CVE-2005-0021

Exim 4.41 - 'dns_build_reverse' Local Read Emails

Title source: exploit-db.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2005-0021 has a selected CVSS score of 7.2; EIP currently links 2 catalogued exploits.

Description

Multiple buffer overflows in Exim before 4.43 may allow attackers to execute arbitrary code via (1) an IPv6 address with more than 8 components, as demonstrated using the -be command line option, which triggers an overflow in the host_aton function, or (2) the -bh command line option or dnsdb PTR lookup, which triggers an overflow in the dns_build_reverse function.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
2

Proofs of concept

2

Catalogued exploits

ExploitDBExim 4.41 - 'dns_build_reverse' Local Read EmailsExploitDB exploitby PluggerExploit1 file
ExploitDB
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Local exploit for Exim 4.41 that uses a buffer overflow in the dns_build_reverse function, triggered via the -bh command line option, to execute shellcode and gain shell access.

Backdoor review

No backdoor observed in reviewed code

The provided C source code is a straightforward local privilege escalation exploit for CVE-2005-0021 in Exim. It constructs a payload to trigger a buffer overflow in the `dns_build_reverse` function via the `-bh` command-line option, with the goal of executing shellcode that spawns `/bin/sh`. The code is clearly commented, uses well-known public shellcode, and contains no hidden or deceptive functionality beyond the stated exploit behavior. No backdoor, trojan, or suspicious behavior is observed.

ClassificationExploit
Model confidence95%
AuthenticationRequired
LanguagesC
Target softwareExim
Attack typesbuffer overflowlocal privilege escalation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The code constructs a buffer overflow payload with shellcode and uses execve to launch the vulnerable Exim binary with the payload, which is the definition of an exploit.

exploits/linux/local/1009.c:19-56exploits/linux/local/1009.c:60-66

Requirements

  • Requires a local user account on the target server.exploits/linux/local/1009.c:6-7
  • Exim binary must be located at payload withheld.exploits/linux/local/1009.c:61

Observed behavior

  • Constructs a 288-byte payload containing a malformed IPv6 address, NOP sled, and Aleph1 shellcode that executes /bin/sh.exploits/linux/local/1009.c:19-56
  • Executes Exim with the -bh option and the crafted payload as an argument.exploits/linux/local/1009.c:60-66
  • Prints a message indicating the exploit is being launched and expects a shell.exploits/linux/local/1009.c:65
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Mechanism
Payload withheldThe exploit triggers CVE-2005-0021 to gain local code execution.exploits/linux/local/1009.c:22exploits/linux/local/1009.c:62-63
Shellcode
Payload withheldThe payload executes /bin/sh upon successful exploitation.exploits/linux/local/1009.c:46-49
Target Binary
Payload withheldThe exploit targets a specific Exim installation path.exploits/linux/local/1009.c:61
Review boundaries

What the analysis did not establish

  • The hardcoded return address (0xbffff2f4) is specific to a particular environment and may not work on all systems.
  • The exploit relies on the Exim binary being at a specific path (payload withheld).
  • The shellcode is a standard execve /bin/sh payload and does not include any cleanup or privilege restoration.
  • Only the provided C source file was reviewed; the referenced external archive (exim-4.41.tar.gz) was not fetched or analyzed.
  • Binary files, if any, were not inspected per the evidence envelope policy.
  • The review does not assess whether the exploit is functional or safe to execute.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

ExploitDBExim 4.41 - 'dns_build_reverse' Local Buffer OverflowExploitDB exploitby Rafael CarrascoNot analyzed1 file
ExploitDB
PoC details

References

11