Exim issues email server update, mitigations for 6 zero-day vulnerabilities

Share post:

Network administrators with Exim Main Transfer Agent email servers in their environments are being urged to update their servers today or apply mitigations to close six zero-day vulnerabilities.

The security release, exim-4.96.1, is being published today. “This is a security release,” says Exim on its website. “You should upgrade as soon as possible.”

“All versions of Exim previous to version 4.96.1 are now obsolete,” it adds.

This comes after Trend Micro’s Zero Day Initiative warned last week that the developers hadn’t responded to its alert 14 months ago about a critical vulnerability that allows remote attackers without authentication to execute arbitrary code on a server.

The vulnerability, CVE-2023-42115, has a score of 9.8.

“The specific flaw exists within the smtp service,” says Trend Micro, “which listens on TCP port 25 by default. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of a buffer. An attacker can leverage this vulnerability to execute code in the context of the service account.”

The vulnerability was reported to Exim on June 14, 2022. After getting no response as to when the hole would be closed, Trend Micro decided to publish its finding. At the time it said the only mitigation is for administrators to block any remote access to Exim servers.

The update issued today also addresses
— an SMTP challenge stack-based buffer overflow (CVE-2023-42116), with a CVSS score of 8.1;

— an NTLM challenge out-of-bounds read (CVE-2023-42114), with a CVSS score of 3.7;

Not addressed in the patches are these three vulnerabilities:
— an improper neutralization of special elements issue (CVE-2023-42117).
Exim says this can be mitigated by not using the application behind an untrusted proxy-protocol proxy;
— a dnsdb out-of-bounds read issue (CVE-2023-42219) with a CVSS Score of 3.1.
Exim says this can be mitigated by using a trustworthy DNS resolver that is able to validate the data according to the DNS record types;
— a libspf2 Integer Underflow (CVE-2023-42118) with a CVSS score of 7.5
To mitigate Exim says administrators shouldn’t use the `spf` condition in an access control list (ACL).

The post Exim issues email server update, mitigations for 6 zero-day vulnerabilities first appeared on IT World Canada.
Howard Solomon
Howard Solomonhttps://www.itworldcanada.com
Currently a freelance writer, I'm the former editor of ITWorldCanada.com and Computing Canada. An IT journalist since 1997, I've written for ITBusiness.ca and Computer Dealer News. Before that I was a staff reporter at the Calgary Herald and the Brampton (Ont.) Daily Times.


Related articles

CrowdStrike update causes global IT outages, fix is available

Some airlines, banks and government services around the world have been affected by a faulty software update for...

Charges dismissed in SolarWinds hacking case

A judge has dismissed most of the Securities and Exchange Commission's (SEC) fraud charges against SolarWinds related to...

Canadian is among foreign nationals pleading guilty to involvement with Lockbit ransomware

Two foreign nationals have pleaded guilty in the US District of New Jersey to their involvement in the...

FBI rapidly hacks into Trump shooter’s phone, raises privacy concerns

Just two days after the attempted assassination at a Trump rally, the FBI announced it had gained access...

Become a member

New, Relevant Tech Stories. Our article selection is done by industry professionals. Our writers summarize them to give you the key takeaways