-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2012.1030
                           exim4 security update
                              29 October 2012

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           exim4
Publisher:         Debian
Operating System:  Debian GNU/Linux 6
                   UNIX variants (UNIX, Linux, OSX)
Impact/Access:     Execute Arbitrary Code/Commands -- Remote/Unauthenticated
Resolution:        Patch/Upgrade
CVE Names:         CVE-2012-5671  

Original Bulletin: 
   http://www.debian.org/security/2012/dsa-2566

Comment: This advisory references vulnerabilities in products which run on 
         platforms other than Debian. It is recommended that administrators 
         running exim4 check for an updated version of the software for their
         operating system.

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- - -------------------------------------------------------------------------
Debian Security Advisory DSA-2566-1                   security@debian.org
http://www.debian.org/security/                                Nico Golde
October 25, 2012                       http://www.debian.org/security/faq
- - -------------------------------------------------------------------------

Package        : exim4
Vulnerability  : heap-based buffer overflow
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2012-5671

It was discovered that Exim, a mail transport agent, is not properly
handling the decoding of DNS records for DKIM.  Specifically, crafted
records can yield to a heap-based buffer overflow.  An attacker can
exploit this flaw to execute arbitrary code.

For the stable distribution (squeeze), this problem has been fixed in
version 4.72-6+squeeze3.

For the testing distribution (wheezy), this problem has been fixed in
version 4.80-5.1.

For the unstable distribution (sid), this problem has been fixed in
version 4.80-5.1.


We recommend that you upgrade your exim4 packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org

- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlCKYrgACgkQHYflSXNkfP+/nwCeIN7ZAsHG/zXm3DpBcI/5rrhY
8hsAn3F0AzTH5wLvICpTM6InEny5vuCy
=T8xi
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBUI3dtO4yVqjM2NGpAQKPNhAAg1o3YHdezO4tpk6dq8+NiMP6pSHEKh1E
VT7rKPloLHEMqGVUXgzPyS06orHQh2KQZ/UsYbYTGEMmitFKoufe/dBMxHhcEPES
r1Ps0Vl+L4TCM+Lj+NUzgVUiw9ZwiKe9XtBXcmEy+2KV2yWRemx5JRUgGLoiYh2S
U70nvpE72PARKyaazFWJeytgZuhE+HMaxb+hpa0yQXGmp4HJlYdasvWH2UuR43Ww
KF9CDBuC+Ecjm9MPj5c+OO59LAJJqrNB97WX/k6IQFQYtfefb8Da0XNi/Z8tnoNz
Y3ChT+stmMV87wnOKeMTJ0YxUs8nJ3pXmebVr0eBOGpJdf9pminAQtuNtTpCBRBP
XDigSd4r7hL8BgAv7Z60k2ZYXytVmyj0RcZahBsiWkg4A1eZbAI++6TQH6v+KDwq
yn3lscfED2++4YylvLP7XPAxbTa1nt+JVtYIkPfoPoALzInh37DndojaHCenzal4
ShRVRUZ7/0wtT+WVOObIa4VU1jtjwQ2hcv71pSVLE9c3iL8q6p6MumU4JO6stv8j
AUbbb0pBePjUvqSvsqr2rAd82x5RYcAoENGVFC6nmeXwnE8MnhG5OZth1OcTDSto
+mZY/hhmLvIHDf3yNYxbxSCPmCsJYi29IR+QUoy649tWnFe8q6aVv6IqqSGga74E
T0ebM/Up/yk=
=0AcK
-----END PGP SIGNATURE-----