CVE-2018-6789

CVE-2018-6789 is an off-by-one buffer overflow (CWE-120) in the base64d decoding function of Exim's SMTP listener, affecting Exim versions before 4.90.1. A remote, unauthenticated attacker triggers it by sending a handcrafted message to the SMTP listener, causing the overflow during base64 decoding. Successful exploitation yields arbitrary code execution on the mail server with the privileges of the Exim daemon. Affected operators include anyone running a vulnerable Exim mail transfer agent, including Exim as shipped in Debian and Ubuntu; Exim powers roughly half of internet-facing mail servers, with on the order of 400,000 servers exposed at disclosure. Exploitation is confirmed in the wild: the flaw is in CISA's Known Exploited Vulnerabilities catalog with known ransomware use, multiple public PoCs/exploits are available, and it appears in the NSA's list of top flaws abused by Chinese state-sponsored hackers.

What to do: Upgrade Exim to 4.90.1 or later, or apply the patched Exim package from Debian's and Ubuntu's security repositories on affected distributions. Inventory internet-facing SMTP services (ports 25/465/587) for vulnerable Exim versions, review mail logs for signs of exploitation, and prioritize patching given the flaw's CISA KEV listing and known ransomware use.