«Exim Off-by-one RCE: Exploiting CVE-2018-6789 with Fully Mitigations Bypassing»(html). Devco(en inglés). 6 de marzo de 2018. Archivado desde el original el 23 de julio de 2018. Consultado el 26 de julio de 2018. «As shown above, exim allocates a buffer of 3*(len/4)+1 bytes to store decoded base64 data. However, when the input is not a valid base64 string and the length is 4n+3, exim allocates 3n+1 but consumes 3n+2 bytes while decoding. This causes one byte heap overflow (aka off-by-one). Generally, this bug is harmless because the memory overwritten is usually unused. However, this byte overwrites some critical data when the string fits some specific length. In addition, this byte is controllable, which makes exploitation more feasible. Base64 decoding is such a fundamental function and therefore this bug can be triggered easily, causing remote code execution.»
Gurubaran (7 de marzo de 2018). «Exim Vulnerability Puts More than 500,000 Email Servers at High Risk»(html). GB Hackers(en inglés). Archivado desde el original el 26 de julio de 2018. Consultado el 26 de julio de 2018. «The Vulnerability resides with b64decode function in the SMTP listener. When the provided input is not a valid base64 string it consumes additional bytes while decoding which causes the one-byte heap overflow.»
Gurubaran (7 de marzo de 2018). «Exim Vulnerability Puts More than 500,000 Email Servers at High Risk»(html). GB Hackers(en inglés). Archivado desde el original el 26 de julio de 2018. Consultado el 26 de julio de 2018. «The Vulnerability resides with b64decode function in the SMTP listener. When the provided input is not a valid base64 string it consumes additional bytes while decoding which causes the one-byte heap overflow.»
«Exim Off-by-one RCE: Exploiting CVE-2018-6789 with Fully Mitigations Bypassing»(html). Devco(en inglés). 6 de marzo de 2018. Archivado desde el original el 23 de julio de 2018. Consultado el 26 de julio de 2018. «As shown above, exim allocates a buffer of 3*(len/4)+1 bytes to store decoded base64 data. However, when the input is not a valid base64 string and the length is 4n+3, exim allocates 3n+1 but consumes 3n+2 bytes while decoding. This causes one byte heap overflow (aka off-by-one). Generally, this bug is harmless because the memory overwritten is usually unused. However, this byte overwrites some critical data when the string fits some specific length. In addition, this byte is controllable, which makes exploitation more feasible. Base64 decoding is such a fundamental function and therefore this bug can be triggered easily, causing remote code execution.»
