Exim TLS Flaw Opens Email Servers to Remote ‘Root’ Code Execution Attacks

Exim maintainers today released Exim version 4.92.2 after
publishing an early warning two days ago, giving system
administrators a heads-up^[1] on its upcoming security
patches that affect all versions of the email server software up to
and including then-latest 4.92.1.

Exim is a widely used, open source mail transfer agent (MTA)
software developed for Unix-like operating systems such as Linux,
Mac OSX or Solaris, which runs almost 60% of the internet’s email
servers today for routing, delivering and receiving email
messages.

Tracked as CVE-2019-15846, the
security vulnerability only affects Exim servers that accept TLS
connections, potentially allowing attackers to gain root-level
access to the system “by sending an SNI ending in a backslash-null
sequence during the initial TLS handshake.”

SNI, stands for Server Name Indication, is an extension of the
TLS protocol that allows the server to safely host multiple TLS
certificates for multiple sites, all under a single IP address.

According to the Exim team, since the vulnerability doesn’t
depend on the TLS library being used by the server, both GnuTLS and
OpenSSL are affected.

Moreover, though the default configuration of the Exim mail
server software doesn’t come with TLS enabled, some operating
systems bundled the Exim software with the vulnerable feature
enabled by default.

The vulnerability was discovered by an open source contributor
and security researcher who goes by the online alias Zerons and
analyzed by cybersecurity experts at Qualys.

Just three months ago, Exim also patched a severe remote command
execution vulnerability, tracked as CVE-2019-10149, that was
actively exploited in the wild by various groups of hackers to
compromise vulnerable servers.

The Exim advisory says that a rudimentary proof of concept (PoC)
exists for this flaw, but currently there is no known exploit
available to the public.

Server administrators are highly recommended to install the
latest Exim 4.92.2 version immediately, and if not possible, can
mitigate the issue by not allowing unpatched Exim servers to accept
TLS connections.

The team says, “If you can’t install the above versions, ask
your package maintainer for a version containing the backported
fix. On request and depending on our resources we will support you
in backporting the fix.”

^[2]