Exim is a mail transfer agent (MTA) used on Unix-like operating systems. Exim is a free software distributed under the terms of the GNU General Public License, and it aims to be a general and flexible mailer with extensive facilities for checking incoming e-mail. Exim has been ported to most Unix-like systems, as well as to Microsoft Windows using the Cygwin emulation layer. Exim 4 is currently the default MTA on Debian Linux systems.
Many Exim installations exist, especially within Internet service providers and universities in the United Kingdom. Exim is also widely used with the GNU Mailman mailing list manager, and cPanel. In March 2023 a study performed by E-Soft, Inc., approximated that 56% out of a total of 602,000 of the publicly reachable mail-servers on the Internet ran Exim.
A critical flaw exists within the Simple Mail Transfer Protocol (SMTP) service, which listens on TCP port 25 by default. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of a buffer.
This vulnerability allows remote attackers to execute arbitrary code in the context of the service account on affected installations of Exim. Authentication is not required to exploit this vulnerability.
NOTE: Although this vulnerability was first reported on 2022-06-06, it has since been reported by the CISA (America’s Cyber Defense Agency) to be known to be currently actively exploited in the wild as of 2023-09-07. Prioritisation should be given to remediation in any impacted environment.
Customers are advised to upgrade to the latest version of Exim. As announced by Exim on the OpenWall security mailing list, a security update for exim-4.96.1 and 4.97 has been created that mitigates this critical vulnerability
Fixed versions and commits are : 7bb5bc2c6, 4.96.1, 4.97
NOTE: Remediation of this vulnerability by patching to a specific version indicated may not be sufficient to secure the product against further vulnerabilities discovered in later versions, subsequent to the publication of this guidance. Unless contra-indicated, customers are therefore advised to always upgrade to the latest version of the product available.
Mitigation: Do not offer EXTERNAL authentication.
NOTE: Caution should always be taken in applying any temporary mitigations listed. Mitigations are only recommended in cases where patches to remediate the vulnerability are not available, or cannot safely be applied to a given environment immediately. A given mitigation may not in all cases be recommended officially by the application vendor. The viability of any given temporary mitigation measure may vary, depending on server platform and existing configuration. Mitigations listed may incompletely remediate any given vulnerability. Configuration changes to implement listed mitigations may impact/disrupt required functionality within a given customer application. Care should therefore be taken to carefully analyse any listed mitigations for appropriateness to a given environment. Customers are advised to test any configuration changes prior to their being introduced into a production environment.
Category: Arbitrary Code Execution
AppCheck has added a plugin to detect the flaw that will run as part of your standard scans.
AppCheck is a software security vendor based in the UK, offering a leading security scanning platform that automates the discovery of security flaws within organisations websites, applications, network, and cloud infrastructure. AppCheck are authorized by the Common Vulnerabilities and Exposures (CVE) Program as a CVE Numbering Authority (CNA).
No software to download or install.
Contact us or call us 0113 887 8380
AppCheck is a software security vendor based in the UK, offering a leading security scanning platform that automates the discovery of security flaws within organisations websites, applications, network and cloud infrastructure. AppCheck are authorised by the Common Vulnerabilities and Exposures (CVE) Program as a CVE Numbering Authority (CNA)
