Exim DMARC dmarc.c dmarc_dns_lookup desbordamiento de búfer

Una vulnerabilidad fue encontrada en Exim y clasificada como problemática. La función dmarc_dns_lookup del archivo dmarc.c del componente DMARC Handler es afectada por esta vulnerabilidad. Por la manipulación de un input desconocido se causa una vulnerabilidad de clase desbordamiento de búfer. El advisory puede ser descargado de git.exim.org. La vulnerabilidad es identificada como CVE-2022-3620. El ataque se puede efectuar a través de la red. Los detalles técnicos son conocidos. Fue declarado como no está definido. El parche puede ser descargado de git.exim.org. El mejor modo sugerido para mitigar el problema es aplicar el parche al componente. Una solución posible ha sido publicada antes y no simplemente después de la publicación de la vulnerabilidad.

Campo2022-10-20 21:532022-11-18 18:472022-11-18 18:54
nameEximEximExim
componentDMARC HandlerDMARC HandlerDMARC Handler
filedmarc.cdmarc.cdmarc.c
functiondmarc_dns_lookupdmarc_dns_lookupdmarc_dns_lookup
cwe416 (desbordamiento de búfer)416 (desbordamiento de búfer)416 (desbordamiento de búfer)
risk111
cvss3_vuldb_avNNN
cvss3_vuldb_acHHH
cvss3_vuldb_prNNN
cvss3_vuldb_uiNNN
cvss3_vuldb_sUUU
cvss3_vuldb_cLLL
cvss3_vuldb_iLLL
cvss3_vuldb_aLLL
cvss3_vuldb_rlOOO
cvss3_vuldb_rcCCC
identifier12fb3842f81bcbd4a4519d5728f2d7e0e3ca144512fb3842f81bcbd4a4519d5728f2d7e0e3ca144512fb3842f81bcbd4a4519d5728f2d7e0e3ca1445
urlhttps://git.exim.org/exim.git/commit/12fb3842f81bcbd4a4519d5728f2d7e0e3ca1445https://git.exim.org/exim.git/commit/12fb3842f81bcbd4a4519d5728f2d7e0e3ca1445https://git.exim.org/exim.git/commit/12fb3842f81bcbd4a4519d5728f2d7e0e3ca1445
nameParcheParcheParche
patch_name12fb3842f81bcbd4a4519d5728f2d7e0e3ca144512fb3842f81bcbd4a4519d5728f2d7e0e3ca144512fb3842f81bcbd4a4519d5728f2d7e0e3ca1445
patch_urlhttps://git.exim.org/exim.git/commit/12fb3842f81bcbd4a4519d5728f2d7e0e3ca1445https://git.exim.org/exim.git/commit/12fb3842f81bcbd4a4519d5728f2d7e0e3ca1445https://git.exim.org/exim.git/commit/12fb3842f81bcbd4a4519d5728f2d7e0e3ca1445
cveCVE-2022-3620CVE-2022-3620CVE-2022-3620
responsibleVulDBVulDBVulDB
date1666216800 (2022-10-20)1666216800 (2022-10-20)1666216800 (2022-10-20)
typeMail Server SoftwareMail Server SoftwareMail Server Software
cvss2_vuldb_avNNN
cvss2_vuldb_acHHH
cvss2_vuldb_auNNN
cvss2_vuldb_ciPPP
cvss2_vuldb_iiPPP
cvss2_vuldb_aiPPP
cvss2_vuldb_rcCCC
cvss2_vuldb_rlOFOFOF
cvss2_vuldb_eNDNDND
cvss3_vuldb_eXXX
cvss2_vuldb_basescore5.15.15.1
cvss2_vuldb_tempscore4.44.44.4
cvss3_vuldb_basescore5.65.65.6
cvss3_vuldb_tempscore5.45.45.4
cvss3_meta_basescore5.65.67.0
cvss3_meta_tempscore5.45.46.9
price_0day$0-$5k$0-$5k$0-$5k
cve_assigned1666216800 (2022-10-20)1666216800 (2022-10-20)
cve_nvd_summaryA vulnerability was found in Exim and classified as problematic. This issue affects the function dmarc_dns_lookup of the file dmarc.c of the component DMARC Handler. The manipulation leads to use after free. The attack may be initiated remotely. The name of the patch is 12fb3842f81bcbd4a4519d5728f2d7e0e3ca1445. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211919.A vulnerability was found in Exim and classified as problematic. This issue affects the function dmarc_dns_lookup of the file dmarc.c of the component DMARC Handler. The manipulation leads to use after free. The attack may be initiated remotely. The name of the patch is 12fb3842f81bcbd4a4519d5728f2d7e0e3ca1445. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211919.
cvss3_nvd_avN
cvss3_nvd_acL
cvss3_nvd_prN
cvss3_nvd_uiN
cvss3_nvd_sU
cvss3_nvd_cH
cvss3_nvd_iH
cvss3_nvd_aH
cvss3_cna_avN
cvss3_cna_acH
cvss3_cna_prN
cvss3_cna_uiN
cvss3_cna_sU
cvss3_cna_cL
cvss3_cna_iL
cvss3_cna_aL
cve_cnaVulDB
cvss3_nvd_basescore9.8
cvss3_cna_basescore5.6

Want to stay up to date on a daily basis?

Enable the mail alert feature now!