Millions of Internet-connected machines running the open source Exim mail server may be vulnerable to a newly disclosed vulnerability that, in some cases, allows unauthenticated attackers to execute commands with all-powerful root privileges.
The flaw, which dates back to version 4.87 released in April 2016, is trivially exploitable by local users with a low-privileged account on a vulnerable system running with default settings.
The command execution flaw is also exploitable remotely, albeit with some restrictions. The most likely scenario for remote exploits is when default settings have been made such as:
The vulnerability is also remotely exploitable against default Exim setups, although an attacker first must keep a connection to the vulnerable server open for seven days, by transmitting one byte every few minutes. Researchers from Qualys, the security firm that discovered the vulnerability, didn’t rule out other, simpler and more practical ways to remotely exploit default setups.
“This vulnerability is trivially exploitable in the local and non-default cases (attackers will have working exploits before that, public or not),” Qualys researchers wrote in an advisory published on Wednesday. “And in the default case, a remote attack takes a long time to succeed (to the best of our knowledge).”
The vulnerability, which is tracked as CVE-2019-10149, affects versions 4.87 through 4.91. The flaw was fixed in version 4.92, which was released in February. But it was never identified as a vulnerability. What’s more, many distributions of Linux have continued to ship with vulnerable Exim versions.
A search on BinaryEdge (a service that indexes Internet-connected devices) showed that more than 4.7 million machines are running a vulnerable Exim version. It’s a good bet that a non-trivial percentage of these machines are susceptible to the attacks. Updates to version 4.92 are available here.
