CVE-2005-0021
Exim < 4.43 - Buffer Overflow via IPv6 Address or DNS PTR Lookup
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2005-0021. PoCs published by Plugger, Rafael Carrasco.
AI-analyzed exploit summary This exploit targets a buffer overflow vulnerability in Exim (CVE-2005-0021) by injecting shellcode into the '-bh' argument. It uses Aleph1's shellcode to spawn a shell, with NOP sleds for padding and a hardcoded return address.
Description
Multiple buffer overflows in Exim before 4.43 may allow attackers to execute arbitrary code via (1) an IPv6 address with more than 8 components, as demonstrated using the -be command line option, which triggers an overflow in the host_aton function, or (2) the -bh command line option or dnsdb PTR lookup, which triggers an overflow in the dns_build_reverse function.
Exploits (2)
This exploit targets a buffer overflow vulnerability in Exim (CVE-2005-0021) by injecting shellcode into the '-bh' argument. It uses Aleph1's shellcode to spawn a shell, with NOP sleds for padding and a hardcoded return address.
This exploit targets a buffer overflow vulnerability in Exim (CVE-2005-0021) by injecting shellcode into a crafted input string passed to the `-bh` argument. The shellcode spawns a `/bin/sh` shell, and the return address is brute-forced using an accompanying Perl script.