exim4-daemon-light", reference:"4.72-6+squeeze3")) flag++;
if (deb_check(release:"6.0", prefix:"exim4-daemon-light-dbg", reference:"4.72-6+squeeze3")) flag++;
if (deb_check(release:"6.0", prefix:"exim4-dbg", reference:"4.72-6+squeeze3")) flag++;
if (deb_check(release:"6.0", prefix:"exim4-dev", reference:"4.72-6+squeeze3")) flag++;
if (deb_check(release:"6.0", prefix:"eximon4", reference:"4.72-6+squeeze3")) flag++;

if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());
  else security_warning(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from openSUSE Security Update openSUSE-2012-738.
#
# The text description of this plugin is (C) SUSE LLC.
#

include("compat.inc");

if (description)
{
  script_id(74790);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");

  script_cve_id("CVE-2011-1764", "CVE-2012-5671");

  script_name(english:"openSUSE Security Update : exim (openSUSE-SU-2012:1404-1)");
  script_summary(english:"Check for the openSUSE-2012-738 patch");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote openSUSE host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:"This update fixes a remotely exploitable overflow in DKIM handling."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.novell.com/show_bug.cgi?id=670711"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.novell.com/show_bug.cgi?id=786652"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://lists.opensuse.org/opensuse-updates/2012-10/msg00083.html"
  );
  script_set_attribute(attribute:"solution", value:"Update the affected exim packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:exim");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:exim-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:exim-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:eximon");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:eximon-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:eximstats-html");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:12.1");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:12.2");

  script_set_attribute(attribute:"vuln_publication_date", value:"2011/10/04");
  script_set_attribute(attribute:"patch_publication_date", value:"2012/10/26");
  script_set_attribute(attribute:"plugin_publication_date", value:"2014/06/13");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
if (release !~ "^(SUSE12\.1|SUSE12\.2)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "12.1 / 12.2", release);
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

ourarch = get_kb_item("Host/cpu");
if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);

flag = 0;

if ( rpm_check(release:"SUSE12.1", reference:"exim-4.80.1-5.4.1") ) flag++;
if ( rpm_check(release:"SUSE12.1", reference:"exim-debuginfo-4.80.1-5.4.1") ) flag++;
if ( rpm_check(release:"SUSE12.1", reference:"exim-debugsource-4.80.1-5.4.1") ) flag++;
if ( rpm_check(release:"SUSE12.1", reference:"eximon-4.80.1-5.4.1") ) flag++;
if ( rpm_check(release:"SUSE12.1", reference:"eximon-debuginfo-4.80.1-5.4.1") ) flag++;
if ( rpm_check(release:"SUSE12.1", reference:"eximstats-html-4.80.1-5.4.1") ) flag++;
if ( rpm_check(release:"SUSE12.2", reference:"exim-4.80.1-2.4.1") ) flag++;
if ( rpm_check(release:"SUSE12.2", reference:"exim-debuginfo-4.80.1-2.4.1") ) flag++;
if ( rpm_check(release:"SUSE12.2", reference:"exim-debugsource-4.80.1-2.4.1") ) flag++;
if ( rpm_check(release:"SUSE12.2", reference:"eximon-4.80.1-2.4.1") ) flag++;
if ( rpm_check(release:"SUSE12.2", reference:"eximon-debuginfo-4.80.1-2.4.1") ) flag++;
if ( rpm_check(release:"SUSE12.2", reference:"eximstats-html-4.80.1-2.4.1") ) flag++;

if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
  else security_hole(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "exim");
}

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from openSUSE Security Update openSUSE-2014-482.
#
# The text description of this plugin is (C) SUSE LLC.
#

include("compat.inc");

if (description)
{
  script_id(77126);
  script_version("1.5");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");

  script_cve_id("CVE-2011-1407", "CVE-2012-5671", "CVE-2014-2957", "CVE-2014-2972");

  script_name(english:"openSUSE Security Update : exim (openSUSE-SU-2014:0983-1)");
  script_summary(english:"Check for the openSUSE-2014-482 patch");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote openSUSE host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Changes in exim :

  - Silence static checkers; (beo#1506).

  - update to 4.83 This release of Exim includes one
    incompatible fix :

  + the behavior of expansion of arguments to math
    comparison functions (<, <=, =, =>, >) was unexpected,
    expanding the values twice; CVE-2014-2972; (bnc#888520)
    This release contains the following enhancements and
    bugfixes :

  + PRDR was promoted from Experimental to mainline

  + OCSP Stapling was promoted from Experimental to mainline

  + new Experimental feature Proxy Protocol

  + new Experimental feature DSN (Delivery Status
    Notifications)

  + TLS session improvements

  + TLS SNI fixes

  + LDAP enhancements

  + DMARC fixes (previous CVE-2014-2957) and new
    $dmarc_domain_policy

  + several new operations (listextract, utf8clean, md5,
    sha1)

  + enforce header formatting with verify=header_names_ascii

  + new commandline option -oMm

  + new TLSA dns lookup

  + new malware 'sock' type

  + cutthrough routing enhancements

  + logging enhancements

  + DNSSEC enhancements

  + exiqgrep enhancements

  + deprecating non-standard SPF results

  + build and portability fixes

  + documentation fixes and enhancements

  - Verify source tar ball gpg signature.

  - Refresh exim-enable_ecdh_openssl.patch and strip version
    number from the patch filename.

  - exim482-enable_ecdh_openssl.patch: Enable ECDH (elliptic
    curve diffie hellman) support, taken from
    http://bugs.exim.org/show_bug.cgi?id=1397

  - BuildRequire libopenssl-devel only on SUSE systems.

  - Fix suse_version condition of the pre- and postun
    scriptlets.

  - Call service_add_pre from pre scriptlet on post-12.2
    systems.

  - update to 4.82

  - Add -bI: framework, and -bI:sieve for querying sieve
    capabilities.

  - Make -n do something, by making it not do something.
    When combined with -bP, the name of an option is not
    output.

  - Added tls_dh_min_bits SMTP transport driver option, only
    honoured by GnuTLS.

  - First step towards DNSSEC, provide $sender_host_dnssec
    for $sender_host_name and config options to manage this,
    and basic check routines.

  - DSCP support for outbound connections and control
    modifier for inbound.

  - Cyrus SASL: set local and remote IP;port properties for
    driver. (Only plugin which currently uses this is
    kerberos4, which nobody should be using, but we should
    make it available and other future plugins might
    conceivably use it, even though it would break NAT;
    stuff *should* be using channel bindings instead).

  - Handle 'exim -L <tag>' to indicate to use syslog with
    tag as the process name; added for Sendmail
    compatibility; requires admin caller. Handle -G as
    equivalent to 'control = suppress_local_fixups' (we used
    to just ignore it); requires trusted caller. Also parse
    but ignore: -Ac -Am -X<logfile> Bugzilla 1117.

  - Bugzilla 1258 - Refactor MAIL FROM optional args
    processing.

  - Add +smtp_confirmation as a default logging option.

  - Bugzilla 198 - Implement remove_header ACL modifier.

  - Bugzilla 1197, 1281, 1283 - Spec typo.

  - Bugzilla 1290 - Spec grammar fixes.

  - Bugzilla 1285 - Spec omission, fix docbook errors for
    spec.txt creation.

  - Add Experimental DMARC support using libopendmarc
    libraries.

  - Fix an out of order global option causing a segfault.
    Reported to dev mailing list by by Dmitry Isaikin.

  - Bugzilla 1201 & 304 - New cutthrough-delivery feature,
    with TLS support.

  - Support 'G' suffix to numbers in $(if comparisons.

  - Handle smtp transport tls_sni option forced-fail for
    OpenSSL.

  - Bugzilla 1196 - Spec examples corrections

  - Add expansion operators $(listnamed:name) and
    $(listcount:string)

  - Add gnutls_allow_auto_pkcs11 option (was originally
    called gnutls_enable_pkcs11, but renamed to more
    accurately indicate its function.

  - Let Linux makefile inherit CFLAGS/CFLAGS_DYNAMIC. Pulled
    from Debian 30_dontoverridecflags.dpatch by Andreas
    Metzler.

  - Add expansion item $(acl (name)(arg)...), expansion
    condition 'acl ((name)(arg)...)', and optional args on
    acl condition 'acl = name arg...'

  - Permit multiple router/transport headers_add/remove
    lines.

  - Add dnsdb pseudo-lookup 'a+' to do an 'aaaa' + 'a'
    combination.

  - Avoid using a waiting database for a single-message-only
    transport. Performance patch from Paul Fisher. Bugzilla
    1262.

  - Strip leading/trailing newlines from add_header ACL
    modifier data. Bugzilla 884.

  - Add $headers_added variable, with content from use of
    ACL modifier add_header (but not yet added to the
    message). Bugzilla 199.

  - Add 8bitmime log_selector, for 8bitmime status on the
    received line. Pulled from Bugzilla 817 by Wolfgang
    Breyha.

  - SECURITY: protect DKIM DNS decoding from remote exploit.
    CVE-2012-5671 (nb: this is the same fix as in Exim
    4.80.1)

  - Add A= logging on delivery lines, and a client_set_id
    option on authenticators.

  - Add optional authenticated_sender logging to A= and a
    log_selector for control.

  - Unbreak server_set_id for NTLM/SPA auth, broken by 4.80
    PP/29.

  - Dovecot auth: log better reason to rejectlog if Dovecot
    did not advertise SMTP AUTH mechanism to us, instead of
    a generic protocol violation error. Also, make Exim more
    robust to bad data from the Dovecot auth socket.

  - Fix ultimate retry timeouts for intermittently
    deliverable recipients.

  - When a queue runner is handling a message, Exim first
    routes the recipient addresses, during which it prunes
    them based on the retry hints database. After that it
    attempts to deliver the message to any remaining
    recipients. It then updates the hints database using the
    retry rules.

  - So if a recipient address works intermittently, it can
    get repeatedly deferred at routing time. The retry hints
    record remains fresh so the address never reaches the
    final cutoff time.

  - This is a fairly common occurrence when a user is
    bumping up against their storage quota. Exim had some
    logic in its local delivery code to deal with this.
    However it did not apply to per-recipient defers in
    remote deliveries, e.g. over LMTP to a separate IMAP
    message store.

  - This change adds a proper retry rule check during
    routing so that the final cutoff time is checked against
    the message's age. We only do this check if there is an
    address retry record and there is not a domain retry
    record; this implies that previous attempts to handle
    the address had the retry_use_local_parts option turned
    on. We use this as an approximation for the destination
    being like a local delivery, as in LMTP.

  - I suspect this new check makes the old local delivery
    cutoff check redundant, but I have not verified this so
    I left the code in place.

  - Correct gecos expansion when From: is a prefix of the
    username.

  - Test 0254 submits a message to Exim with the header &#9;
    Resent-From: f

  - When I ran the test suite under the user fanf2, Exim
    expanded the header to contain my full name, whereas it
    should have added a Resent-Sender: header. It
    erroneously treats any prefix of the username as equal
    to the username. This change corrects that bug.

  - DCC debug and logging tidyup Error conditions log to
    paniclog rather than rejectlog. Debug lines prefixed by
    'DCC: ' to remove any ambiguity.

  - Avoid unnecessary rebuilds of lookup-related code.

  - Fix OCSP reinitialisation in SNI handling for Exim/TLS
    as server. Bug spotted by Jeremy Harris; was flawed
    since initial commit. Would have resulted in OCSP
    responses post-SNI triggering an Exim NULL dereference
    and crash.

  - Add $router_name and $transport_name variables. Bugzilla
    308.

  - Define SIOCGIFCONF_GIVES_ADDR for GNU Hurd. Bug
    detection, analysis and fix by Samuel Thibault. Bugzilla
    1331, Debian bug #698092.

  - Update eximstats to watch out for senders sending 'HELO
    [IpAddr]'

  - SMTP PRDR
    (http://www.eric-a-hall.com/specs/draft-hall-prdr-00.txt
    ). Server implementation by Todd Lyons, client by JH.
    Only enabled when compiled with EXPERIMENTAL_PRDR. A new
    config variable 'prdr_enable' controls whether the
    server advertises the facility. If the client requests
    PRDR a new acl_data_smtp_prdr ACL is called once for
    each recipient, after the body content is received and
    before the acl_smtp_data ACL. The client is controlled
    by bolth of: a hosts_try_prdr option on the smtp
    transport, and the server advertisement. Default client
    logging of deliveries and rejections involving PRDR are
    flagged with the string 'PRDR'.

  - Fix problems caused by timeouts during quit ACLs trying
    to double fclose(). Diagnosis by Todd Lyons. Update
    configure.default to handle IPv6 localhost better. Patch
    by Alain Williams (plus minor tweaks). Bugzilla 880.

  - OpenSSL made graceful with empty tls_verify_certificates
    setting. This is now consistent with GnuTLS, and is now
    documented: the previous undocumented portable approach
    to treating the option as unset was to force an
    expansion failure. That still works, and an empty string
    is now equivalent.

  - Renamed DNSSEC-enabling option to 'dns_dnssec_ok', to
    make it clearer that Exim is using the DO (DNSSEC OK)
    EDNS0 resolver flag, not performing validation itself.

  - Added force_command boolean option to pipe transport.
    Patch from Nick Koston, of cPanel Inc.

  - AUTH support on callouts (and hence
    cutthrough-deliveries). Bugzilla 321, 823.

  - Added udpsend ACL modifer and hexquote expansion
    operator

  - Fix eximon continuous updating with timestamped
    log-files. Broken in a format-string cleanup in 4.80,
    missed when I repaired the other false fix of the same
    issue. Report and fix from Heiko Schlichting. Bugzilla
    1363.

  - Guard LDAP TLS usage against Solaris LDAP variant.
    Report from Prashanth Katuri.

  - Support safari_ecdhe_ecdsa_bug for openssl_options. It's
    SecureTransport, so affects any MacOS clients which use
    the system-integrated TLS libraries, including email
    clients.

  - Fix segfault from trying to fprintf() to a NULL stdio
    FILE* if using a MIME ACL for non-SMTP local injection.
    Report and assistance in diagnosis by Warren Baker.

  - Adjust exiqgrep to be case-insensitive for
    sender/receiver.

  - Fix comparisons for 64b. Bugzilla 1385.

  - Add expansion variable $authenticated_fail_id to keep
    track of last id that failed so it may be referenced in
    subsequent ACL's.

  - Bugzilla 1375 - Prevent TLS rebinding in ldap. Patch
    provided by Alexander Miroch.

  - Bugzilla 1382 - Option ldap_require_cert overrides
    start_tls ldap library initialization, allowing
    self-signed CA's to be used. Also properly sets
    require_cert option later in code by using NULL (global
    ldap config) instead of ldap handle (per session). Bug
    diagnosis and testing by alxgomz.

  - Enhanced documentation in the ratelimit.pl script
    provided in the src/util/ subdirectory.

  - Bug 1301 - Imported transport SQL logging patch from
    Axel Rau renamed to Transport Post Delivery Action by
    Jeremy Harris, as EXPERIMENTAL_TPDA.

  - Bugzilla 1217 - Redis lookup support has been added. It
    is only enabled when Exim is compiled with
    EXPERIMENTAL_REDIS. A new config variable redis_servers
    = needs to be configured which will be used by the redis
    lookup. Patch from Warren Baker, of The Packet Hub.

  - Fix exiqsumm summary for corner case. Patch provided by
    Richard Hall.

  - Bugzilla 1289 - Clarify host/ip processing when have
    errors looking up a hostname or reverse DNS when
    processing a host list. Used suggestions from multiple
    comments on this bug.

  - Bugzilla 1057 - Multiple clamd TCP targets patch from
    Mark Zealey.

  - Had previously added a -CONTINUE option to runtest in
    the test suite. Missed a few lines, added it to make the
    runtest require no keyboard interaction.

  - Bugzilla 1402 - Test 533 fails if any part of the path
    to the test suite contains upper case chars. Make router
    use caseful_local_part.

  - Bugzilla 1400 - Add AVOID_GNUTLS_PKCS11 build option.
    Allows GnuTLS support when GnuTLS has been built with
    p11-kit.

  - Add systemd support for openSUSE > 12.2

  - Remove some obsolete conditionnal macros

  - exim.spec forces the use of SSL libraries, so make sure
    the BuildRequires are there. Also add previously
    implicit cyrus-sasl back.

  - Fixed another remote code execution issue (CVE-2011-1407
    / bnc#694798)

  - Fixed STARTTLS command injection (bnc#695144)"
  );
  # http://bugs.exim.org/show_bug.cgi?id=1397
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugs.exim.org/show_bug.cgi?id=1397"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.eric-a-hall.com/specs/draft-hall-prdr-00.txt"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.novell.com/show_bug.cgi?id=694798"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.novell.com/show_bug.cgi?id=695144"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.novell.com/show_bug.cgi?id=888520"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://lists.opensuse.org/opensuse-updates/2014-08/msg00014.html"
  );
  script_set_attribute(attribute:"solution", value:"Update the affected exim packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:exim");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:exim-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:exim-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:eximon");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:eximon-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:eximstats-html");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:12.3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:13.1");

  script_set_attribute(attribute:"vuln_publication_date", value:"2011/05/16");
  script_set_attribute(attribute:"patch_publication_date", value:"2014/07/25");
  script_set_attribute(attribute:"plugin_publication_date", value:"2014/08/12");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
if (release !~ "^(SUSE12\.3|SUSE13\.1)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "12.3 / 13.1", release);
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

ourarch = get_kb_item("Host/cpu");
if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);

flag = 0;

if ( rpm_check(release:"SUSE12.3", reference:"exim-4.83-3.4.1") ) flag++;
if ( rpm_check(release:"SUSE12.3", reference:"exim-debuginfo-4.83-3.4.1") ) flag++;
if ( rpm_check(release:"SUSE12.3", reference:"exim-debugsource-4.83-3.4.1") ) flag++;
if ( rpm_check(release:"SUSE12.3", reference:"eximon-4.83-3.4.1") ) flag++;
if ( rpm_check(release:"SUSE12.3", reference:"eximon-debuginfo-4.83-3.4.1") ) flag++;
if ( rpm_check(release:"SUSE12.3", reference:"eximstats-html-4.83-3.4.1") ) flag++;
if ( rpm_check(release:"SUSE13.1", reference:"exim-4.83-6.4.1") ) flag++;
if ( rpm_check(release:"SUSE13.1", reference:"exim-debuginfo-4.83-6.4.1") ) flag++;
if ( rpm_check(release:"SUSE13.1", reference:"exim-debugsource-4.83-6.4.1") ) flag++;
if ( rpm_check(release:"SUSE13.1", reference:"eximon-4.83-6.4.1") ) flag++;
if ( rpm_check(release:"SUSE13.1", reference:"eximon-debuginfo-4.83-6.4.1") ) flag++;
if ( rpm_check(release:"SUSE13.1", reference:"eximstats-html-4.83-6.4.1") ) flag++;

if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
  else security_hole(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "exim / exim-debuginfo / exim-debugsource / eximon / etc");
}

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Fedora Security Advisory 2012-17085.
#

include("compat.inc");

if (description)
{
  script_id(62769);
  script_version("1.10");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/12");

  script_cve_id("CVE-2012-5671");
  script_bugtraq_id(56285);
  script_xref(name:"FEDORA", value:"2012-17085");

  script_name(english:"Fedora 16 : exim-4.76-4.fc16.2 (2012-17085)");
  script_summary(english:"Checks rpm output for the updated package.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Fedora host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"This update protect DKIM DNS decoding from remote exploit,
CVE-2012-5671.

Note that Tenable Network Security has extracted the preceding
description block directly from the Fedora security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.redhat.com/show_bug.cgi?id=870347"
  );
  # https://lists.fedoraproject.org/pipermail/package-announce/2012-October/090963.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?dc41ff6c"
  );
  script_set_attribute(attribute:"solution", value:"Update the affected exim package.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:ND/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:exim");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:16");

  script_set_attribute(attribute:"patch_publication_date", value:"2012/10/28");
  script_set_attribute(attribute:"plugin_publication_date", value:"2012/10/31");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2012-2020 Tenable Network Security, Inc.");
  script_family(english:"Fedora Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
os_ver = os_ver[1];
if (! ereg(pattern:"^16([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 16.x", "Fedora " + os_ver);

if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);

flag = 0;
if (rpm_check(release:"FC16", reference:"exim-4.76-4.fc16.2")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "exim");
}

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Gentoo Linux Security Advisory GLSA 201401-32.
#
# The advisory text is Copyright (C) 2001-2015 Gentoo Foundation, Inc.
# and licensed under the Creative Commons - Attribution / Share Alike 
# license. See http://creativecommons.org/licenses/by-sa/3.0/
#

include("compat.inc");

if (description)
{
  script_id(72159);
  script_version("1.7");
  script_cvs_date("Date: 2018/07/12 19:01:15");

  script_cve_id("CVE-2010-2023", "CVE-2010-2024", "CVE-2010-4344", "CVE-2010-4345", "CVE-2011-0017", "CVE-2011-1407", "CVE-2011-1764", "CVE-2012-5671");
  script_bugtraq_id(40451, 40454, 45308, 45341, 46065, 47736, 47836, 56285);
  script_xref(name:"GLSA", value:"201401-32");

  script_name(english:"GLSA-201401-32 : Exim: Multiple vulnerabilities");
  script_summary(english:"Checks for updated package(s) in /var/db/pkg");

  script_set_attribute(
    attribute:"synopsis", 
    value:
"The remote Gentoo host is missing one or more security-related
patches."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"The remote host is affected by the vulnerability described in GLSA-201401-32
(Exim: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Exim. Please review the
      CVE identifiers referenced below for details.
  
Impact :

    A remote attacker could possibly execute arbitrary code with root
      privileges, or cause a Denial of Service condition.
  
Workaround :

    There is no known workaround at this time."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security.gentoo.org/glsa/201401-32"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"All Exim users should upgrade to the latest version:
      # emerge --sync
      # emerge --ask --oneshot --verbose '>=mail-mta/exim-4.80.1'"
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploit_framework_core", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'Exim4 string_format Function Heap Buffer Overflow');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
  script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
  script_set_attribute(attribute:"canvas_package", value:'CANVAS');

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:exim");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux");

  script_set_attribute(attribute:"patch_publication_date", value:"2014/01/27");
  script_set_attribute(attribute:"plugin_publication_date", value:"2014/01/28");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2014-2018 Tenable Network Security, Inc.");
  script_family(english:"Gentoo Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("qpkg.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo");
if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;

if (qpkg_check(package:"mail-mta/exim", unaffected:make_list("ge 4.80.1"), vulnerable:make_list("lt 4.80.1"))) flag++;

if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());
  else security_hole(0);
  exit(0);
}
else
{
  tested = qpkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "Exim");
}

#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Fedora Security Advisory 2012-16899.
#

include("compat.inc");

if (description)
{
  script_id(62865);
  script_version("1.6");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/12");

  script_cve_id("CVE-2012-5671");
  script_xref(name:"FEDORA", value:"2012-16899");

  script_name(english:"Fedora 18 : exim-4.80.1-1.fc18 (2012-16899)");
  script_summary(english:"Checks rpm output for the updated package.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Fedora host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"This update protect DKIM DNS decoding from remote exploit,
CVE-2012-5671.

Note that Tenable Network Security has extracted the preceding
description block directly from the Fedora security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.redhat.com/show_bug.cgi?id=870347"
  );
  # https://lists.fedoraproject.org/pipermail/package-announce/2012-November/091664.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?398e9bec"
  );
  script_set_attribute(attribute:"solution", value:"Update the affected exim package.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:exim");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:18");

  script_set_attribute(attribute:"patch_publication_date", value:"2012/10/26");
  script_set_attribute(attribute:"plugin_publication_date", value:"2012/11/09");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2012-2020 Tenable Network Security, Inc.");
  script_family(english:"Fedora Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
os_ver = os_ver[1];
if (! ereg(pattern:"^18([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 18.x", "Fedora " + os_ver);

if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);

flag = 0;
if (rpm_check(release:"FC18", reference:"exim-4.80.1-1.fc18")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "exim");
}

#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(73621);
  script_version("1.5");
  script_cvs_date("Date: 2019/11/26");

  script_cve_id("CVE-2012-5671");
  script_bugtraq_id(56285);

  script_name(english:"Atmail Webmail < 6.6.2 Exim Buffer Overflow");
  script_summary(english:"Checks Atmail version number");

  script_set_attribute(attribute:"synopsis", value:
"The remote web server contains an application that is affected by a
buffer overflow vulnerability.");
  script_set_attribute(attribute:"description", value:
"According to its version, the Atmail Webmail install on the remote
host is a version prior to 6.6.2. It is, therefore, potentially
affected by an error in the included Exim component related to the
'dkim_exim_query_dns_txt' function and DNS record parsing that could
allow a buffer overflow and possibly arbitrary code execution.");
  script_set_attribute(attribute:"see_also", value:"https://help.atmail.com/hc/en-us/categories/200214454-Changelog");
  script_set_attribute(attribute:"see_also", value:"https://lists.exim.org/lurker/message/20121026.080330.74b9147b.en.html");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Atmail Webmail 6.6.2 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2012/10/26");
  script_set_attribute(attribute:"patch_publication_date", value:"2012/11/15");
  script_set_attribute(attribute:"plugin_publication_date", value:"2014/04/18");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:atmail:atmail");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("atmail_webmail_detect.nasl");
  script_require_keys("www/atmail_webmail");

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("http.inc");
include("webapp_func.inc");

port = get_http_port(default:80, php:TRUE);
install = get_install_from_kb(appname:'atmail_webmail', port:port, exit_on_fail:TRUE);

dir = install['dir'];
display_version = install['ver'];
# Get normalized version for check
kb_dir = str_replace(string:dir, find:"/", replace:"\");
version = get_kb_item_or_exit('www/'+port+'/atmail_webmail_normalized_ver/'+kb_dir+'/'+display_version);
install_url = build_url(port:port, qs:dir);

if (version == UNKNOWN_VER || isnull(version))
  audit(AUDIT_UNKNOWN_WEB_APP_VER, "Atmail Webmail", install_url);

if (version !~ "^6\.")
  audit(AUDIT_WEB_APP_NOT_INST, "Atmail Webmail 6.x", port);

if (ver_compare(ver:version, fix:'6.6.2', strict:FALSE) == -1)
{
  if (report_verbosity > 0)
  {
    report =
      '\n  URL               : ' + install_url +
      '\n  Installed version : ' + version + ' ('+display_version+')' +
      '\n  Fixed version     : 6.6.2\n';
    security_warning(port:port, extra:report);
  }
  else security_warning(port);
  exit(0);
}
else audit(AUDIT_WEB_APP_NOT_AFFECTED, "Atmail Webmail", install_url, version);

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Ubuntu Security Notice USN-1618-1. The text 
# itself is copyright (C) Canonical, Inc. See 
# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered 
# trademark of Canonical, Inc.
#

include("compat.inc");

if (description)
{
  script_id(62708);
  script_version("1.9");
  script_cvs_date("Date: 2019/09/19 12:54:28");

  script_cve_id("CVE-2012-5671");
  script_xref(name:"USN", value:"1618-1");

  script_name(english:"Ubuntu 10.04 LTS / 11.04 / 11.10 / 12.04 LTS / 12.10 : exim4 vulnerability (USN-1618-1)");
  script_summary(english:"Checks dpkg output for updated packages.");

  script_set_attribute(
    attribute:"synopsis", 
    value:
"The remote Ubuntu host is missing one or more security-related
patches."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"It was discovered that Exim incorrectly handled DKIM DNS decoding.
This flaw could allow a remote attacker to execute arbitrary code.

Note that Tenable Network Security has extracted the preceding
description block directly from the Ubuntu security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://usn.ubuntu.com/1618-1/"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"Update the affected exim4-daemon-custom, exim4-daemon-heavy and / or
exim4-daemon-light packages."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:exim4-daemon-custom");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:exim4-daemon-heavy");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:exim4-daemon-light");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:10.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:11.04");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:11.10");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:12.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:12.10");

  script_set_attribute(attribute:"vuln_publication_date", value:"2012/10/31");
  script_set_attribute(attribute:"patch_publication_date", value:"2012/10/26");
  script_set_attribute(attribute:"plugin_publication_date", value:"2012/10/26");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"Ubuntu Security Notice (C) 2012-2019 Canonical, Inc. / NASL script (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Ubuntu Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l");

  exit(0);
}


include("audit.inc");
include("ubuntu.inc");
include("misc_func.inc");

if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/Ubuntu/release");
if ( isnull(release) ) audit(AUDIT_OS_NOT, "Ubuntu");
release = chomp(release);
if (! preg(pattern:"^(10\.04|11\.04|11\.10|12\.04|12\.10)$", string:release)) audit(AUDIT_OS_NOT, "Ubuntu 10.04 / 11.04 / 11.10 / 12.04 / 12.10", "Ubuntu " + release);
if ( ! get_kb_item("Host/Debian/dpkg-l") ) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Ubuntu", cpu);

flag = 0;

if (ubuntu_check(osver:"10.04", pkgname:"exim4-daemon-custom", pkgver:"4.71-3ubuntu1.4")) flag++;
if (ubuntu_check(osver:"10.04", pkgname:"exim4-daemon-heavy", pkgver:"4.71-3ubuntu1.4")) flag++;
if (ubuntu_check(osver:"10.04", pkgname:"exim4-daemon-light", pkgver:"4.71-3ubuntu1.4")) flag++;
if (ubuntu_check(osver:"11.04", pkgname:"exim4-daemon-custom", pkgver:"4.74-1ubuntu1.3")) flag++;
if (ubuntu_check(osver:"11.04", pkgname:"exim4-daemon-heavy", pkgver:"4.74-1ubuntu1.3")) flag++;
if (ubuntu_check(osver:"11.04", pkgname:"exim4-daemon-light", pkgver:"4.74-1ubuntu1.3")) flag++;
if (ubuntu_check(osver:"11.10", pkgname:"exim4-daemon-custom", pkgver:"4.76-2ubuntu1.1")) flag++;
if (ubuntu_check(osver:"11.10", pkgname:"exim4-daemon-heavy", pkgver:"4.76-2ubuntu1.1")) flag++;
if (ubuntu_check(osver:"11.10", pkgname:"exim4-daemon-light", pkgver:"4.76-2ubuntu1.1")) flag++;
if (ubuntu_check(osver:"12.04", pkgname:"exim4-daemon-custom", pkgver:"4.76-3ubuntu3.1")) flag++;
if (ubuntu_check(osver:"12.04", pkgname:"exim4-daemon-heavy", pkgver:"4.76-3ubuntu3.1")) flag++;
if (ubuntu_check(osver:"12.04", pkgname:"exim4-daemon-light", pkgver:"4.76-3ubuntu3.1")) flag++;
if (ubuntu_check(osver:"12.10", pkgname:"exim4-daemon-custom", pkgver:"4.80-3ubuntu1.1")) flag++;
if (ubuntu_check(osver:"12.10", pkgname:"exim4-daemon-heavy", pkgver:"4.80-3ubuntu1.1")) flag++;
if (ubuntu_check(osver:"12.10", pkgname:"exim4-daemon-light", pkgver:"4.80-3ubuntu1.1")) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_WARNING,
    extra      : ubuntu_report_get()
  );
  exit(0);
}
else
{
  tested = ubuntu_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "exim4-daemon-custom / exim4-daemon-heavy / exim4-daemon-light");
}