CVE-2014-2957

CVSS V2 Medium 6.8 CVSS V3 None
Description
The dmarc_process function in dmarc.c in Exim before 4.82.1, when EXPERIMENTAL_DMARC is enabled, allows remote attackers to execute arbitrary code via the From header in an email, which is passed to the expand_string function.
Overview
  • CVE ID
  • CVE-2014-2957
  • Assigner
  • cret@cert.org
  • Vulnerability Status
  • Modified
  • Published Version
  • 2014-09-04T17:55:05
  • Last Modified Date
  • 2021-05-04T18:15:08
Weakness Enumerations
CWE URL
CWE-20 http://cwe.mitre.org/data/definitions/20.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:exim:exim:*:*:*:*:*:*:*:* 1 OR 4.82
cpe:2.3:a:exim:exim:4.00:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:exim:exim:4.01:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:exim:exim:4.02:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:exim:exim:4.03:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:exim:exim:4.04:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:exim:exim:4.05:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:exim:exim:4.10:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:exim:exim:4.11:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:exim:exim:4.12:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:exim:exim:4.14:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:exim:exim:4.20:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:exim:exim:4.21:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:exim:exim:4.22:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:exim:exim:4.23:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:exim:exim:4.24:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:exim:exim:4.30:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:exim:exim:4.31:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:exim:exim:4.32:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:exim:exim:4.33:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:exim:exim:4.34:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:exim:exim:4.40:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:exim:exim:4.41:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:exim:exim:4.42:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:exim:exim:4.43:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:exim:exim:4.44:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:exim:exim:4.50:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:exim:exim:4.51:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:exim:exim:4.52:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:exim:exim:4.53:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:exim:exim:4.54:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:exim:exim:4.60:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:exim:exim:4.61:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:exim:exim:4.62:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:exim:exim:4.63:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:exim:exim:4.64:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:exim:exim:4.65:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:exim:exim:4.66:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:exim:exim:4.67:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:exim:exim:4.68:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:exim:exim:4.69:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:exim:exim:4.70:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:exim:exim:4.71:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:exim:exim:4.72:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:exim:exim:4.73:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:exim:exim:4.74:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:exim:exim:4.75:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:exim:exim:4.76:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:exim:exim:4.77:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:exim:exim:4.80:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:exim:exim:4.80.1:*:*:*:*:*:*:* 1 OR
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:N/AC:M/Au:N/C:P/I:P/A:P
  • Access Vector
  • NETWORK
  • Access Compatibility
  • MEDIUM
  • Authentication
  • NONE
  • Confidentiality Impact
  • PARTIAL
  • Integrity Impact
  • PARTIAL
  • Availability Impact
  • PARTIAL
  • Base Score
  • 6.8
  • Severity
  • MEDIUM
  • Exploitability Score
  • 8.6
  • Impact Score
  • 6.4
References
Reference URL Reference Tags
https://lists.exim.org/lurker/message/20140528.122536.a31d60a4.en.html Patch Vendor Advisory
http://git.exim.org/exim.git/commitdiff/5b7a7c051c9ab9ee7c924a611f90ef2be03e0ad0
http://www.openwall.com/lists/oss-security/2021/05/04/7
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2014-2957
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2957
History
Created Old Value New Value Data Type Notes
2022-05-10 16:17:38 Added to TrackCVE
2022-12-02 00:27:16 cert@cert.org cret@cert.org CVE Assigner updated
2022-12-02 00:27:16 2014-09-04T17:55Z 2014-09-04T17:55:05 CVE Published Date updated
2022-12-02 00:27:16 2021-05-04T18:15:08 CVE Modified Date updated
2022-12-02 00:27:16 Modified Vulnerability Status updated