CIS Logo
tagline: Confidence in the Connected World

A Vulnerability in Exim Could Allow for Remote Command Execution

MS-ISAC ADVISORY NUMBER:

2019-090

DATE(S) ISSUED:

09/06/2019

OVERVIEW:

A vulnerability has been discovered in Exim, which could allow for unauthenticated remote attackers to execute arbitrary system commands when initiating TLS connections to affected mail servers. Local attackers can take advantage of this vulnerability as well through similar means. Exim is a mail transfer agent used to deploy mail servers on Unix-like systems. Successful exploitation of this vulnerability will enable the attacker to perform command execution as root in the context of the mail server. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

THREAT INTELLIGENCE:

Qualys researchers have analyzed the PoC exploit that triggers this vulnerability. However, the PoC exploit has not yet been made public. This vulnerability does not affect the latest version, Exim 4.92.2.

SYSTEMS AFFECTED:

  • Exim versions prior to 4.92.2

RISK:

Government:
  • Large and medium government entities: HIGH
  • Small government entities: MEDIUM
Businesses:
  • Large and medium business entities: HIGH
  • Small business entities: MEDIUM
Home Users:
LOW

TECHNICAL SUMMARY:

A vulnerability has been discovered in Exim, which could allow for both local and unauthenticated remote attackers to execute arbitrary system commands when initiating a TLS handshake with mail server.

This vulnerability exists due to a buffer overflow vulnerability within the SMTP Delivery process of the mail servers default runtime configuration. A buffer overflow condition may occur when a local or unauthenticated remote user sends a crafted Server Name Indication (SNI) ending in a backslash-null sequence during the initial TLS handshake. Depending on the servers configuration, this vulnerability is also exploitable through sending a crafted client TLS certificate.

Successful exploitation of this vulnerability will enable the attacker to perform command execution as root in the context of the mail server. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

RECOMMENDATIONS:

We recommend the following actions be taken:

  • Apply appropriate patches provided by Exim to vulnerable systems immediately after appropriate testing
  • Verify no unauthorized system modifications have occurred on system before applying patch.
  • Apply the principle of Least Privilege to all systems and services.
  • Remind users not to open emails, download attachments, or follow links provided by unknown or untrusted sources.

REFERENCES:

Get Email Updates When Cyber Threats Like This Arise

Arrow Subscribe to Advisories

Related Resources



Arrow CIS Control 3: Continuous Vulnerability Assessment and Remediation

Information Hub : Advisories


CONTROL: 1 --- ADVISORY CONTROL: 0
CONTROL: 2 --- ADVISORY CONTROL: 0
CONTROL: 3 --- ADVISORY CONTROL: 0

Pencil White paper 18 Sep 2019
CONTROL: 4 --- ADVISORY CONTROL: 0