Re: [exim] CVE-2017-16943, CVE-2017-16944

--===============1351629631==
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="z7774dl7jvavltdl"
Content-Disposition: inline


--z7774dl7jvavltdl
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Randy Bush <[email protected]> (Di 28 Nov 2017 23:34:55 CET):
> > Distros are advised to include these commits.
>=20
> deb/ubu distros are so far behind that they do not have the vuln

That isn't true. The current stable Debian (9.x) ships with
Exim 4.89. And from (including) 4.88 onwards Exim is vulnerable.

Though, the Debian Distro changed to built-in default of the chunking
extension to 'disabled'. One need to switch it on explictly in the
runtime config to be vulnerable.

Please correct me, if I'm wrong.

    Best regards from Dresden/Germany
    Viele Gr=C3=BC=C3=9Fe aus Dresden
    Heiko Schlittermann
--=20
 SCHLITTERMANN.de ---------------------------- internet & unix support -
 Heiko Schlittermann, Dipl.-Ing. (TU) - {fon,fax}: +49.351.802998{1,3} -
 gnupg encrypted messages are welcome --------------- key ID: F69376CE -
 ! key id 7CBF764A and 972EAC9F are revoked since 2015-01 ------------ -

--z7774dl7jvavltdl
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQEzBAABCgAdFiEE0L/WueylaUpvFJ3Or0zGdqa2wUIFAlod6VYACgkQr0zGdqa2
wULkXwf9GlAUT+dpJtyR4B8L7F/VpYcJK8HE+xGVIDpDsJTFmir4yREeb+xnCZb2
bnmYpEogCf7AEDBlRVwbcs8b7xDt9Q0y7cCl5gzs3MCshmLnBl80fDvNjdk13ZIb
+LygP9YiyF5iELxVDITu0wNUnX1GFjE53rt91/jyQfPBTXuYf3fYn0nTIpxW5YRA
Q83l4D3lJDKu7taWREncfCJtOMpmOJ7lNgh0vQdPjvnHEYWlYBVzrZnLA1FdKk56
R8roVpu4G+FrVbGkcn5UMULZw9wNbGwaRhU6nkzTKgD5IIfKLhT/x14oQuDqKwBB
7KaM37/MugWV+2ZkKn9KiZGJ6SwJPg==
=CHI5
-----END PGP SIGNATURE-----

--z7774dl7jvavltdl--


--===============1351629631==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

-- 
## List details at https://lists.exim.org/mailman/listinfo/exim-announce Exim details at http://www.exim.org/ ##

--===============1351629631==--