Serious vulnerabilities in the widely used Exim message transfer agent (MTA) software have left hundreds of thousands of systems susceptible to remote code execution (RCE).
Exim mail servers worldwide require immediate patching Due to its role in handling email, Exim is often exposed to the internet, making it a prime target for exploitation when vulnerabilities are present.
As of October 1, there were over 300,000 Exim servers publicly accessible on the internet, according to a regular Securityspace survey.
One of the vulnerabilities, identified as CVE-2023-42115, affects Exim’s simple mail transfer protocol (SMTP) service, which operates on TCP port 25. This bug allows attackers to write data beyond the end of a buffer. Exploiting this vulnerability grants unauthenticated remote attackers the ability to execute code within the context of the SMTP service, resulting in a critical CVSS score of 9.8.
The bug was reported through the Zero Day Initiative as one of six zero-day vulnerabilities disclosed through the program.
Additionally, two high-severity bugs were identified (CVSS score of 8.1): CVE-2023-42116, a buffer overflow in Exim’s SMTP challenge component, and CVE-2023-42117, a memory corruption bug in the SMTP service that also enables remote code execution by an attacker.
Patches have been released for three of these vulnerabilities, with Exim’s maintainers preparing to address them. However, further information is required for the remaining issues, as stated in a post on the oss-sec mailing list by Heiko Schlittermann.
Exim previously required urgent patching in 2019, with updates released in June and October. In 2020, the United States National Security Agency (NSA) warned that the MTA was under attack from the Russian hacking operation known as Sandworm.
