A still unpatched zero-day RCE impacts more than 3.5M Exim servers

Experts warn of a critical zero-day vulnerability, tracked as CVE-2023-42115, in all versions of Exim mail transfer agent (MTA) software.

A critical zero-day vulnerability, tracked as CVE-2023-42115 (CVSS score 9.8), affects all versions of Exim mail transfer agent (MTA) software. A remote, unauthenticated attacker, can exploit the vulnerability to gain remote code execution (RCE) on Internet-exposed servers.

The flaw is due to an Out-of-bounds Write issue that resides in the SMTP service, it is caused by the lack of proper validation of user-supplied data.

“This vulnerability allows remote attackers to execute arbitrary code on affected installations of Exim. Authentication is not required to exploit this vulnerability.” reads the advisory published by Trend Micro’s Zero Day Initiative (ZDI). “The specific flaw exists within the smtp service, which listens on TCP port 25 by default. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of a buffer. An attacker can leverage this vulnerability to execute code in the context of the service account.”

An anonymous researcher disclosed the flaw through the ZDI on June 6, 2022, and ZDI reported the vulnerability to the vendor on June 14, 2022.

On September 25, 2023, ZDI asked for an update and informed the vendor that they intend to publicly disclose the zero-day on September 27, 2023.

The vulnerability has yet to be addressed by the development team, and more than one year has passed.

Bleeping Computer reported that more than 3.5 million Exim servers are exposed online.

The only way to mitigate the risk of exploitation for the above issue, is to restrict interaction with the application.

“Given the nature of the vulnerability, the only salient mitigation strategy is to restrict interaction with the application,” concludes ZDI.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Exim mail transfer)

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.