New 21Nails Exim bugs expose millions of email servers to hacking
The maintainers of Exim have released patches to address as many as 21 security vulnerabilities in its software which could allow unauthenticated attackers to attain complete remote code execution and gain root privileges.
The flaws that have been collectively called as ’21Nails,’ include 11 vulnerabilities that require local access to the server and 10 other weaknesses that could be exploited remotely.
The issues were discovered by Qualys and reported to Exim on Oct. 20, 2020.
Bharat Jogi, senior manager at Qualys stated in a public disclosure that some of the vulnerabilities can be chained together to obtain a full remote unauthenticated code execution and gain root privileges on the Exim Server. Most of the vulnerabilities discovered by the Qualys Research Team affects all versions of Exim going back all the way to 2004.
Exim is a popular mail transfer agent (MTA) used on Unix-like operating systems, having more than 60% of the publicly reachable mail servers on the Internet running the software. According to Shodan search nearly four million Exim servers are exposed online.
The vulnerabilities when successfully exploited, could be used to tweak email settings and even add new accounts on the compromised mail servers.
The list of the 21 bugs include:
Local vulnerabilities:
- CVE-2020-28007: Link attack in Exim’s log directory
- CVE-2020-28008: Assorted attacks in Exim’s spool directory
- CVE-2020-28014: Arbitrary file creation and clobbering
- CVE-2021-27216: Arbitrary file deletion
- CVE-2020-28011: Heap buffer overflow in queue_run()
- CVE-2020-28010: Heap out-of-bounds write in main()
- CVE-2020-28013: Heap buffer overflow in parse_fix_phrase()
- CVE-2020-28016: Heap out-of-bounds write in parse_fix_phrase()
- CVE-2020-28015: New-line injection into spool header file (local)
- CVE-2020-28012: Missing close-on-exec flag for privileged pipe
- CVE-2020-28009: Integer overflow in get_stdinput()
Remote vulnerabilities:
- CVE-2020-28017: Integer overflow in receive_add_recipient()
- CVE-2020-28020: Integer overflow in receive_msg()
- CVE-2020-28023: Out-of-bounds read in smtp_setup_msg()
- CVE-2020-28021: New-line injection into spool header file (remote)
- CVE-2020-28022: Heap out-of-bounds read and write in xtract_option()
- CVE-2020-28026: Line truncation and injection in spool_read_header()
- CVE-2020-28019: Failure to reset function pointer after BDAT error
- CVE-2020-28024: Heap buffer underflow in smtp_ungetc()
- CVE-2020-28018: Use-after-free in tls-openssl.c
- CVE-2020-28025: Heap out-of-bounds read in pdkim_finish_bodyhash()
It is recommended to apply the patches immediately, as email servers have emerged as a profitable target for espionage campaigns.
According to Jogi, Mail Transfer Agents are interesting targets for attackers because they are usually accessible over the internet. Once exploited, they could modify sensitive email settings on the mail servers and allow adversaries to create new accounts on the target mail servers.
Image Credits : Twitter
The post New 21Nails Exim bugs expose millions of email servers to hacking first appeared on Cybersafe News.
