Re: CVE-2019-15846: Exim - local or remote attacker can execute programs with root privileges.

Heiko Schlittermann via Exim-announce <[email protected]> Fri, 6 Sep 2019 12:44:30 +0200

Newsgroups	gmane.mail.exim.announce
Organization	schlittermann -- internet & unix support
Message-ID	<20190906104430.GA3837__5459.25550847954$1567768938$gmane$org@jumper.schlittermann.de>

--===============0934706008==
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="qZLIv6EoKi7YuaSc"
Content-Disposition: inline


--qZLIv6EoKi7YuaSc
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Heiko Schlittermann <[email protected]> (Fr 06 Sep 2019 12:20:39 CE=
ST):
> Mitigation
> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
>
> Do not offer TLS for incomming connections (tls_advertise_hosts).
> This mitigation is *not* recommended!

This should block the most popular attack vector:

In your MAIL ACL:

    deny    condition =3D ${if eq{\\}{${substr{-1}{1}{$tls_in_sni}}}}
            message =3D sorry


    Best regards from Dresden/Germany
    Viele Gr=C3=BC=C3=9Fe aus Dresden
    Heiko Schlittermann
--
 SCHLITTERMANN.de ---------------------------- internet & unix support -
 Heiko Schlittermann, Dipl.-Ing. (TU) - {fon,fax}: +49.351.802998{1,3} -
 gnupg encrypted messages are welcome --------------- key ID: F69376CE -
 ! key id 7CBF764A and 972EAC9F are revoked since 2015-01 ------------ -

--qZLIv6EoKi7YuaSc
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQEzBAABCgAdFiEE0L/WueylaUpvFJ3Or0zGdqa2wUIFAl1yOI4ACgkQr0zGdqa2
wULT9AgAi4Tik4cZ0O+yz6oHNpKh5/a82Xk2sIlZp73riuaxcazDwHWKuyAmSJC4
UH0OPSHJRD/P+8A3bZOVyqyrWmDQ0KUVRecKLdzTa3S6ugw1Xe26voNDjjMg4u0g
b9b8kNopaa+xF7jysckqi8924KzfK63Po029lI/4n4ppV3RyYd2hkrj0TzOCL+Xl
P7ELvJIAio0+HyWAjiMhcHHptwHuKwnx+VoJ6x0pVaZiGvhDnjdjNxURu7Ss4KbJ
oiLWyhcruvuWzp0etHeyJVTP8yqbyBUNczucV/k37IyCSmD+/6TKRlQn36mJapeB
5fDTbLCJHvO0KILIgTqRJcIUI7ALnw==
=3BA0
-----END PGP SIGNATURE-----

--qZLIv6EoKi7YuaSc--


--===============0934706008==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

-- 
## List details at https://lists.exim.org/mailman/listinfo/exim-announce Exim details at http://www.exim.org/ ##

--===============0934706008==--