Critical Exim Security Vulnerability: disable chunking

--===============0243508458==
Content-Type: multipart/signed; micalg=pgp-sha256;
	protocol="application/pgp-signature"; boundary="vkogqOf2sHV7VnPd"
Content-Disposition: inline


--vkogqOf2sHV7VnPd
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

Folks,

A remote code execution vulnerability has been reported in Exim, with
immediate public disclosure (we were given no private notice).
A tentative patch exists but has not yet been confirmed.

With immediate effect, please apply this workaround: if you are running
Exim 4.88 or newer (4.89 is current, 4.90 is upcoming) then in the main
section of your Exim configuration, set:

  chunking_advertise_hosts =

That's an empty value, nothing on the right of the equals.  This
disables advertising the ESMTP CHUNKING extension, making the BDAT verb
unavailable and avoids letting an attacker apply the logic.

This should be a complete workaround.  Impact of applying the workaround
is that mail senders have to stick to the traditional DATA verb instead
of using BDAT.

We've requested CVEs.  More news will be forthcoming as we get this
worked out.

-Phil

--vkogqOf2sHV7VnPd
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----

iHUEARYIAB0WIQROXBeef/xNv45sEy9REE5mjdBEgQUCWhjoDQAKCRBREE5mjdBE
gdy5AP9etRVLVIGLzwWNXdb/S4SdnznnGye1LqKEzx/J09mZOAEA/TMxe1JVePJk
ROsx4YJ3ut2AZ0NOZNWJ95oinAotIA6JAjMEAQEIAB0WIQTGk6A04e1u6VTK4toT
2tmcfkFRnAUCWhjoFwAKCRAT2tmcfkFRnAFDD/9o7/j04Muce/csVVTxUdx8tBOd
DOYtlctrUYuPYL9c982naLfEsykTZsLYm8Xb21ctQGHovWH8K4ZTom0qwwTek2tB
AIFaN8l1aJ7PjP7fstPv/+dV5xRlikI/NXhaBpu47DipaoMGvYCHL/m6Zeib04Dv
m4Tmn42it0BJl8UzjjYiQmRKeCIg23++VBrxTFgFOSXOZLZXDw48wPRpaCEZ/ocv
g7xz1GeK9nZd2duVVcJWUofVQhxT4w9cdLOUp+aR2XKHUifHbYgwFTuixuSypti0
aO9PO9H7kG5mYCSqmE3xl9hdz+ab64VY9yT1NeGV9jI01AG1xlOcEPBT31c5nU/v
0ZKe7ZaoR8EvJS/G2n7nPZv0sI7OJnyFcud28J2DMSLwg6wio28/NE2GSI7/HRZ1
Uc406baPyvg866EscCKS4yEAj4W0wdGrMTxUrjNVZX+6la5/WNCJ2oCzCLKL4ujz
zWXMXqohh+iYHq8nIDy79CZX21jlbTZgv6gTuhPByw8nrW0mM+N4pQ5oeKsMegBQ
NrtGBZtcogg0vK5OGJHQiYu/H5VOnWG6ibpcbIYMJDuYkgf2FWiztDTeq1mDWA3d
P214xOJPaBSSAkOo+3ZgzOS5murwjZroZA/Xn9izixV8XP2YWg3Mcx1AXGTi1Mnj
fG3LvEN1LwhGe3speA==
=w0+V
-----END PGP SIGNATURE-----

--vkogqOf2sHV7VnPd--


--===============0243508458==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

-- 
## List details at https://lists.exim.org/mailman/listinfo/exim-announce Exim details at http://www.exim.org/ ##

--===============0243508458==--