Exim issues email server update, mitigations for 6 zero-day vulnerabilities

Share post:

Network administrators with Exim Main Transfer Agent email servers in their environments are being urged to update their servers today or apply mitigations to close six zero-day vulnerabilities.

The security release, exim-4.96.1, is being published today. “This is a security release,” says Exim on its website. “You should upgrade as soon as possible.”

“All versions of Exim previous to version 4.96.1 are now obsolete,” it adds.

This comes after Trend Micro’s Zero Day Initiative warned last week that the developers hadn’t responded to its alert 14 months ago about a critical vulnerability that allows remote attackers without authentication to execute arbitrary code on a server.

The vulnerability, CVE-2023-42115, has a score of 9.8.

“The specific flaw exists within the smtp service,” says Trend Micro, “which listens on TCP port 25 by default. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of a buffer. An attacker can leverage this vulnerability to execute code in the context of the service account.”

The vulnerability was reported to Exim on June 14, 2022. After getting no response as to when the hole would be closed, Trend Micro decided to publish its finding. At the time it said the only mitigation is for administrators to block any remote access to Exim servers.

The update issued today also addresses
— an SMTP challenge stack-based buffer overflow (CVE-2023-42116), with a CVSS score of 8.1;

— an NTLM challenge out-of-bounds read (CVE-2023-42114), with a CVSS score of 3.7;

Not addressed in the patches are these three vulnerabilities:
— an improper neutralization of special elements issue (CVE-2023-42117).
Exim says this can be mitigated by not using the application behind an untrusted proxy-protocol proxy;
— a dnsdb out-of-bounds read issue (CVE-2023-42219) with a CVSS Score of 3.1.
Exim says this can be mitigated by using a trustworthy DNS resolver that is able to validate the data according to the DNS record types;
— a libspf2 Integer Underflow (CVE-2023-42118) with a CVSS score of 7.5
To mitigate Exim says administrators shouldn’t use the `spf` condition in an access control list (ACL).

The post Exim issues email server update, mitigations for 6 zero-day vulnerabilities first appeared on IT World Canada.
Howard Solomon
Howard Solomonhttps://www.itworldcanada.com
Currently a freelance writer, I'm the former editor of ITWorldCanada.com and Computing Canada. An IT journalist since 1997, I've written for several of ITWC's sister publications including ITBusiness.ca and Computer Dealer News. Before that I was a staff reporter at the Calgary Herald and the Brampton (Ont.) Daily Times.

Featured Tech Jobs


Related articles

Cyber Security Today, Week in Review for week ending Friday, Feb. 23, 2024

This episode features discussion on the takedown of the LockBit ransomware gang

Breaking news: RCMP facing ‘alarming’ cyber attack

The RCMP is facing a serious cyber attack from an unspecified threat actor. The Mounties told CBC News today that a “breach of this magnitude is alarming.” “The situation is evolving quickly but at this time, there is no impact on RCMP operations and no known threat to the safety and security of Canadians,” a spokesperson

Leaked documents may show the inside of China’s hacking strategy

Documents apparently stolen by disgruntled employees to embarrass their firm may give insight into China's cyber

Become a member

New, Relevant Tech Stories. Our article selection is done by industry professionals. Our writers summarize them to give you the key takeaways