Millions servers affected by Exim software

Millions of Internet-connected machines running the open source Exim mail server may be vulnerable to a newly disclosed vulnerability that, in some cases, allows unauthenticated attackers to execute commands with all-powerful root privileges.

The flaw, which dates back to version 4.87 released in April 2016, is trivially exploitable by local users with a low-privileged account on a vulnerable system running with default settings. All that’s required is for the person to send an email to ${run{...}}@localhost, where localhost is an existing local domain on a vulnerable Exim installation. With that, attackers can execute commands of their choice that run with root privileges.

The command execution flaw is also exploitable remotely, albeit with some restrictions. The most likely scenario for remote exploits is when default settings have been made such as:

• The verify = recipient is removed manually by an administrator, possibly to prevent username enumeration using RCPT TO functions. In such a case, the local exploitation method above works.
• Exim is configured to recognize tags in the local part of a recipient’s address (through local\_part\_suffix = +\* : -\* for example). Attackers can exploit the vulnerability by reusing the local exploit method with an RCPT TO balrog+${run{...}}@localhost (where balrog is the name of a local user).
• Exim is configured to relay mail to a remote domain, as a secondary MX. A remote attacker can reuse the local-exploitation method with an RCPT TO ${run{...}}@khazad.dum where khazad.dum is one of Exim’s relay_to_domains.

The vulnerability is also remotely exploitable against default Exim setups, although an attacker first must keep a connection to the vulnerable server open for seven days, by transmitting one byte every few minutes. Researchers from Qualys, the security firm that discovered the vulnerability, didn’t rule out other, simpler and more practical ways to remotely exploit default setups.

source: arstechnica.com