Re: [exim] Security release for CVE-2016-1531: 4.84.2, 4.85.…

Top Page
Delete this message
Reply to this message
Author: Heiko Schlichting
Date:  
To: exim-users
Subject: Re: [exim] Security release for CVE-2016-1531: 4.84.2, 4.85.2, 4.86.2, 4.87 RC5
Heiko Schlittermann wrote:
>
>     keep_environment = TZ : LANG : ^LC_ : ^LDAP
>     add_environment = <; PATH=/bin:/usr/bin:/usr/local/bin

>
> could be a good starting point.


The handling of "TZ" is very special and often does noch work as expected.
Your list suggests that TZ content will be used from the environment but
this is often not the case. It depends on

    * if and how TZ is set at compile time
    * TIMEZONE_DEFAULT setting in Makefile at compile time
    * "timezone" global config variable


Here are two examples which I found confusing until reading the source in
src/buildconfig.c:

    $ exim -bP add_environment
    add_environment = TZ=Atlantic/Reykjavik


    $ exim -bP environment
    TZ=Europe/Berlin


    -----------


    $ exim -bP keep_environment
    keep_environment = TZ


    $ env TZ=Atlantic/Reykjavik exim -bP environment
    TZ=Europe/Berlin


Heiko

Heiko Schlichting                Freie Universität Berlin
heiko.schlichting@???   Zentraleinrichtung für Datenverarbeitung
Telefon +49 30 838-54327         Fabeckstraße 32
Telefax +49 30 838454327         14195 Berlin