Horizon Alert
Summary of the vulnerability and why it matters
This vulnerability in Exim, a mail server software, allows an unauthenticated attacker to execute arbitrary code. It stems from how the software handles specific TLS configurations and data transfers, potentially leading to memory corruption that can be exploited over the network.
- Network attackers can exploit this.
- It could lead to complete system compromise.
- This is a critical vulnerability.
Attack Path
How an attacker could exploit the issue
An unauthenticated network attacker can trigger a use-after-free in Exim's BDAT body parsing when GnuTLS is configured. This happens by sending a specific sequence of TLS and cleartext messages during a CHUNKING transfer, leading to heap corruption and potential arbitrary code execution.
- Network access required.
- Targeted vulnerable Exim TLS configurations.
- Client sends TLS close_notify mid-body.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability is likely to be weaponized because Exim is a common mail server, and this flaw allows for unauthenticated remote code execution. Attackers favor such vulnerabilities as they grant direct control over critical infrastructure with minimal effort.
- Public exploit code is available.
- Vendor notes recent security disclosures.
- Exploitation is possible over the network.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize immediate patching of Exim to version 4.99.3 or later to address the critical use-after-free vulnerability. If immediate patching is not feasible, isolate affected Exim servers from untrusted networks or implement strict firewall rules to block all incoming traffic on the SMTP port (25) until mitigation can be applied. Monitor logs for any signs of exploitation attempts or unusual activity on affected systems.
- Patch Exim to 4.99.3+.
- Isolate or firewall affected systems.
- Monitor for exploitation.
