Exim through 4.97.1 misparses a multiline RFC 2231 header filename, and thus remote attackers can bypass a $mime_filename extension-blocking protection mechanism, and potentially deliver executable attachments to the mailboxes of end users.

Researchers say a proof of concept is available for this flaw. However, user interaction is required. Monitoring for additional insights.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Exim through 4.97.1 misparses a multiline RFC 2231 header filename, and thus remote attackers can bypass a
    $mime_filename extension-blocking protection mechanism, and potentially deliver executable attachments to
    the mailboxes of end users. (CVE-2024-39929)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-6939-1 advisory.

    Phillip Szelat discovered that Exim misparses multiline MIME header filenames. A remote attacker could use     this issue to bypass a MIME filename extension-blocking protection mechanism and possibly deliver     executable attachments to the mailboxes of end users.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2024:0218-1 advisory.

    - CVE-2024-39929: Fixed incorrect parsing of multiline rfc2231 header filename (boo#1227423).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-55603127f3 advisory.

    This is new version of exim fixing CVE-2024-39929.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-87a7b3f47a advisory.

    This is new version of exim fixing CVE-2024-39929.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dsa-5728 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5728-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     July 10, 2024                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : exim4     CVE ID         : CVE-2024-39929     Debian Bug     : 1075785

    Phillip Szelat discovered that Exim, a mail transport agent, does not     properly parse a multiline RFC 2231 header filename, allowing a remote     attacker to bypass a $mime_filename based extension-blocking protection     mechanism.

    For the oldstable distribution (bullseye), this problem has been fixed     in version 4.94.2-7+deb11u3.

    For the stable distribution (bookworm), this problem has been fixed in     version 4.96-15+deb12u5.

    We recommend that you upgrade your exim4 packages.

    For the detailed security status of exim4 please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/exim4

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
427292	Alpine: multiple exim packages: security update to 4.98-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
427292	Alpine: multiple exim packages: security update to 4.98-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
204941	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : Exim vulnerability (USN-6939-1)	Nessus	Ubuntu Local Security Checks	medium
204757	openSUSE 15 Security Update : exim (openSUSE-SU-2024:0218-1)	Nessus	SuSE Local Security Checks	medium
204684	Fedora 40 : exim (2024-55603127f3)	Nessus	Fedora Local Security Checks	medium
204678	Fedora 39 : exim (2024-87a7b3f47a)	Nessus	Fedora Local Security Checks	medium
202168	Debian dsa-5728 : exim4 - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2024-39929

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium