Exim issues email server update, mitigations for 6 zero-day vulnerabilities

Network administrators with Exim Main Transfer Agent email servers in their environments are being urged to update their servers today or apply mitigations to close six zero-day vulnerabilities.

The security release, exim-4.96.1, is being published today. “This is a security release,” says Exim on its website. “You should upgrade as soon as possible.”

“All versions of Exim previous to version 4.96.1 are now obsolete,” it adds.

This comes after Trend Micro’s Zero Day Initiative warned last week that the developers hadn’t responded to its alert 14 months ago about a critical vulnerability that allows remote attackers without authentication to execute arbitrary code on a server.

The vulnerability, CVE-2023-42115, has a score of 9.8.

“The specific flaw exists within the smtp service,” says Trend Micro, “which listens on TCP port 25 by default. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of a buffer. An attacker can leverage this vulnerability to execute code in the context of the service account.”

The vulnerability was reported to Exim on June 14, 2022. After getting no response as to when the hole would be closed, Trend Micro decided to publish its finding. At the time it said the only mitigation is for administrators to block any remote access to Exim servers.

The update issued today also addresses
— an SMTP challenge stack-based buffer overflow (CVE-2023-42116), with a CVSS score of 8.1;

— an NTLM challenge out-of-bounds read (CVE-2023-42114), with a CVSS score of 3.7;

Not addressed in the patches are these three vulnerabilities:
— an improper neutralization of special elements issue (CVE-2023-42117).
Exim says this can be mitigated by not using the application behind an untrusted proxy-protocol proxy;
— a dnsdb out-of-bounds read issue (CVE-2023-42219) with a CVSS Score of 3.1.
Exim says this can be mitigated by using a trustworthy DNS resolver that is able to validate the data according to the DNS record types;
— a libspf2 Integer Underflow (CVE-2023-42118) with a CVSS score of 7.5
To mitigate Exim says administrators shouldn’t use the `spf` condition in an access control list (ACL).

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

Howard Solomon
Howard Solomon
Currently a freelance writer, I'm the former editor of ITWorldCanada.com and Computing Canada. An IT journalist since 1997, I've written for several of ITWC's sister publications including ITBusiness.ca and Computer Dealer News. Before that I was a staff reporter at the Calgary Herald and the Brampton (Ont.) Daily Times. I can be reached at hsolomon [@] soloreporter.com

Related Tech News

Featured Tech Jobs


CDN in your inbox

CDN delivers a critical analysis of the competitive landscape detailing both the challenges and opportunities facing solution providers. CDN's email newsletter details the most important news and commentary from the channel.