certfr_avis - certfr-2023-avi-0810

CERTFR-2023-AVI-0810

Vulnerability from certfr_avis

Une vulnérabilité a été découverte dans les produits Sophos. Elle permet à un attaquant de provoquer une exécution de code arbitraire à distance.

Les produits SG UTM ne bénéficieront pas de correctif de sécurité avant le 17 octobre 2023 pour cette vulnérabilité, l'éditeur propose cependant des mesures de contournement afin de désactiver la gestion de SPF.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Sophos	N/A	Sophos Firewall versions 19.5.x antérieures à 19.5 GA/MR1/MR2/MR3
Sophos	N/A	Sophos Firewall versions 19.0.x antérieures à 19.0 GA/MR1/MR2/MR3
Sophos	N/A	Sophos Firewall versions 18.5.x antérieures à 18.5 MR4/MR5
Sophos	N/A	Sophos Firewall versions 20.x antérieures à 20 EAP1

References

Title

Publication Time

Tags

Bulletin de sécurité Sophos 20231005 du 05 octobre 2023

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Sophos Firewall versions 19.5.x ant\u00e9rieures \u00e0 19.5 GA/MR1/MR2/MR3",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Sophos",
          "scada": false
        }
      }
    },
    {
      "description": "Sophos Firewall versions 19.0.x ant\u00e9rieures \u00e0 19.0 GA/MR1/MR2/MR3",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Sophos",
          "scada": false
        }
      }
    },
    {
      "description": "Sophos Firewall versions 18.5.x ant\u00e9rieures \u00e0 18.5 MR4/MR5",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Sophos",
          "scada": false
        }
      }
    },
    {
      "description": "Sophos Firewall versions 20.x ant\u00e9rieures \u00e0 20 EAP1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Sophos",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2023-42118",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-42118"
    }
  ],
  "initial_release_date": "2023-10-06T00:00:00",
  "last_revision_date": "2023-10-06T00:00:00",
  "links": [],
  "reference": "CERTFR-2023-AVI-0810",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2023-10-06T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans les produits Sophos. Elle permet\n\u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance.\n\nLes produits SG UTM ne b\u00e9n\u00e9ficieront pas de correctif de s\u00e9curit\u00e9 avant\nle 17 octobre 2023 pour cette vuln\u00e9rabilit\u00e9, l\u0027\u00e9diteur propose cependant\ndes mesures de contournement afin de d\u00e9sactiver la gestion de SPF.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans les produits Sophos",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Sophos 20231005 du 05 octobre 2023",
      "url": "https://www.sophos.com/fr-fr/security-advisories/sophos-sa-20231005-exim-vuln"
    }
  ]
}

CVE-2023-42118 (GCVE-0-2023-42118)

Vulnerability from cvelistv5

Published

2024-05-03 02:13

Modified

2025-03-28 12:04

Severity ?

7.5 (High) - CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-191 - Integer Underflow (Wrap or Wraparound)

Summary

Exim libspf2 Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Exim libspf2. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of SPF macros. When parsing SPF macros, the process does not properly validate user-supplied data, which can result in an integer underflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the service account. . Was ZDI-CAN-17578.

References

URL

Tags

https://www.zerodayinitiative.com/advisories/ZDI-23-1472/

x_research-advisory

Impacted products

	Vendor	Product	Version
	Exim	libspf2	Version: exim 4.96-RC0-14-24b8ed847-XX

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:exim:libspf2:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "libspf2",
            "vendor": "exim",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-42118",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-03T14:45:10.464774Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-03T20:58:33.989Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-03-28T12:04:20.804Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "ZDI-23-1472",
            "tags": [
              "x_research-advisory",
              "x_transferred"
            ],
            "url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1472/"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/03/28/1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "libspf2",
          "vendor": "Exim",
          "versions": [
            {
              "status": "affected",
              "version": "exim 4.96-RC0-14-24b8ed847-XX"
            }
          ]
        }
      ],
      "dateAssigned": "2023-09-06T21:25:45.475Z",
      "datePublic": "2023-09-27T22:21:14.249Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Exim libspf2 Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Exim libspf2. Authentication is not required to exploit this vulnerability. \n\nThe specific flaw exists within the parsing of SPF macros. When parsing SPF macros, the process does not properly validate user-supplied data, which can result in an integer underflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the service account.\n. Was ZDI-CAN-17578."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-191",
              "description": "CWE-191: Integer Underflow (Wrap or Wraparound)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-18T18:30:11.548Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-23-1472",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-23-1472/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "Anonymous"
      },
      "title": "Exim libspf2 Integer Underflow Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2023-42118",
    "datePublished": "2024-05-03T02:13:26.055Z",
    "dateReserved": "2023-09-06T21:14:24.436Z",
    "dateUpdated": "2025-03-28T12:04:20.804Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CERTFR-2023-AVI-0810

Vulnerability from certfr_avis

Solution

CVE-2023-42118 (GCVE-0-2023-42118)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature