Critical Exim flaw opens servers to remote code execution, patch now!
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-10149 | Unvalidated Email Recipient Enables Remote Command Execution in Exim MTA CVE-2019-10149 is an improper input validation flaw (CWE-78, OS command injection) in the deliver_message() function in /src/deliver.c of the Exim mail transfer agent, where email recipient addresses are not safely validated before use. A remote attacker triggers it by sending mail whose recipient address contains crafted Exim string-expansion syntax (such as ${run{...}}), causing Exim to expand and execute attacker-supplied operating-system commands during recipient verification or delivery. An attacker gains arbitrary remote command execution on the mail server, commonly with elevated privileges, enabling full system compromise, data theft, ransomware deployment (e.g., the Trinity ransomware campaign), or installation of botnet implants. Any organization running an internet-exposed Exim MTA in the affected version range is at risk, and Exim is widely deployed as the default mail server on many Linux distributions. Exploitation is confirmed in the wild: mass scanning and compromise campaigns began shortly after the June 2019 disclosure, CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2022-01-10, and its EPSS score of 100% (100th percentile) reflects near-certain near-term exploitation risk. Do: Upgrade Exim to 4.92 or later, or install your distribution's patched Exim package, as required by CISA's KEV action ('apply updates per vendor instructions'); if patching must be delayed, restrict internet-facing SMTP access and tighten recipient-verification configuration. Check mail logs for suspicious MAIL FROM/RCPT TO addresses containing expansion syntax such as ${run{...}} or shell-like commands, and audit patched servers for post-compromise artifacts such as unusual cron jobs, downloaded binaries, or new authorized SSH keys. | 9.8 | 100% | KEV PoC ×5 |
| mass≈500,000+ internet-exposed Exim SMTP servers, with hundreds of thousands likely running vulnerable versions | |
| CVE-2019-15846 | Exim before 4.92.2 allows remote attackers to execute arbitrary code as root via a trailing backslash. Exim before 4.92.2 allows remote attackers to execute arbitrary code as root via a trailing backslash. NVD description · AI analysis pending | 9.8 | 36% |
| — |
Full article373 words · extracted from helpnetsecurity.com · click to collapse
The Exim mail transfer agent (MTA) is impacted by a critical vulnerability that may allow local or unauthenticated remote attackers to execute programs with root privileges on the underlying system.
About Exim
Exim is the most widely used MTA today and is deployed on over half of all Internet-facing mail servers.
It’s efficient, highly configurable, bundled with most Unix-like systems – and free.
About the vulnerability
CVE-2019-15846 affects Exim versions 4.80 to (and including) 4.92.1. A server will be vulnerable only if it accepts TLS connection.
Exim installations do not come with TLS support enabled by default, but those that are bundled with the various Linux distributions do.
CVE-2019-15846 is exploitable by sending a SNI ending in a backslash-null sequence during the initial TLS handshake, Exim maintainers explained.
The vulnerability has been fixed in Exim version 4.92.2, to which users are urged to upgrade. If they can’t, they can ask your package maintainer for a version containing the backported fix.
“On request and depending on our resources we will support you in backporting the fix,” the project maintainers added. “Please note, the Exim project officially doesn’t support versions prior the current stable version.”
They also offered several mitigations:
- Do not to offer TLS (not recommended), and
- Add specific rules to the mail access-control list (ACL) to prevent the currently known attack vector.
Ubuntu and Debian have already released updated distro or Exim packages. All production versions of cPanel & WHM have also been patched.
How likely is a wide exploitation of the flaw?
Similarly critical vulnerabilities affecting Exim were disclosed earlier this year. Attackers started exploiting one of them (CVE-2019-10149) a week after it’s existence was publicly revealed.
Exim maintainers say that a PoC exploit for CVE-2019-15846 exists, though it’s still not widely accessible. Though, according to Qualys researchers, who analyzed the vulnerability reported by a researcher that goes by “Zerons”, other exploitation methods may exist.
It’s hard to say just how many Internet-facing, Exim-running servers are out there and how many of them are vulnerable. Security Space puts the number around half a million, Shodan says there are over 5 million. Most of them likely still run a vulnerable version.
If your servers are among them, upgrade or patch quickly.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2019/09/09/exim-cve-2019-15846/