USN-3164-1: Exim vulnerability

Ubuntu Security Notice USN-3164-1

5th January, 2017

exim4 vulnerability

A security issue affects these releases of Ubuntu and its derivatives:

• Ubuntu 16.10
• Ubuntu 16.04 LTS
• Ubuntu 14.04 LTS
• Ubuntu 12.04 LTS

Summary

Exim could be made to expose private DKIM signing keys.

Software description

• exim4 - Exim is a mail transport agent

Details

Bjoern Jacke discovered that Exim incorrectly handled DKIM keys. In certain
configurations, private DKIM signing keys could be leaked to the log files.

Update instructions

The problem can be corrected by updating your system to the following package version:

Ubuntu 16.10:

exim4-daemon-heavy 4.87-3ubuntu1.1

exim4-daemon-light 4.87-3ubuntu1.1

Ubuntu 16.04 LTS:

exim4-daemon-heavy 4.86.2-2ubuntu2.1

exim4-daemon-light 4.86.2-2ubuntu2.1

Ubuntu 14.04 LTS:

exim4-daemon-heavy 4.82-3ubuntu2.2

exim4-daemon-light 4.82-3ubuntu2.2

Ubuntu 12.04 LTS:

exim4-daemon-heavy 4.76-3ubuntu3.4

exim4-daemon-light 4.76-3ubuntu3.4

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References

CVE-2016-9963