Exim vulnerability opens 400,000 servers to remote code execution
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2018-6789 | Pre-auth Buffer Overflow RCE in Exim SMTP Listener CVE-2018-6789 is an off-by-one buffer overflow (CWE-120) in the base64d decoding function of Exim's SMTP listener, affecting Exim versions before 4.90.1. A remote, unauthenticated attacker triggers it by sending a handcrafted message to the SMTP listener, causing the overflow during base64 decoding. Successful exploitation yields arbitrary code execution on the mail server with the privileges of the Exim daemon. Affected operators include anyone running a vulnerable Exim mail transfer agent, including Exim as shipped in Debian and Ubuntu; Exim powers roughly half of internet-facing mail servers, with on the order of 400,000 servers exposed at disclosure. Exploitation is confirmed in the wild: the flaw is in CISA's Known Exploited Vulnerabilities catalog with known ransomware use, multiple public PoCs/exploits are available, and it appears in the NSA's list of top flaws abused by Chinese state-sponsored hackers. Do: Upgrade Exim to 4.90.1 or later, or apply the patched Exim package from Debian's and Ubuntu's security repositories on affected distributions. Inventory internet-facing SMTP services (ports 25/465/587) for vulnerable Exim versions, review mail logs for signs of exploitation, and prioritize patching given the flaw's CISA KEV listing and known ransomware use. | 9.8 | 82% | KEV ransomware PoC ×4 |
| mass≈400,000+ internet-exposed Exim mail servers; Exim runs on roughly half of internet-facing mail servers |
Full article261 words · extracted from helpnetsecurity.com · click to collapse
If you’re using the Exim mail transfer agent on your Internet-connected Unix-like systems and you haven’t yet upgraded to version 4.90.1, now is the time to do it as all previous versions contain a vulnerability that can be exploited to achieve remote code execution.
About the Exim remote code execution vulnerability
The buffer overflow vulnerability in the base64 decode function of Exim (CVE-2018-6789) was discovered and reported by Meh Chang of the DEVCORE research team in early February 2018, and a patch was released five days later.
“Generally, this bug is harmless because the memory overwritten is usually unused. However, this byte overwrites some critical data when the string fits some specific length,” the DEVCORE team explained in an advisory.
“In addition, this byte is controllable, which makes exploitation more feasible. Base64 decoding is such a fundamental function and therefore this bug can be triggered easily, causing remote code execution.”
Public exploit
Exim maintainers previously said that they believe exploiting the flaw would be difficult, and noted that there is no available mitigation for the bug.
The DEVCORE team developed, detailed and published on Tuesday an exploit targeting the SMTP daemon of Exim.
They also noted that the bug is present since the first commit of Exim, so all versions of the software before version 4.90.1 are affected.
A March 2017 report showed that approximately 56% of the mail servers visible on the Internet ran Exim.
“According to our research, it can be leveraged to gain Pre-auth Remote Code Execution and at least 400k servers are at risk,” the team added.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2018/03/07/exim-remote-code-execution/