--- licence_title: Creative Commons Attribution 4.0 International (CC-BY 4.0) licence_link: https://creativecommons.org/licenses/by/4.0/ licence_restrictions: https://cert.europa.eu/legal-notice licence_author: CERT-EU, The Cybersecurity Service for the European Union institutions, bodies, offices and agencies title: 'Critical Exim TLS Vulnerability' version: '1.0' number: '2019-019' date: 'September 09, 2019' --- _History:_ * _09/19/2019 --- v1.0 -- Initial publication_ # Summary Exim Mail Transfer Agent (MTA) servers are exposed to a security vulnerability, which can grant attackers the ability to run malicious code with root privileges. This vulnerability has been assigned the number CVE-2019-15846 [1, 9]. The vulnerability is particularly critical, as over 50% of MTAs in the world use Exim [4]. # Technical Details The vulnerability allows local or unauthenticated remote attackers to execute programs with root privileges on affected servers that accept TLS connections. The vulnerability is exploitable by sending a Server Name Indication (SNI) ending in a backslash-null sequence during the initial TLS handshake [2]. The vulnerability only depends if the server accepts TLS connections. It does not depend on the TLS library, so both, GnuTLS and OpenSSL are affected. An exploit POC already exists [5]. # Products Affected * All Exim servers running version 4.92.1 and before are vulnerable. # Recommendations Download and build a fixed version 4.92.2 [6, 7, 8, 9]. If the above versions cannot be directly installed, contact your package maintainer for a version containing the backported fix [9]. ## Possible Workarounds Server owners can mitigate this vulnerability by disabling TLS support for the Exim server. However, this may not be an option, as this exposes email traffic in cleartext, and makes it vulnerable to sniffing attacks and interception [6]. # References [1] [2] [3] [4] [5] [6] [7] [8] [9]