Am 02.10.23 um 19:38 schrieb Christof Meerwald via Exim-users:
>
> "Please why?
>
> + do you use AUTH (NTLM/EXTERNAL) on port 25?"
>
> So I was asking if these details were indeed available somewhere
> before Sunday evening.
A lance for security:
The Trend Micro abstracts had already enough informations to make
exploitcoders look in the source to find the problems themself.
Any more information would have speed up this process, because it makes
it easier to locate the section of code you need to check, and we(user
and devs) don't wont this to happen, as the patches where not available yet.
As Heiko wrote, the communications with ZDI was not great( from both
sides i assume, as each side expected more from the other side), but
when you as dev get an issue report but no infos about the exploit,
configs etc, it's a pain in the ass job to find it yourself, even if you
are a longterm dev for the project.
That slowed it down massively and now, with the public advisories from
ZDI, the pressure was immense to find it in time and develope a working fix.
And: Big Thanks TEAM, 4.96.1 is running fine! (Fedora has the update ready)
best regards,
Cyborg
--
## subscription configuration (requires account):
##
https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@???
## Exim details at
http://www.exim.org/
## Please use the Wiki with this list -
http://wiki.exim.org/
