By using this site, you agree to the Privacy Policy and Terms of Use.
Accept
10alert.com10alert.com10alert.com
  • Threats
    • WordPress ThreatsDanger
    Threats
    A cyber or cybersecurity threat is a malicious act that seeks to damage data, steal data, or disrupt digital life in general. Cyber threats include…
    Show More
    Top News
    Man-in-the-Disk: A new and dangerous way to hack Android
    12 months ago
    Microsoft Issues New Windows 10 Update Warning
    11 months ago
    How to enable TPM and Secure Boot on Hyper-V to install Windows 11 on VM
    12 months ago
    Latest News
    Wordfence Intelligence Weekly WordPress Vulnerability Report (September 11, 2023 to September 17, 2023)
    5 days ago
    Exploring Winrar Vulnerability (CVE-2023-38831) | McAfee Blog
    6 days ago
    Two PHP Object Injection Vulnerabilities Fixed in Essential Blocks
    7 days ago
    Agent Tesla’s Unique Approach: VBS and Steganography for Delivery and Intrusion
    1 week ago
  • Fix
    Fix
    Troubleshooting guide you need when errors, bugs or technical glitches might ruin your digital experience.
    Show More
    Top News
    Missing Sum at Bottom Right Corner in excell (FIX)
    12 months ago
    Windows 10 build 19044.1889 (KB5016616) outs for 21H2, 21H1, 20H2
    12 months ago
    How to reset Windows Update on Windows 11
    12 months ago
    Latest News
    How automatically delete unused files from my Downloads folder?
    7 months ago
    Now you can speed up any video in your browser
    7 months ago
    How to restore access to a file after EFS or view it on another computer?
    8 months ago
    18 Proven Tips to Speed Up Your WordPress Site and Improve SEO | 2023 Guide
    8 months ago
  • How To
    How ToShow More
    Switching to Cloudflare can cut your network carbon emissions up to 96% (and we’re joining the SBTi)
    Switching to Cloudflare can cut your network carbon emissions up to 96% (and we’re joining the SBTi)
    16 hours ago
    Cloudflare account permissions, how to use them, and best practices
    Cloudflare account permissions, how to use them, and best practices
    16 hours ago
    Announcing Cloudflare Incident Alerts
    Announcing Cloudflare Incident Alerts
    16 hours ago
    Welcome to Birthday Week 2023
    Welcome to Birthday Week 2023
    2 days ago
    A new wave of innovation with Edge, your AI-powered browser
    3 days ago
  • News
    News
    This category of resources includes the latest technology news and updates, covering a wide range of topics and innovations in the tech industry. From new…
    Show More
    Top News
    Tolerant Easter egg on Google
    11 months ago
    Cloning Apps on Android
    11 months ago
    How to delete system error memory dump files in Windows 10?
    11 months ago
    Latest News
    How to use image layers on Paint for Windows 11
    6 days ago
    How to disable Copilot on Windows 11 (completely)
    2 weeks ago
    How to blur image background in Photos for Windows 11
    2 weeks ago
    How to hide text from screenshots on Snipping Tool for Windows 11
    2 weeks ago
  • Glossary
  • My Bookmarks
Reading: Millions servers affected by Exim software
Share
Notification Show More
Aa
Aa
10alert.com10alert.com
  • Threats
  • Fix
  • How To
  • News
  • Glossary
  • My Bookmarks
  • Threats
    • WordPress ThreatsDanger
  • Fix
  • How To
  • News
  • Glossary
  • My Bookmarks
Follow US
News

Millions servers affected by Exim software

Tom Grant
Last updated: 10 October
Tom Grant 4 years ago
Share
3 Min Read

Millions of Internet-connected machines running the open source Exim mail server may be vulnerable to a newly disclosed vulnerability that, in some cases, allows unauthenticated attackers to execute commands with all-powerful root privileges.

The flaw, which dates back to version 4.87 released in April 2016, is trivially exploitable by local users with a low-privileged account on a vulnerable system running with default settings. All that’s required is for the person to send an email to ${run{...}}@localhost, where localhost is an existing local domain on a vulnerable Exim installation. With that, attackers can execute commands of their choice that run with root privileges.

The command execution flaw is also exploitable remotely, albeit with some restrictions. The most likely scenario for remote exploits is when default settings have been made such as:

  • The verify = recipient is removed manually by an administrator, possibly to prevent username enumeration using RCPT TO functions. In such a case, the local exploitation method above works.
  • Exim is configured to recognize tags in the local part of a recipient’s address (through local_part_suffix = +* : -* for example). Attackers can exploit the vulnerability by reusing the local exploit method with an RCPT TO balrog+${run{...}}@localhost (where balrog is the name of a local user).
  • Exim is configured to relay mail to a remote domain, as a secondary MX. A remote attacker can reuse the local-exploitation method with an RCPT TO ${run{...}}@khazad.dum where khazad.dum is one of Exim’s relay_to_domains.

The vulnerability is also remotely exploitable against default Exim setups, although an attacker first must keep a connection to the vulnerable server open for seven days, by transmitting one byte every few minutes. Researchers from Qualys, the security firm that discovered the vulnerability, didn’t rule out other, simpler and more practical ways to remotely exploit default setups. This vulnerability is trivially exploitable in the local and non-default cases (attackers will have working exploits before that, public or not), Qualys researchers wrote in an advisory published on Wednesday. And in the default case, a remote attack takes a long time to succeed (to the best of our knowledge).

The vulnerability, which is tracked as CVE-2019-10149, affects versions 4.87 through 4.91. The flaw was fixed in version 4.92, which was released in February. But it was never identified as a vulnerability. What’s more, many distributions of Linux have continued to ship with vulnerable Exim versions.

A search on BinaryEdge (a service that indexes Internet-connected devices) showed that more than 4.7 million machines are running a vulnerable Exim version. It’s a good bet that a non-trivial percentage of these machines are susceptible to the attacks. Updates to version 4.92 are available here.

source: arstechnica.com


Translate this article

TAGGED: Linux, Security
Tom Grant October 10, 2022 September 30, 2019
Share This Article
Facebook Twitter Reddit Telegram Email Copy Link Print

STAY CONECTED

24.8k Followers Like
253.9k Followers Follow
33.7k Subscribers Subscribe
124.8k Members Follow

LAST 10 ALERT

Switching to Cloudflare can cut your network carbon emissions up to 96% (and we’re joining the SBTi)
Switching to Cloudflare can cut your network carbon emissions up to 96% (and we’re joining the SBTi)
Apps 16 hours ago
Cloudflare account permissions, how to use them, and best practices
Cloudflare account permissions, how to use them, and best practices
Apps 16 hours ago
Announcing Cloudflare Incident Alerts
Announcing Cloudflare Incident Alerts
Apps 16 hours ago
Welcome to Birthday Week 2023
Welcome to Birthday Week 2023
Apps 2 days ago
A new wave of innovation with Edge, your AI-powered browser
Windows 3 days ago

You Might Also Like

Switching to Cloudflare can cut your network carbon emissions up to 96% (and we’re joining the SBTi)
Apps

Switching to Cloudflare can cut your network carbon emissions up to 96% (and we’re joining the SBTi)

16 hours ago
Cloudflare account permissions, how to use them, and best practices
Apps

Cloudflare account permissions, how to use them, and best practices

16 hours ago
Windows

A new wave of innovation with Edge, your AI-powered browser

3 days ago
Cloudflare Email Security now works with CrowdStrike Falcon LogScale
Apps

Cloudflare Email Security now works with CrowdStrike Falcon LogScale

5 days ago
Show More

Related stories

How to upgrade to Windows 11 23H2 with Installation Assistant
Critical Vulnerability in Forminator Plugin
How to blur image background in Photos for Windows 11
How to download official Windows 11 23H2 ISO file
PHP Object Injection Vulnerability in Flatsome Theme
How to download Windows 11 22H2 ISO after 23H2 releases
Previous Next

10 New Stories

Curator can help you with PC Game Pass picks
Cloudflare Email Security now works with CrowdStrike Falcon LogScale
Wordfence Intelligence Weekly WordPress Vulnerability Report (September 11, 2023 to September 17, 2023)
Exploring Winrar Vulnerability (CVE-2023-38831) | McAfee Blog
How to use image layers on Paint for Windows 11
New! Rate Limiting analytics and throttling
Previous Next
Hot News
Switching to Cloudflare can cut your network carbon emissions up to 96% (and we’re joining the SBTi)
Cloudflare account permissions, how to use them, and best practices
Announcing Cloudflare Incident Alerts
Welcome to Birthday Week 2023
A new wave of innovation with Edge, your AI-powered browser
10alert.com10alert.com
Follow US
© 10 Alert Network. All Rights Reserved.
  • Privacy Policy
  • Contact
  • Customize Interests
  • My Bookmarks
  • Glossary
Go to mobile version
adbanner
AdBlock Detected
Our site is an advertising supported site. Please whitelist to support our site.
Okay, I'll Whitelist
Welcome Back!

Sign in to your account

Lost your password?