Entreprise française de cybersécurité depuis 2004
☎ 03 60 47 09 81 - info@securiteinfo.com

CVE-2010-4344

Description

Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session that includes two MAIL commands in conjunction with a large message containing crafted headers, leading to improper rejection logging.

POC

Reference

- http://www.openwall.com/lists/oss-security/2021/05/04/7

- http://www.theregister.co.uk/2010/12/11/exim_code_execution_peril/

Github

- https://github.com/ARPSyndicate/cve-scores

- https://github.com/AleksandrMihajlov/SDB-13-01

- https://github.com/Farrhouq/Inpt-report

- https://github.com/Ostorlab/KEV

- https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors

- https://github.com/byte-mug/cumes

- https://github.com/neo-13th/HW13.1

- https://github.com/oneplus-x/jok3r

- https://github.com/sbeteta42/enum_scan