The release of the Exim 4.94.2 mail server addresses 21 vulnerabilities (CVE-2020-28007 to CVE-2020-28026, CVE-2021-27216) discovered by Qualys, collectively known as 21Nails. Ten of these issues can be exploited remotely (including execution of code with root privileges) through manipulation of SMTP commands during interaction with the server. <\/p>\n
All versions of Exim, tracked in Git since 2004, are affected. Working exploit prototypes have been prepared for 4 local vulnerabilities and 3 remote issues. The exploits for the local vulnerabilities (CVE-2020-28007, CVE-2020-28008, CVE-2020-28015, CVE-2020-28012) allow elevating privileges to the root user. Two remote issues (CVE-2020-28020, CVE-2020-28018) enable execution of code with exim user privileges without authentication (which can then lead to root access by exploiting one of the local vulnerabilities). <\/p>\n
The CVE-2020-28021 vulnerability allows remote code execution with root privileges but requires authenticated access (the user must establish an authenticated session, after which they can exploit the vulnerability by manipulating the AUTH parameter in the MAIL FROM command). The issue arises because an attacker can achieve string substitution in the spool file header due to the recording of the authenticated_sender value without proper escaping of special characters (for example, by sending the command \"MAIL FROM: AUTH=Raven+0AReyes\"). <\/p>\n
Additionally, it is noted that another remote vulnerability, CVE-2020-28017, is exploitable for executing code with the user privileges of \"exim\" without authentication but requires more than 25 GB of memory. For the remaining 13 vulnerabilities, exploits could potentially also be prepared, but work in this direction has not yet been conducted. <\/p>\n