Out-of-Bounds Write in Exim with Proxy-Protocol

Executive Summary

Exim before version 4.100.1 has a vulnerability where an out-of-bounds write can occur when Proxy-Protocol is used with an attacker-controlled proxy. This means an attacker could potentially write data outside the intended memory buffer, leading to crashes or arbitrary code execution.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking the Exim version and configuration. Run 'exim --version' to verify if your version is below 4.100.1. If Proxy-Protocol is enabled, inspect the configuration file (typically /etc/exim/exim.conf) for 'proxy_protocol' settings. Monitor logs for unusual out-of-bounds write errors or crashes.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow an attacker to execute arbitrary code on the affected system, potentially leading to unauthorized access, data theft, or system compromise. It may also cause denial-of-service conditions by crashing the Exim service.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Exim to version 4.100.1 or later. If upgrading is not possible, disable Proxy-Protocol support in Exim's configuration. Restrict network access to Exim ports (25, 465, 587) using firewalls. Monitor for exploitation attempts and apply patches as soon as they are available.

Useful 0 Not Useful 0