Install patches quickly. Exim causes 0.4 million servers to face severe code execution vulnerabilities.

Install patches quickly. Exim causes 0.4 million servers to face severe code execution vulnerabilities.

An unknown but widely used email program Exim vulnerability may expose up to 0.4 million of servers around the world to severe attacks until they install updates.

Exim is one of the email MTA services available for Ubuntu, and Exim4 is the default setting for Debian. Exim stands for the experimental Internet Mailer, developed for Unix systems at the University of Cambridge in 1995 as a substitute for Sendmail.

Researchers reported in a report released on Tuesday that the vulnerability, except version 4.90.1, can execute malicious code in all versions. The buffer overflow vulnerability is indexed as a CVE-2018-6789 and is located in a base64 decoded function. Attackers can remotely execute code by sending special operation input to the server running Exim.

Researchers at Devcore security consulting said, "the single-byte data produced by the vulnerability will overwrite some key data when the string is suitable for a specific length ". In addition, this byte is controllable, making development more feasible. Base64 decoding is a basic function, so this bug is easily triggered, resulting in remote code execution ."

As far as Exim is concerned, Exim developers wrote in a report: "If some preconditions are met, base64d () will cause a buffer overflow. With manual messages, remote code execution seems possible. Currently, we are not sure about the severity of the vulnerability. We believe that the vulnerability is very difficult to exploit and the mitigation measures are unknown ."

Devcore researchers say as many as 0.4 million servers are at risk. Shodan's search engine found a large number of servers reporting vulnerabilities. On September 6, February 10, developers released the fix for version 4.90.1. Any organization that uses Exim should ensure that it uses the latest version.

This article permanently updates link: https://www.bkjia.com/Linux/2018-03/151249.htm