{"id":151908,"date":"2025-12-17T23:11:58","date_gmt":"2025-12-17T21:11:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/obnovlenie-pochtovogo-servera-exim-4-99-1-s-ustraneniem-uyazvimosti"},"modified":"2025-12-17T23:11:58","modified_gmt":"2025-12-17T21:11:58","slug":"obnovlenie-pochtovogo-servera-exim-4-99-1-s-ustraneniem-uyazvimosti","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/obnovlenie-pochtovogo-servera-exim-4-99-1-s-ustraneniem-uyazvimosti","title":{"rendered":"Update of the Exim mail server to version 4.99.1, fixing a vulnerability","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A corrective release of the Exim mail server 4.99.1 has been published, which addresses a vulnerability (CVE-2025-67896) that allows a remote attacker to corrupt memory content outside of the allocated buffer. This issue could potentially be exploited for remote code execution on the server, although a working exploit has not yet been prepared. <\/p>\n
The vulnerability exists in the code for working with the internal database (Hints DB) based on SQLite, which is used to store temporary information, message delivery state, and email sending intensity data. The issue arises because records from the database were directly converted into the internal structure «dbdata_ratelimit_unique» without proper validation. A situation occurred where a fixed array «bloom» of 40 bytes was created, and the content of the «bloom_size» field, which determines the number of elements written into the array, depended on the size of the data in the database. An attacker could exploit this by writing outside the allocated buffer by placing data in the database (using another vulnerability) that caused the «bloom_size» field to take on a value far exceeding the size of the array. <\/p>\n
The problem is present in Exim versions 4.99 and 4.98.2 and affects only configurations with ACL ratelimit that use the «unique» or «per_addr» parameters (for example, «warn ratelimit = 100 \/ 1h \/ per_addr \/ $sender_address» or «warn ratelimit = 100 \/ 1h \/ per_rcpt \/ unique=$sender_address»). Additionally, for an attack to occur, Exim must be compiled with SQLite support (USE_SQLITE=yes), activated in the configuration file (hints_database = sqlite). In vulnerable configurations, running «exim -bV» will output «Hints DB: Using sqlite3». <\/p>\n
Among the major distributions, the problematic versions were used in Debian 13, Ubuntu 25.10, SUSE\/openSUSE, Arch Linux, Fedora, and FreeBSD. RHEL and derivative distributions are not affected, as Exim is not included in their standard package repository (in EPEL, the update for the exim package has not yet been published). <\/p>\n
A new vector for exploiting the vulnerability CVE-2025-26794, which was fixed in the February release of Exim 4.98.1, has also been identified. The vulnerability allows for SQL code injection into the internal database (Hints DB). The previously added fix did not escape single quotes. An example of the MAIL FROM command that leads to SQL code injection is: «MAIL FROM:<«x’\/**\/UNION\/**\/SELECT\/**\/X'<hex_blob>’—«@attacker.com>». This vulnerability can be used as a starting point to create conditions for the buffer overflow described above. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"