CVE-2017-16944

High

Published: 25/11/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The receive_msg function in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service via infinite loop and stack exhaustion using BDAT commands and an improper check for a '.' character signifying the end of the content.

Risk Assessment

Attackers can cause service unavailability, leading to disruptions in organizational operations and loss of user trust.

Recommendation

It is recommended to update Exim to the latest version to mitigate this vulnerability and to monitor logs for potential attack attempts.

Other vulnerabilities in Exim SMTP daemon

CVE-2017-16943Critical
The receive_msg function in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via vectors involving BDAT commands.

Original NVD description (English source)

The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service (infinite loop and stack exhaustion) via vectors involving BDAT commands and an improper check for a '.' character signifying the end of the content, related to the bdat_getc function.