Mail servers running the Mail Transfer Agent (MTA) Exim are vulnerable. According to security researchers from Qualys, attackers could target 21 vulnerabilities and gain full control over servers after successful attacks. A version that is protected against such attacks is available.
Exim is widespread and is used on millions of mail servers around the world. According to the Shodan search engine, around 4 million Exim servers are currently accessible via the Internet. That makes them an easy target.
The security researchers have christened their discoveries 21Nails and that wrote a blog post. According to them, some holes are related to the threat levelcritical“How many that are specifically, is not clear from the contribution.
Install the security update quickly
Ten of the gaps should be exploitable remotely. In many cases, attackers could trigger memory errors by sending certain requests and then execute malicious code with root rights. In such a case, servers are generally considered to be completely compromised.
According to the security researchers, attackers could combine several vulnerabilities in order to be able to access servers without authentication with root rights. In a detailed report, the security researchers reveal details of the 21 security vulnerabilities and what possible attacks might look like.
Admins should react immediately and use the version protected against the attacks described Exim 4.94.2 to install. According to the security researchers, all previous editions are vulnerable. This is often the case in the standard settings. A security vulnerability (CVE-2020-28017) is said to affect all Exim versions from 2004 onwards.