According to its banner, the version of Exim running on the remote host is prior to 4.94.2. It is, therefore, potentially affected by multiple vulnerabilities that can lead to remote code execution.

The remote host is affected by the vulnerability described in GLSA-202105-01 (Exim: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Exim. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker, by connecting to the SMTP listener daemon, could       possibly execute arbitrary code with the privileges of the process or       cause a Denial of Service condition. Furthermore, a local attacker could       perform symlink attacks to overwrite arbitrary files with the privileges       of the user running the application or escalate privileges.
  Workaround :

    There is no known workaround at this time.

The version of exim installed on the remote host is prior to 4.92-1.33. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2022-1622 advisory.

  - Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. Because Exim operates as root in the     log directory (owned by a non-root user), a symlink or hard link attack allows overwriting critical root-     owned files anywhere on the filesystem. (CVE-2020-28007)

  - Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. Because Exim operates as root in the     spool directory (owned by a non-root user), an attacker can write to a /var/spool/exim4/input spool header     file, in which a crafted recipient address can indirectly lead to command execution. (CVE-2020-28008)

  - Exim 4 before 4.94.2 allows Integer Overflow to Buffer Overflow because get_stdinput allows unbounded     reads that are accompanied by unbounded increases in a certain size variable. NOTE: exploitation may be     impractical because of the execution time needed to overflow (multiple days). (CVE-2020-28009)

  - Exim 4 before 4.94.2 allows Out-of-bounds Write because the main function, while setuid root, copies the     current working directory pathname into a buffer that is too small (on some common platforms).
    (CVE-2020-28010)

  - Exim 4 before 4.94.2 allows Heap-based Buffer Overflow in queue_run via two sender options: -R and -S.
    This may cause privilege escalation from exim to root. (CVE-2020-28011)

  - Exim 4 before 4.94.2 allows Exposure of File Descriptor to Unintended Control Sphere because rda_interpret     uses a privileged pipe that lacks a close-on-exec flag. (CVE-2020-28012)

  - Exim 4 before 4.94.2 allows Heap-based Buffer Overflow because it mishandles -F '.(' on the command     line, and thus may allow privilege escalation from any user to root. This occurs because of the     interpretation of negative sizes in strncpy. (CVE-2020-28013)

  - Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. The -oP option is available to the exim     user, and allows a denial of service because root-owned files can be overwritten. (CVE-2020-28014)

  - Exim 4 before 4.94.2 has Improper Initialization that can lead to recursion-based stack consumption or     other consequences. This occurs because use of certain getc functions is mishandled when a client uses     BDAT instead of DATA. (CVE-2020-28019)

  - Exim 4 before 4.94.2 has Improper Restriction of Write Operations within the Bounds of a Memory Buffer.
    This occurs when processing name=value pairs within MAIL FROM and RCPT TO commands. (CVE-2020-28022)

  - Exim 4 before 4.94.2 allows Out-of-bounds Read. smtp_setup_msg may disclose sensitive information from     process memory to an unauthenticated SMTP client. (CVE-2020-28023)

  - Exim 4 before 4.94.2 allows Buffer Underwrite that may result in unauthenticated remote attackers     executing arbitrary commands, because smtp_ungetc was only intended to push back characters, but can     actually push back non-character error codes such as EOF. (CVE-2020-28024)

  - Exim 4 before 4.94.2 allows Out-of-bounds Read because pdkim_finish_bodyhash does not validate the     relationship between sig->bodyhash.len and b->bh.len; thus, a crafted DKIM-Signature header might lead to     a leak of sensitive information from process memory. (CVE-2020-28025)

  - Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters, relevant in non-default     configurations that enable Delivery Status Notification (DSN). Certain uses of ORCPT= can place a newline     into a spool header file, and indirectly allow unauthenticated remote attackers to execute arbitrary     commands as root. (CVE-2020-28026)

  - Exim 4 before 4.94.2 has Execution with Unnecessary Privileges. By leveraging a delete_pid_file race     condition, a local user can delete arbitrary files as root. This involves the -oP and -oPX options.
    (CVE-2021-27216)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 20.10 / 21.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4934-1 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4934-2 advisory.

  - Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. Because Exim operates as root in the     log directory (owned by a non-root user), a symlink or hard link attack allows overwriting critical root-     owned files anywhere on the filesystem. (CVE-2020-28007)

  - Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. Because Exim operates as root in the     spool directory (owned by a non-root user), an attacker can write to a /var/spool/exim4/input spool header     file, in which a crafted recipient address can indirectly lead to command execution. (CVE-2020-28008)

  - Exim 4 before 4.94.2 allows Integer Overflow to Buffer Overflow because get_stdinput allows unbounded     reads that are accompanied by unbounded increases in a certain size variable. NOTE: exploitation may be     impractical because of the execution time needed to overflow (multiple days). (CVE-2020-28009)

  - Exim 4 before 4.94.2 allows Heap-based Buffer Overflow in queue_run via two sender options: -R and -S.
    This may cause privilege escalation from exim to root. (CVE-2020-28011)

  - Exim 4 before 4.94.2 allows Exposure of File Descriptor to Unintended Control Sphere because rda_interpret     uses a privileged pipe that lacks a close-on-exec flag. (CVE-2020-28012)

  - Exim 4 before 4.94.2 allows Heap-based Buffer Overflow because it mishandles -F '.(' on the command     line, and thus may allow privilege escalation from any user to root. This occurs because of the     interpretation of negative sizes in strncpy. (CVE-2020-28013)

  - Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. The -oP option is available to the exim     user, and allows a denial of service because root-owned files can be overwritten. (CVE-2020-28014)

  - Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters. Local users can alter the behavior of     root processes because a recipient address can have a newline character. (CVE-2020-28015)

  - Exim 4 before 4.94.2 allows an off-by-two Out-of-bounds Write because -F '' is mishandled by     parse_fix_phrase. (CVE-2020-28016)

  - Exim 4 before 4.94.2 allows Integer Overflow to Buffer Overflow in receive_add_recipient via an e-mail     message with fifty million recipients. NOTE: remote exploitation may be difficult because of resource     consumption. (CVE-2020-28017)

  - Exim 4 before 4.92 allows Integer Overflow to Buffer Overflow, in which an unauthenticated remote attacker     can execute arbitrary code by leveraging the mishandling of continuation lines during header-length     restriction. (CVE-2020-28020)

  - Exim 4 before 4.94.2 has Improper Restriction of Write Operations within the Bounds of a Memory Buffer.
    This occurs when processing name=value pairs within MAIL FROM and RCPT TO commands. (CVE-2020-28022)

  - Exim 4 before 4.94.2 allows Buffer Underwrite that may result in unauthenticated remote attackers     executing arbitrary commands, because smtp_ungetc was only intended to push back characters, but can     actually push back non-character error codes such as EOF. (CVE-2020-28024)

  - Exim 4 before 4.94.2 allows Out-of-bounds Read because pdkim_finish_bodyhash does not validate the     relationship between sig->bodyhash.len and b->bh.len; thus, a crafted DKIM-Signature header might lead to     a leak of sensitive information from process memory. (CVE-2020-28025)

  - Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters, relevant in non-default     configurations that enable Delivery Status Notification (DSN). Certain uses of ORCPT= can place a newline     into a spool header file, and indirectly allow unauthenticated remote attackers to execute arbitrary     commands as root. (CVE-2020-28026)

  - Exim 4 before 4.94.2 has Execution with Unnecessary Privileges. By leveraging a delete_pid_file race     condition, a local user can delete arbitrary files as root. This involves the -oP and -oPX options.
    (CVE-2021-27216)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
149260	Exim < 4.94.2 Multiple Vulnerabilities (21Nails)	Nessus	SMTP problems	5/5/2021	1/2/2024	critical
149277	GLSA-202105-01 : Exim: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	5/5/2021	1/12/2024	critical
163870	Amazon Linux AMI : exim (ALAS-2022-1622)	Nessus	Amazon Linux Local Security Checks	8/5/2022	10/16/2023	critical
149253	Ubuntu 18.04 LTS / 20.04 LTS : Exim vulnerabilities (USN-4934-1)	Nessus	Ubuntu Local Security Checks	5/4/2021	10/16/2023	critical
149323	Ubuntu 16.04 ESM : Exim vulnerabilities (USN-4934-2)	Nessus	Ubuntu Local Security Checks	5/6/2021	10/20/2023	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical