Exim SMTP listener base64d function one-character buffer overflow

Added: 05/16/2018
CVE: CVE-2018-6789
BID: 103049

Background

Exim is a mail transfer agent used on Unix-like operating systems.

Problem

Exim 5.90 and earlier are vulnerable to a one-character buffer overflow in the base64d() function in the SMTP listener.

Resolution

Upgrade to Exim 4.90.1 or higher, apply the update from your system vendor, or apply the patch supplied by Exim.

References

https://devco.re/blog/2018/03/06/exim-off-by-one-RCE-exploiting-CVE-2018-6789-en/
https://exim.org/static/doc/security/CVE-2018-6789.txt
https://bugzilla.redhat.com/show_bug.cgi?id=1543268
https://bugzilla.novell.com/show_bug.cgi?id=1079832

Limitations

Exploit works on Exim 4.89 and 4.88 on Debian stretch and Ubuntu zesty.

The target Exim configuration must have an authenticator using base64 enabled. CRAM-MD5 authenticator uses base64 and is enabled by default.

Platforms

Linux

Back to exploit index