On February 10, the Unix-based email server Exim released an update to address a heap buffer overflow vulnerability that can be used by an unauthenticated attacker to remotely execute arbitrary code. The flaw, assigned CVE-2018-6789, is noted to exist in all versions of Exim, prior to their latest release, 4.90.1, which means the attack surface potential is very wide. A quick search on Shodan yields more than 6 million results.
Vulnerability details
The vulnerability was originally discovered by DEVCORE, and details were published on their blog on March 6. The vulnerability is due to a flaw in the b64decode buffer length in the base64d() function. Due to an off-by-one calculation mistake, heap memory can be overwritten when parsing an invalid base64 string leading to critical data being overwritten.
As base64 decoding is a widely used function, and since the byte is user-controlled, this increases the ease of exploitation, which can be utilized for remote code execution.
Identifying affected systems
To detect systems affected by this critical flaw, Tenable has released Nessus® plugins for Tenable.io Vulnerability Management, SecurityCenter and Nessus Pro. Additionally, Tenable has released passive detection via Nessus Network Monitor, which may be used with Tenable.io Vulnerability Management to detect the vulnerability passively on the network. Tenable.io Container Security has also been updated to detect the Exim off-by-one RCE vulnerability in Docker container images. The following table summarizes Tenable's coverage.
Cisco has updated the advisory several times since the initial release to reflect the affected vectors as well as to make corrections to the patch versions. Tenable continues to monitor this situation and update our coverage as necessary.
Plugin ID | Description |
107149 | Exim < 4.90.1 Buffer Overflow RCE Vulnerability |
700223 (Nessus Network Monitor) | Exim < 4.90.1 Remote Code Execution |
106722 | Debian DLA-1274-1 : exim4 security update |
106728 | Debian DSA-4110-1 : exim4 - security update |
107007 | Fedora 26 : exim (2018-25a7ba3cb6) |
107009 | Fedora 27 : exim (2018-5aec14e125) |
106733 | FreeBSD : exim -- a buffer overflow vulnerability, remote code execution (316b3c3e-0e98-11e8-8d41-97657151f8c2) |
106888 | openSUSE Security Update : exim (openSUSE-2018-170) |
106791 | Ubuntu 14.04 LTS / 16.04 LTS / 17.10 : exim4 vulnerability (USN-3565-1) |
107178 | GLSA-201803-01 : Exim: Multiple vulnerabilities |
What should you do?
If you’re running a version of Exim prior to 4.90.1, make sure you update to the most current release. Exim notes that all versions of Exim prior to 4.90.1 are now obsolete and that 3.x releases are also obsolete and should not be used.
Get more information
- Learn more about Tenable.io, the first Cyber Exposure platform for holistic management of your modern attack surface
- Get a free 60-day trial of Tenable.io Vulnerability Management
- DEVCORE blog details
- Exim ChangeLog
- Exim CVE-2018-6789 Advisory