New Critical Security Flaws Expose Exim Mail Servers to Remote Attacks
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-10149 | Unvalidated Email Recipient Enables Remote Command Execution in Exim MTA CVE-2019-10149 is an improper input validation flaw (CWE-78, OS command injection) in the deliver_message() function in /src/deliver.c of the Exim mail transfer agent, where email recipient addresses are not safely validated before use. A remote attacker triggers it by sending mail whose recipient address contains crafted Exim string-expansion syntax (such as ${run{...}}), causing Exim to expand and execute attacker-supplied operating-system commands during recipient verification or delivery. An attacker gains arbitrary remote command execution on the mail server, commonly with elevated privileges, enabling full system compromise, data theft, ransomware deployment (e.g., the Trinity ransomware campaign), or installation of botnet implants. Any organization running an internet-exposed Exim MTA in the affected version range is at risk, and Exim is widely deployed as the default mail server on many Linux distributions. Exploitation is confirmed in the wild: mass scanning and compromise campaigns began shortly after the June 2019 disclosure, CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2022-01-10, and its EPSS score of 100% (100th percentile) reflects near-certain near-term exploitation risk. Do: Upgrade Exim to 4.92 or later, or install your distribution's patched Exim package, as required by CISA's KEV action ('apply updates per vendor instructions'); if patching must be delayed, restrict internet-facing SMTP access and tighten recipient-verification configuration. Check mail logs for suspicious MAIL FROM/RCPT TO addresses containing expansion syntax such as ${run{...}} or shell-like commands, and audit patched servers for post-compromise artifacts such as unusual cron jobs, downloaded binaries, or new authorized SSH keys. | 9.8 | 100% | KEV PoC ×5 |
| mass≈500,000+ internet-exposed Exim SMTP servers, with hundreds of thousands likely running vulnerable versions | |
| CVE-2023-42115 | Exim AUTH Out-Of-Bounds Write Remote Code Execution Vulnerability. Exim AUTH Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Exim. Authentication is not required to exploit this vulnerability. The specific flaw exists within the smtp service, which listens on TCP port 25 by default. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of a buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. . Was ZDI-CAN-17434. NVD description · AI analysis pending | 9.8 group max | 10% |
| — | ||
| CVE-2023-42118 | Exim libspf2 Integer Underflow Remote Code Execution Vulnerability. Exim libspf2 Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Exim libspf2. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of SPF macros. When parsing SPF macros, the process does not properly validate user-supplied data, which can result in an integer underflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the service account. . Was ZDI-CAN-17578. NVD description · AI analysis pending | 8.8 | 52% |
| — |
Full article664 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananSep 30, 2023Email Security / Hacking News
Multiple security vulnerabilities have been disclosed in the Exim mail transfer agent that, if successfully exploited, could result in information disclosure and remote code execution.
The list of flaws, which were reported anonymously way back in June 2022, is as follows -
- CVE-2023-42114 (CVSS score: 3.7) - Exim NTLM Challenge Out-Of-Bounds Read Information Disclosure Vulnerability
- CVE-2023-42115 (CVSS score: 9.8) - Exim AUTH Out-Of-Bounds Write Remote Code Execution Vulnerability
- CVE-2023-42116 (CVSS score: 8.1) - Exim SMTP Challenge Stack-based Buffer Overflow Remote Code Execution Vulnerability
- CVE-2023-42117 (CVSS score: 8.1) - Exim Improper Neutralization of Special Elements Remote Code Execution Vulnerability
- CVE-2023-42118 (CVSS score: 7.5) - Exim libspf2 Integer Underflow Remote Code Execution Vulnerability
- CVE-2023-42119 (CVSS score: 3.1) - Exim dnsdb Out-Of-Bounds Read Information Disclosure Vulnerability
The most severe of the vulnerabilities is CVE-2023-42115, which allows remote, unauthenticated attackers to execute arbitrary code on affected installations of Exim.
"The specific flaw exists within the SMTP service, which listens on TCP port 25 by default," the Zero Day Initiative said in an alert published this week.
"The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of a buffer. An attacker can leverage this vulnerability to execute code in the context of the service account."
Exim maintainers, in a message shared on the Open Source Security mailing list oss-security, said fixes for CVE-2023-42114, CVE-2023-42115, and CVE-2023-42116 are "available in a protected repository and are ready to be applied by the distribution maintainers."
"The remaining issues are debatable or miss information we need to fix them," adding it asked ZDI more specifics about the issues and that it "didn't get answers we were able to work with" until May 2023. The Exim team further said they are awaiting detailed specifics on the other three shortcomings.
However, the ZDI pushed back against claims about "sloppy handling" and "neither team pinging the other for 10 months," stating it reached out several times to the developers.
"After our disclosure timeline was exceeded by many months, we notified the maintainer of our intent to publicly disclose these bugs, at which time we were told, 'you do what you do,'" it said.
"If these bugs have been appropriately addressed, we will update our advisories with a link to the security advisory, code check-in, or other public documentation closing the issue."
In the absence of patches, the ZDI recommends restricting interaction with the application as the only "salient" mitigation strategy.
This is not the first time security flaws have been uncovered in the widely used mail transfer agent. In May 2021, Qualys disclosed a set of 21 vulnerabilities collectively tracked as 21Nails that enable unauthenticated attackers to achieve complete remote code execution and gain root privileges.
Previously in May 2020, the U.S. government reported that hackers affiliated with Sandworm, a state-sponsored group from Russia, had been exploiting a critical Exim vulnerability (CVE-2019-10149, CVSS score: 9.8) to penetrate sensitive networks.
The development also comes hot on the heels of a new study by researchers from the University of California San Diego that discovered a novel technique called forwarding-based spoofing which takes advantage of weaknesses in email forwarding to send messages impersonating legitimate entities, thereby compromising on integrity.
"The original protocol used to check the authenticity of an email implicitly assumes that each organization operates its own mailing infrastructure, with specific IP addresses not used by other domains," the research found.
"But today, many organizations outsource their email infrastructure to Gmail and Outlook. As a result, thousands of domains have delegated the right to send email on their behalf to the same third party. While these third-party providers validate that their users only send email on behalf of domains that they operate, this protection can be bypassed by email forwarding."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2023/09/new-critical-security-flaws-expose-exim.html