We'd love to hear about it! Click here to go to the product suggestion community
There is a heap-based buffer overflow in string_vformat (string.c). The currently known exploit uses a extraordinary long EHLO string to crash the Exim process that is receiving the message.This is allready the third time this year, EXIM is vulnerable. From my point of view, sophos UTM and XG shouldn't be vulnerable because of the same reasons, they have not been vulnerable for CVE-2019-15846. Maybe anybody can confirm anyways?
I'll update this thread once we have more information available on this.
This topic seems to be slowly attracting attention in the German Media as well:
In reply to HuberChristian:
Maybe the ehlo-string will be stripped again. I hope so.
In reply to Jaydeep:
Do you have any news for us yet ? 48 hours have passed...kind regards-- Guenther AlbrechtArrow ECS Internet Security AG A-1100 Wien, Wienerbergstrasse 11
Anything else happen here? Is the security gap a problem or not?
In reply to ThorstenSult:
We're tracking this issue with both XG and UTM and I will have an update soon. We're not using the affected Exim version 4.92 in UTM or XG but I'll post it once I have a confirmation from our team.
Thanks for the feedback.
Thanks for your patience.
Please note that Sophos UTM and Sophos XG are not affected by this CVE-2019-16928 Vulnerability as it does not use the affected Exim versions.