summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorTodd Lyons <tlyons@exim.org>2014-07-18 11:42:08 -0700
committerTodd Lyons <tlyons@exim.org>2014-07-21 07:28:07 -0700
commit0de7239e563eff6e83c3e72d7deb9fd26a54a3a7 (patch)
tree12c6d4be2fe5533782197ff8124530f8113cfc0c
parent7685ce68148a083d7759e78d01aa5198fc099c44 (diff)
Documentation/Tests for CVE-2014-2972 fixexim-4_83
-rw-r--r--doc/doc-txt/ChangeLog4
-rw-r--r--test/aux-fixed/0002.lsearch1
-rw-r--r--test/scripts/0000-Basic/00021
-rw-r--r--test/stdout/00021
4 files changed, 7 insertions, 0 deletions
diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index 770b106a5..61086c7e2 100644
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -150,6 +150,10 @@ PP/02 Fix internal collision of T_APL on systems which support RFC3123
JH/28 Fix parsing of MIME headers for parameters with quoted semicolons.
+TL/15 SECURITY: prevent double expansion in math comparison functions
+ (can expand unsanitized data). Not remotely exploitable.
+ CVE-2014-2972
+
Exim version 4.82
-----------------
diff --git a/test/aux-fixed/0002.lsearch b/test/aux-fixed/0002.lsearch
index dcf198b70..5cd6b1aa0 100644
--- a/test/aux-fixed/0002.lsearch
+++ b/test/aux-fixed/0002.lsearch
@@ -1,2 +1,3 @@
ten-1.test.ex
10.0.0.2
+trick: ${substr_2_2:65535}
diff --git a/test/scripts/0000-Basic/0002 b/test/scripts/0000-Basic/0002
index 7b6c34b3e..51dc6ae48 100644
--- a/test/scripts/0000-Basic/0002
+++ b/test/scripts/0000-Basic/0002
@@ -331,6 +331,7 @@ mask: ${if eq {1}{2}{${mask:invalid}}{NO}}
5>3m: ${if >{5 } {3m }{y}{n}}
5>3z: ${if >{5 } {3z }{y}{n}}
5>a: ${if >{ 5 } {a}{y}{n}}
+5>bad: ${if >{5 } {${lookup{trick}lsearch{DIR/aux-fixed/0002.lsearch}}} {y}{n}}
>0: ${if > {}{0}{y}{n}}
=: ${if = {}{}{y}{n}}
diff --git a/test/stdout/0002 b/test/stdout/0002
index 64e571944..7200bf3a7 100644
--- a/test/stdout/0002
+++ b/test/stdout/0002
@@ -304,6 +304,7 @@
> 5>3m: n
> Failed: invalid integer "3z "
> Failed: integer expected but "a" found
+> Failed: integer expected but "${substr_2_2:65535}" found
>
> >0: n
> =: y