The release of the Exim 4.94.2 mail server addresses 21 vulnerabilities (CVE-2020-28007 to CVE-2020-28026, CVE-2021-27216) discovered by Qualys, collectively known as 21Nails. Ten of these issues can be exploited remotely (including execution of code with root privileges) through manipulation of SMTP commands during interaction with the server.
All versions of Exim, tracked in Git since 2004, are affected. Working exploit prototypes have been prepared for 4 local vulnerabilities and 3 remote issues. The exploits for the local vulnerabilities (CVE-2020-28007, CVE-2020-28008, CVE-2020-28015, CVE-2020-28012) allow elevating privileges to the root user. Two remote issues (CVE-2020-28020, CVE-2020-28018) enable execution of code with exim user privileges without authentication (which can then lead to root access by exploiting one of the local vulnerabilities).
The CVE-2020-28021 vulnerability allows for immediate remote code execution with root privileges but requires authenticated access (the user must establish an authenticated session, after which the vulnerability can be exploited through manipulation of the AUTH parameter in the MAIL FROM command). This issue arises from the attacker being able to inject a string into the spool file header due to improper escaping of special characters in the authenticated_sender value (e.g., by issuing the command 'MAIL FROM:<> AUTH=Raven+0AReyes').
Additionally, it is noted that another remote vulnerability, CVE-2020-28017, is exploitable for executing code with the 'exim' user privileges without authentication but requires more than 25 GB of memory. For the remaining 13 vulnerabilities, potential exploits could also be prepared, but no action has been taken in that direction so far.
Exim developers were notified of the issues back in October of last year and spent over 6 months developing fixes. All administrators are strongly recommended to urgently update Exim on their mail servers. servers up to version 4.94.2. All Exim versions prior to the release of 4.94.2 have been declared obsolete. The release of the new version was coordinated with distributions that simultaneously published package updates: Ubuntu, Arch Linux, FreeBSD, Debian, SUSE, and Fedora. RHEL and CentOS are not affected, as Exim is not part of their standard package repository (the update is still absent in EPEL).
Remote vulnerabilities:
- CVE-2020-28017: Integer overflow in the receive_add_recipient() function;
- CVE-2020-28020: Integer overflow in the receive_msg() function;
- CVE-2020-28023: Read out of the allocated buffer area in the smtp_setup_msg() function;
- CVE-2020-28021: Injection of a newline character into the spool file header;
- CVE-2020-28022: Write and read out of the allocated buffer area in the extract_option() function;
- CVE-2020-28026: Truncation and injection of a string in the spool_read_header() function;
- CVE-2020-28019: Crash when resetting the function pointer after a BDAT error occurs;
- CVE-2020-28024: Underflow buffer overflows in the smtp_ungetc() function;
- CVE-2020-28018: Accessing a buffer after it has been freed (use-after-free) in tls-openssl.c
- CVE-2020-28025: Read out of the allocated buffer area in the pdkim_finish_bodyhash() function.
Local vulnerabilities:
- CVE-2020-28007: Attack via a symbolic link in the Exim log directory;
- CVE-2020-28008: Attacks on the spool directory;
- CVE-2020-28014: Arbitrary file creation;
- CVE-2021-27216: Arbitrary file deletion;
- CVE-2020-28011: Buffer overflow in the queue_run() function;
- CVE-2020-28010: Write out of buffer bounds in the main() function;
- CVE-2020-28013: Buffer overflow in the parse_fix_phrase() function;
- CVE-2020-28016: Write out of buffer bounds in the parse_fix_phrase() function;
- CVE-2020-28015: Injection of a newline character into the spool file header;
- CVE-2020-28012: Absence of the close-on-exec flag for the privileged unnamed channel;
- CVE-2020-28009: Integer overflow in the get_stdinput() function.
Source: opennet.ru
