CVE-2018-6789criticalunder attackransomwareCWE-120

CVE-2018-6789

Published · Updated

Follow this CVE+ Monitor Exim+ Monitor exim4

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 9.8epss 82%
from disclosure to weapon36 days
Published on NVDFeb 8
1st PoC+36d
CISA KEV+1364d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
1 product
Red Hat Enterprise Linux 5
no_fix_planned: Will not fix
Action required by CISAfederal deadline: 2022-05-03

Apply updates per vendor instructions.

In short

Exim mail server has a buffer overflow flaw in its SMTP listener that lets attackers send a specially crafted message to run malicious code on the server without authentication.

Technical detail

A buffer overflow vulnerability exists in the base64d function within Exim's SMTP listener (CWE-120) that processes incoming SMTP commands. Remote attackers can exploit this by sending a crafted SMTP message to trigger heap/stack corruption and achieve arbitrary code execution with the privileges of the Exim daemon, requiring only network access to the SMTP port.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. By sending a handcrafted message, a buffer overflow may happen. This can be used to execute code remotely.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.