Your message dated Fri, 21 Feb 2025 12:19:15 +0000
with message-id <[email protected]>
and subject line Bug#1092910: fixed in exim4 4.98-4
has caused the Debian Bug report #1092910,
regarding exim4: Discloses information about which packages are installed
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1092910: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1092910
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: exim4
Version: 4.96-15+deb12u6
Severity: normal
Tags: security
X-Debbugs-Cc: Debian Security Team <[email protected]>
In its default config, exim delivers mail to system accounts. An
attacker can send mail to, say, [email protected] and wait for the
reply. No reply means that sshd is installed on the target system.
"Unrouteable address" means that this is not the case. The same applies
for all packages that create system accounts.
One could set FIRST_USER_ACCOUNT_UID to prevent mail to system accounts
to be delivered, but this doesn't make things better. The reply will
then be "no mail to system accounts", which is different from
"Unrouteable address". The attacker can still send mail to well-known
system account names and find out whether the corresponding package is
installed or not.
-- Package-specific info:
Exim version 4.96 #2 built 28-Sep-2024 14:49:26
Copyright (c) University of Cambridge, 1995 - 2018
(c) The Exim Maintainers and contributors in ACKNOWLEDGMENTS file, 2007 - 2022
Berkeley DB: Berkeley DB 5.3.28: (September 9, 2013)
Support for: crypteq iconv() IPv6 GnuTLS TLS_resume move_frozen_messages DANE
DKIM DNSSEC Event I18N OCSP PIPECONNECT PRDR Queue_Ramp SOCKS SRS TCP_Fast_Open
Lookups (built-in): lsearch wildlsearch nwildlsearch iplsearch cdb dbm dbmjz
dbmnz dnsdb dsearch nis nis0 passwd
Authenticators: cram_md5 external plaintext
Routers: accept dnslookup ipliteral manualroute queryprogram redirect
Transports: appendfile/maildir/mailstore autoreply lmtp pipe smtp
Fixed never_users: 0
Configure owner: 0:0
Size of off_t: 8
Configuration file search path is
/etc/exim4/exim4.conf:/var/lib/exim4/config.autogenerated
Configuration file is /var/lib/exim4/config.autogenerated
-- System Information:
Debian Release: 12.9
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable')
Architecture: i386 (i686)
Foreign Architectures: amd64
Kernel: Linux 6.1.0-28-686-pae (SMP w/4 CPU threads; PREEMPT)
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages exim4 depends on:
ii debconf [debconf-2.0] 1.5.82
ii exim4-base 4.96-15+deb12u6
ii exim4-daemon-light 4.96-15+deb12u6
exim4 recommends no packages.
exim4 suggests no packages.
-- debconf information:
exim4/drec:
--- End Message ---
--- Begin Message ---
Source: exim4
Source-Version: 4.98-4
Done: Andreas Metzler <[email protected]>
We believe that the bug you reported is fixed in the latest version of
exim4, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Andreas Metzler <[email protected]> (supplier of updated exim4 package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sat, 15 Feb 2025 14:02:27 +0100
Source: exim4
Architecture: source
Version: 4.98-4
Distribution: unstable
Urgency: high
Maintainer: Exim4 Maintainers <[email protected]>
Changed-By: Andreas Metzler <[email protected]>
Closes: 1092910
Changes:
exim4 (4.98-4) unstable; urgency=high
.
* Cherry-pick patches from upstream git master:
+ 79_Dovecot-fix-protocol-sequence-for-version-2.4.0.patch (Compliance
with upcoming dovecot v1.3 auth protocol)
* Use default 550 message in lowuid_aliases router ("Unrouteable address"
instead of "no mail to system accounts") to avoid disclosing information on
installed packages. Closes: #1092910
* 81_Squashed-from-fix-cve-2025-26794-fixes-CVE-26794.patch: Upgrade to
4.98.1, fixing CVE-2025-26794. This is a SQL injection for the
(Sqlite-)hints database with ETRN. Debian binaries do not yet use sqlite
for the hints DB so this just only affects users building their own
binaries from sources and switching to sqlite-hints-DB.
Checksums-Sha1:
a994e49432c82f22c38bb91326c5709542c0a67a 2877 exim4_4.98-4.dsc
f89232f4959dd9f3389813c78f0c6e34ddaece79 484720 exim4_4.98-4.debian.tar.xz
Checksums-Sha256:
d6229b6a07f561566b58ec575674dbff9195303752d79cf2a7bb07a441a9a268 2877
exim4_4.98-4.dsc
3170a800988829d953408c0525c3054b3a88445cea22ad9e72729b43971b38c1 484720
exim4_4.98-4.debian.tar.xz
Files:
28be865da245ee1096de31cb02af8dff 2877 mail standard exim4_4.98-4.dsc
58fcc59d7bac6ddfbc923b3b1b9035ce 484720 mail standard
exim4_4.98-4.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEE0uCSA5741Jbt9PpepU8BhUOCFIQFAme2EqsACgkQpU8BhUOC
FIQ8dQ//V4w5JRwF5g6B58mci0bjfJ9uTM/AHvZ31ibnA3Vv53APiSbEGiUVnMHE
TzDe+3MkNHdFR77Fg+RO4VwzNJMADj+jECJ0R4x7s/AUK+uSDM8BVGdUqguDKPwj
LaIyoxR3stPF9BGkOKlPqwKr0a0cHkWCBqovd+pCuErtAFyX4ZBghEUiTGn+ulhZ
5cX7p8GfAX2ZF1RKb+zGzNu+XoHUn62yarYdm9Y3vLXItJhDCSoeR2fp8Ttkfppn
QDZ9yFbQuqgJzSZTgrxjerSQGST+Q4qCdZqhUCHnes8ljQtRtDIUN+17aKVF1lKq
ElQe1Hk/eOMETnQ9JjUZl+zfb5T4vziunq8JVWyHrqxZXe9hT2LaXYeI0ef3TpWA
+ddH0m5NxvCemTqd3uaGY2VFUhj+/zwENJe98PBFPhSwyiedbcX1a9F7oE7o8rLU
KYMa/rgTDh13uG/o69kfJ6ivpAwYyoFvv/9kxs7go7Oh0nlob/4Bk94XTEORG1QD
9alpj035seszzrXErD2vfX6TyezrVMtadbvR4ktwNcK1lN3ZZg7kqIGIUOE+yu7C
ftvKNDlJZ1zyxoBx+bLtxW1I3HlSjczNdVP9G9V4Btl03b0uBVQUg/m39T+FTxtB
kf3Fyx72dbZCzk207fsq3mo4feXk+ukvW1h8tlySWzAkRqC+oFk=
=3H/O
-----END PGP SIGNATURE-----
pgpmYD0qRTjkB.pgp
Description: PGP signature
--- End Message ---
