Shulou(Shulou.com)06/01 Report--

This article shows you how to carry out CVE-2018-6789Exim buffer overflow vulnerability analysis, the content is concise and easy to understand, can definitely make your eyes bright, through the detailed introduction of this article, I hope you can get something.

0x00 vulnerability background on February 5, 2018, Meh, a security researcher on the DEVCORE team, disclosed to the exim-security mail group that there was a buffer overflow vulnerability in Exim, numbered CVE-2018-6789, which affected all versions of Exim 4.90.1 and could cause remote code execution.

According to the 360CERT network-wide asset retrieval platform, as of March 7, 2018, the search results show that there are more than 1 million servers running Exim in the world, which has a wide range of influence and serious harm.

The global impact distribution is as follows:

0x01 vulnerability affects all versions below Exim 4.90.1

The 0x02 vulnerability analysis vulnerability occurs in the b64decode function of / src/base64.c:

According to the code, exim allocates 3 * (len/4) + 1 byte of space to store base64 decrypted data. If the length of encrypted data passed in len = 4n+3, the space allocated by exim is 3n+1. However, according to the principle of base64 encryption, encrypted data of 4n+3 length will be decrypted into data of 3n+2 length. At this point, a buffer overflow occurs, overflowing one byte of data.

Base64 decryption is very common in data transmission, so the vulnerability is easy to trigger, and Meh has published the idea of remote code execution attacks, and does not rule out the possibility that this vulnerability will be widely exploited.

0x03 patch analysis

The patch actually allocates an extra byte of space to store the decrypted data to avoid overflow.

0x04 hotfix recommendation 360CERT advises relevant users to download the official fix in time, or update to version 4.90.1.

The above content is how to analyze CVE-2018-6789Exim buffer overflow vulnerabilities. Have you learned any knowledge or skills? If you want to learn more skills or enrich your knowledge reserve, you are welcome to follow the industry information channel.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.