21Nails vulnerabilities impact 60% of the internet's email servers

CVE-2018-6789 is an off-by-one buffer overflow (CWE-120) in the base64d decoding function of Exim's SMTP listener, affecting Exim versions before 4.90.1. A remote, unauthenticated attacker triggers it by sending a handcrafted message to the SMTP listener, causing the overflow during base64 decoding. Successful exploitation yields arbitrary code execution on the mail server with the privileges of the Exim daemon. Affected operators include anyone running a vulnerable Exim mail transfer agent, including Exim as shipped in Debian and Ubuntu; Exim powers roughly half of internet-facing mail servers, with on the order of 400,000 servers exposed at disclosure. Exploitation is confirmed in the wild: the flaw is in CISA's Known Exploited Vulnerabilities catalog with known ransomware use, multiple public PoCs/exploits are available, and it appears in the NSA's list of top flaws abused by Chinese state-sponsored hackers.

Do: Upgrade Exim to 4.90.1 or later, or apply the patched Exim package from Debian's and Ubuntu's security repositories on affected distributions. Inventory internet-facing SMTP services (ports 25/465/587) for vulnerable Exim versions, review mail logs for signs of exploitation, and prioritize patching given the flaw's CISA KEV listing and known ransomware use.

CVE-2019-10149 is an improper input validation flaw (CWE-78, OS command injection) in the deliver_message() function in /src/deliver.c of the Exim mail transfer agent, where email recipient addresses are not safely validated before use. A remote attacker triggers it by sending mail whose recipient address contains crafted Exim string-expansion syntax (such as ${run{...}}), causing Exim to expand and execute attacker-supplied operating-system commands during recipient verification or delivery. An attacker gains arbitrary remote command execution on the mail server, commonly with elevated privileges, enabling full system compromise, data theft, ransomware deployment (e.g., the Trinity ransomware campaign), or installation of botnet implants. Any organization running an internet-exposed Exim MTA in the affected version range is at risk, and Exim is widely deployed as the default mail server on many Linux distributions. Exploitation is confirmed in the wild: mass scanning and compromise campaigns began shortly after the June 2019 disclosure, CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2022-01-10, and its EPSS score of 100% (100th percentile) reflects near-certain near-term exploitation risk.

Do: Upgrade Exim to 4.92 or later, or install your distribution's patched Exim package, as required by CISA's KEV action ('apply updates per vendor instructions'); if patching must be delayed, restrict internet-facing SMTP access and tighten recipient-verification configuration. Check mail logs for suspicious MAIL FROM/RCPT TO addresses containing expansion syntax such as ${run{...}} or shell-like commands, and audit patched servers for post-compromise artifacts such as unusual cron jobs, downloaded binaries, or new authorized SSH keys.

Exim before 4.92.2 allows remote attackers to execute arbitrary code as root via a trailing backslash.

Exim 4 before 4.94.2 allows Use After Free in smtp_reset in certain situations that may be common for builds with OpenSSL.