CVE-2023-42115
Exim AUTH Out-Of-Bounds Write Remote Code Execution Vulnerability
In short
Exim mail server has a critical flaw in its authentication system that lets attackers send specially crafted messages to crash the server or run malicious code without needing a password. This affects anyone using Exim to receive emails.
Technical detail
A buffer overflow vulnerability in Exim's SMTP service (TCP 25) allows unauthenticated remote code execution via improper validation of AUTH input, enabling arbitrary code execution in the service's security context. No prior authentication is required; the attacker exploits insufficient bounds checking on user-supplied data to write beyond allocated memory.
Summary generated and translated by AI from the official description.
Exim AUTH Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Exim. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the smtp service, which listens on TCP port 25 by default. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of a buffer. An attacker can leverage this vulnerability to execute code in the context of the service account.
. Was ZDI-CAN-17434.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Exim · Eximpublic PoCs found — 2
githubgithub.com/kirinse/cve-2023-42115★ 8githubgithub.com/doaso/CVE-2023-42115★ 0⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →