Overview:

A recent disclosure has unveiled multiple security vulnerabilities in the Exim mail transfer agent, posing potential risks of information disclosure and Remote Code Execution. These flaws, reported anonymously in June 2022, demand immediate attention to secure affected systems.

Vulnerability Breakdown:

CVE-2023-42114 – Exim NTLM Challenge Out-Of-Bounds Read Information Disclosure Vulnerability

• Issue: Out-of-bounds read vulnerability in Exim NTLM Challenge.
• Risk: Information disclosure.
• Severity: CVSS score of 3.7.

CVE-2023-42115 – Exim AUTH Out-Of-Bounds Write Remote Code Execution Vulnerability

• Issue: Out-of-bounds write vulnerability in Exim AUTH.
• Risk: Remote code execution.
• Severity: CVSS score of 9.8.

CVE-2023-42116 – Exim SMTP Challenge Stack-based Buffer Overflow Remote Code Execution Vulnerability

• Issue: Stack-based buffer overflow in Exim SMTP Challenge.
• Risk: Remote code execution.
• Severity: CVSS score of 8.1.

CVE-2023-42117 – Exim Improper Neutralization of Special Elements Remote Code Execution Vulnerability

• Issue: Improper neutralization of special elements in Exim.
• Risk: Remote code execution.
• Severity: CVSS score of 8.1.

CVE-2023-42118 – Exim libspf2 Integer Underflow Remote Code Execution Vulnerability

• Issue: Integer underflow vulnerability in Exim libspf2.
• Risk: Remote code execution.
• Severity: CVSS score of 7.5.

CVE-2023-42119 – Exim dnsdb Out-Of-Bounds Read Information Disclosure Vulnerability

• Issue: Out-of-bounds read vulnerability in Exim dnsdb.
• Risk: Information disclosure.
• Severity: CVSS score of 3.1.

Expert Analysis:

The most critical vulnerability, CVE-2023-42115, empowers remote, unauthenticated attackers to execute arbitrary code within the service account context. The flaw resides in the SMTP service, defaulting to TCP port 25, where inadequate validation of user-supplied data allows a write past the end of a buffer.

Mitigation and Response:

Exim maintainers have addressed CVE-2023-42114, CVE-2023-42115, and CVE-2023-42116, with fixes available for distribution maintainers. However, the status of the remaining issues is under scrutiny. The Zero Day Initiative (ZDI) urges limiting interaction with the application in the absence of patches.

Controversy and Communication Breakdown:

There have been disagreements between ZDI and Exim maintainers regarding disclosure timelines. While Exim claims fixes are ready, ZDI contends delays and lack of specific information persisted. Users are advised to stay informed and vigilant, seeking updates from both parties.

This incident echoes previous Exim vulnerabilities, highlighting the recurrent need for robust security measures. Notably, in May 2021, Qualys disclosed the 21Nails vulnerabilities, showcasing the persistent challenges in securing mail transfer agents.

In light of these revelations, it becomes imperative for organizations to adopt stringent security protocols, including timely patching, network restrictions, and continuous monitoring.