CVE-2019-15846 Exim mail server flaw allows Remote Code Execution
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-10149 | Unvalidated Email Recipient Enables Remote Command Execution in Exim MTA CVE-2019-10149 is an improper input validation flaw (CWE-78, OS command injection) in the deliver_message() function in /src/deliver.c of the Exim mail transfer agent, where email recipient addresses are not safely validated before use. A remote attacker triggers it by sending mail whose recipient address contains crafted Exim string-expansion syntax (such as ${run{...}}), causing Exim to expand and execute attacker-supplied operating-system commands during recipient verification or delivery. An attacker gains arbitrary remote command execution on the mail server, commonly with elevated privileges, enabling full system compromise, data theft, ransomware deployment (e.g., the Trinity ransomware campaign), or installation of botnet implants. Any organization running an internet-exposed Exim MTA in the affected version range is at risk, and Exim is widely deployed as the default mail server on many Linux distributions. Exploitation is confirmed in the wild: mass scanning and compromise campaigns began shortly after the June 2019 disclosure, CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2022-01-10, and its EPSS score of 100% (100th percentile) reflects near-certain near-term exploitation risk. Do: Upgrade Exim to 4.92 or later, or install your distribution's patched Exim package, as required by CISA's KEV action ('apply updates per vendor instructions'); if patching must be delayed, restrict internet-facing SMTP access and tighten recipient-verification configuration. Check mail logs for suspicious MAIL FROM/RCPT TO addresses containing expansion syntax such as ${run{...}} or shell-like commands, and audit patched servers for post-compromise artifacts such as unusual cron jobs, downloaded binaries, or new authorized SSH keys. | 9.8 | 100% | KEV PoC ×5 |
| mass≈500,000+ internet-exposed Exim SMTP servers, with hundreds of thousands likely running vulnerable versions | |
| CVE-2019-15846 | Exim before 4.92.2 allows remote attackers to execute arbitrary code as root via a trailing backslash. Exim before 4.92.2 allows remote attackers to execute arbitrary code as root via a trailing backslash. NVD description · AI analysis pending | 9.8 | 36% |
| — |
Full article430 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
September 06, 2019
A security flaw in Exim mail servers could be exploited by local or remote attackers to execute arbitrary code with root privileges.
The Exim development team has addressed a vulnerability in Exim mail server, tracked as CVE-2019-15846, that could be exploited by local and remote attackers to execute arbitrary code with root privileges.
The vulnerability is a heap overflow that affects version 4.92.1 and prior of Exim mail server that accept TLS connections. The vulnerability affects both GnuTLS and OpenSSL.
“A local or remote attacker can execute programs with root privileges.” reads the security advisory.
According to Shodan, over 5 million Exim mail servers are exposed on the Internet, most of them the United States.
According to Exim developers, the flaw could be exploited by an attacker sending a SNI ending in a backslash-null sequence during the initial TLS handshake.
“If your Exim server accepts TLS connections, it is vulnerable. This does not depend on the TLS libray, so both, GnuTLS and OpenSSL are affected.” reads the advisory.
“The vulnerability is exploitable by sending a SNI ending in a backslash-null sequence during the initial TLS handshake,”
Developers confirmed that the exploit exists as a POC, but pointed out that they are not aware of attacks in the wild that exploited the issue.
Researchers from Qualys have developed a proof-of-concept (PoC) exploit code for the flaw.
Below the timeline of the vulnerability:
- 2019-07-21 – Report from Zerons to [email protected] / Analysis by Qualys /Fix and tests
- 2019-09-02 – CVE assigned
- 2019-09-03 – Details to [email protected], [email protected] / Grant access to the security repo
- 2019-09-04 – Heads-Up to [email protected], [email protected]
- 2019-09-06 – 10.00 UTC Coordinated Release Date / Disclosure to oss-security, exim-users, public repositories
Possible mitigation consists of configuring the server to not accept TLS connections, but it is not recommended or adding rules to the access control list (ACL).
In June, security experts reported that millions of mail servers running vulnerable Exim mail transfer agent (MTA) versions were under attack, threat actors were exploiting the CVE-2019-10149 flaw to take over them.
The critical vulnerability affected versions 4.87 to 4.91 of the Exim mail transfer agent (MTA) software. The flaw could be exploited by unauthenticated remote attackers to execute arbitrary commands on mail servers for some non-default server configurations.
A few days later, malware researchers at Cybaze-Yoroi ZLAB observed many attack attempts trying to spread malware abusing the CVE-2019-10149 issue.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – Exim mail server, hacking)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/90893/hacking/exim-mail-server-flaw.html