Vulnerabilities > CVE-2020-12783 - Out-of-bounds Read vulnerability in multiple products

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
NONE
Availability impact
NONE
network
low complexity
exim
fedoraproject
debian
canonical
CWE-125
nessus
NVD
Published: 2020-05-11
Updated: 2023-11-07

Summary

Exim through 4.93 has an out-of-bounds read in the SPA authenticator that could result in SPA/NTLM authentication bypass in auths/spa.c and auths/auth-spa.c.

Vulnerable Configurations

Part Description Count
Application
Exim
140
OS
Fedoraproject
2
OS
Debian
3
OS
Canonical
5

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Overread Buffers
    An adversary attacks a target by providing input that causes an application to read beyond the boundary of a defined buffer. This typically occurs when a value influencing where to start or stop reading is set to reflect positions outside of the valid memory location of the buffer. This type of attack may result in exposure of sensitive information, a system crash, or arbitrary code execution.

Nessus

  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2020-93D7305D71.NASL
    descriptionThis is an update fixing out-of-bounds read in the SPA authenticator. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-05-31
    modified2020-05-26
    plugin id136842
    published2020-05-26
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/136842
    titleFedora 31 : exim (2020-93d7305d71)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-2213.NASL
    descriptionIt was discovered that exim4, a mail transport agent, suffers from a authentication bypass vulnerability in the spa authentication driver. The spa authentication driver is not enabled by default. For Debian 8
    last seen2020-05-31
    modified2020-05-19
    plugin id136702
    published2020-05-19
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/136702
    titleDebian DLA-2213-1 : exim4 security update
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-4687.NASL
    descriptionIt was discovered that exim4, a mail transport agent, suffers from a authentication bypass vulnerability in the spa authentication driver. The spa authentication driver is not enabled by default.
    last seen2020-05-22
    modified2020-05-18
    plugin id136676
    published2020-05-18
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/136676
    titleDebian DSA-4687-1 : exim4 - security update
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-4366-1.NASL
    descriptionIt was discovered that Exim incorrectly handled certain inputs. An remote attacker could possibly use this issue to access sensitive information or authentication bypass. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-05-31
    modified2020-05-20
    plugin id136731
    published2020-05-20
    reporterUbuntu Security Notice (C) 2020 Canonical, Inc. / NASL script (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/136731
    titleUbuntu 16.04 LTS / 18.04 LTS / 19.10 / 20.04 : exim4 vulnerability (USN-4366-1)

References