oss-sec mailing list archives
Re: [CVE-2020-28018] Use-After-Free on Exim Question
From: Qualys Security Advisory <qsa () qualys com>
Date: Tue, 11 May 2021 20:55:17 +0000
Hi, On Tue, May 11, 2021 at 01:23:43PM +0200, null p0int3r wrote:
So I suppose that command is the first you send after the second "STARTTLS" command being sent right?
Yes! After the second STARTTLS we send an invalid MAIL FROM command (for example, "MAIL FROM:(\"${run{...}}\")\n"). Exim then responds with a 501 error message that includes our "${run{...}}" string, and since corked in tls_write() is still non-NULL, this string is written to where the used-after-free corked points to. Hopefully this helps!
PD: Congrats for those nice bugs discovered.
Thank you very much for your mail! With best regards, -- the Qualys Security Advisory team [https://d1dejaj6dcqv24.cloudfront.net/asset/image/email-banner-384-2x.png]<https://www.qualys.com/email-banner> This message may contain confidential and privileged information. If it has been sent to you in error, please reply to advise the sender of the error and then immediately delete it. If you are not the intended recipient, do not read, copy, disclose or otherwise use this message. The sender disclaims any liability for such unauthorized use. NOTE that all incoming emails sent to Qualys email accounts will be archived and may be scanned by us and/or by external service providers to detect and prevent threats to our systems, investigate illegal or inappropriate behavior, and/or eliminate unsolicited promotional emails (“spam”). If you have any concerns about this process, please contact us.
Current thread:
- [CVE-2020-28018] Use-After-Free on Exim Question null p0int3r (May 11)
- Re: [CVE-2020-28018] Use-After-Free on Exim Question Solar Designer (May 11)
- Re: [CVE-2020-28018] Use-After-Free on Exim Question Qualys Security Advisory (May 11)
- Re: [CVE-2020-28018] Use-After-Free on Exim Question null p0int3r (May 11)
- Re: [CVE-2020-28018] Use-After-Free on Exim Question Qualys Security Advisory (May 11)
- Re: [CVE-2020-28018] Use-After-Free on Exim Question harris.johnson.x (May 12)
- Re: [CVE-2020-28018] Use-After-Free on Exim Question Qualys Security Advisory (May 12)
- Re: [CVE-2020-28018] Use-After-Free on Exim Question null p0int3r (May 11)