Exim issues email server update, mitigations for 6 zero-day vulnerabilities

Network administrators with Exim Main Transfer Agent email servers in their environments are being urged to update their servers today or apply mitigations to close six zero-day vulnerabilities.

The security release, exim-4.96.1, is being published today. “This is a security release,” says Exim on its website. “You should upgrade as soon as possible.”

“All versions of Exim previous to version 4.96.1 are now obsolete,” it adds.

This comes after Trend Micro’s Zero Day Initiative warned last week that the developers hadn’t responded to its alert 14 months ago about a critical vulnerability that allows remote attackers without authentication to execute arbitrary code on a server.

The vulnerability, CVE-2023-42115, has a score of 9.8.

“The specific flaw exists within the smtp service,” says Trend Micro, “which listens on TCP port 25 by default. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of a buffer. An attacker can leverage this vulnerability to execute code in the context of the service account.”

The vulnerability was reported to Exim on June 14, 2022. After getting no response as to when the hole would be closed, Trend Micro decided to publish its finding. At the time it said the only mitigation is for administrators to block any remote access to Exim servers.

The update issued today also addresses
— an SMTP challenge stack-based buffer overflow (CVE-2023-42116), with a CVSS score of 8.1;

— an NTLM challenge out-of-bounds read (CVE-2023-42114), with a CVSS score of 3.7;

Not addressed in the patches are these three vulnerabilities:
— an improper neutralization of special elements issue (CVE-2023-42117).
Exim says this can be mitigated by not using the application behind an untrusted proxy-protocol proxy;
— a dnsdb out-of-bounds read issue (CVE-2023-42219) with a CVSS Score of 3.1.
Exim says this can be mitigated by using a trustworthy DNS resolver that is able to validate the data according to the DNS record types;
— a libspf2 Integer Underflow (CVE-2023-42118) with a CVSS score of 7.5
To mitigate Exim says administrators shouldn’t use the `spf` condition in an access control list (ACL).