Security researchers document 21 major security vulnerabilities in Exim and warn that users are exposed to remote code execution flaws
Security researchers at Qualys have discovered multiple gaping security holes in Exim, a widely deployed mail server that has been targeted in the past by advanced nation state-based threat actors.
An advisory from Qualys documents a total of 21 security vulnerabilities, 10 serious enough to expose Exim mail servers to remote code execution attacks.
Qualys said it reported the flaws to Exim since last October and noted that some of the vulnerabilities have been present in Exim since at least 2004, Qualys warned.
From the advisory:
We recently audited central parts of the Exim mail server and discovered 21 vulnerabilities (from CVE-2020-28007 to CVE-2020-28026, plus CVE-2021-27216): 11 local vulnerabilities, and 10 remote vulnerabilities. Unless otherwise noted, all versions of Exim are affected since at least the beginning of its Git history, in 2004.
During the course of the research, Qualys said its team successfully exploited three remote code-execution flaws and four local privilege escalation bugs to gain root access on vulnerable mail servers.
[RELATED: NSA Publishes IOCs Associated With Russian Targeting of Exim Servers ]
“We will not publish our exploits for now; instead, we encourage other security researchers to write and publish their own exploits,” the company said, noting that the advisory contains sufficient information to develop reliable exploits for these vulnerabilities,” Qualys said. “In fact, we believe that better exploitation methods exist.”
A separate note from Exim maintainers contains information on applying ..
Support the originator by clicking the read the rest link below.
