Site icon WinCert

400,000 Exim servers at risk

<h5>A bug was discovered in a widely used e-mail program that puts more than 400K servers at risk&period;<&sol;h5>&NewLine;<p><a href&equals;"https&colon;&sol;&sol;www&period;wincert&period;net&sol;wp-content&sol;uploads&sol;2017&sol;09&sol;computer&lowbar;attacker&period;jpg"><img class&equals;"alignnone wp-image-2275 size-full" title&equals;"exim" src&equals;"https&colon;&sol;&sol;www&period;wincert&period;net&sol;wp-content&sol;uploads&sol;2017&sol;09&sol;computer&lowbar;attacker&period;jpg" alt&equals;"ccleaner&semi; badrabbit&semi; exim" width&equals;"640" height&equals;"423" &sol;><&sol;a><&sol;p>&NewLine;<p>The flaw has been related to the <strong>Exim<&sol;strong>&comma; a widely used message transfer agent&period; All of the servers running Exim and are not using the latest <strong>4&period;90&period;1<&sol;strong> version are at risk&period; Without the applied patch&comma; servers are vulnerable to malicious code execution&period; An attacker may send a specially manipulated code to a server running Exim thus allowing the hacker to execute the code remotely&period;<&sol;p>&NewLine;<p>The DevCore team has published an <a href&equals;"https&colon;&sol;&sol;devco&period;re&sol;blog&sol;2018&sol;03&sol;06&sol;exim-off-by-one-RCE-exploiting-CVE-2018-6789-en&sol;">advisory<&sol;a> regarding this buffer overflow vulnerability which has been indexed as CVE-2018-6789&period;<&sol;p>&NewLine;<p>The researchers from DevCore wrote that a single byte of data from an exploit overwrites some critical data when the string fits some specific length&period;<&sol;p>&NewLine;<blockquote><p>&&num;8220&semi;In addition&comma; this byte is controllable&comma; which makes exploitation more feasible&period; Base64 decoding is such a fundamental function&comma; and therefore this bug can be triggered easily&comma; causing remote code execution&period; Currently&comma; we&&num;8217&semi;re unsure about the severity&&num;8221&semi; of the vulnerability&period; &&num;8220&semi;We &ast;believe&ast; an exploit is difficult&period; A mitigation isn&&num;8217&semi;t known&period;&&num;8221&semi;<&sol;p><&sol;blockquote>&NewLine;<p>DevCore warned that a large number of servers are still running vulnerable versions of Exim email program even though the Exim developers have published a fix back on February 10&period;<&sol;p>&NewLine;

Exit mobile version