Researchers report critical vulnerabilities in the Exim open-source mail transfer agent that allow for remote code execution; Exim is used by up to 253K servers
Remote code execution requiring no authentication fixed. 2 other RCEs remain unpatched. — https://arstechnica.com/... [image] BrianKrebs / @briankrebs@infosec.exchange : More info, from https://seclists.org/... Exim4 MTA CVEs assigned from ZDI — From: Heiko Schlittermann <hs () nodmarc schlittermann de> — Date: Fri, 29 Sep 2023 18:06:11 +0200 — Hello Exim users, — the ZDI assigned multiple CVEs to the Exim-MTA and published them — recently: … @nopatience@swecyb.com : The disclosure timeline for the recently announced vulnerability in Exim (CVE-2023-42115) is actually really sad. — Remote, unauthenticated, code execution vulnerability originally responsibly reported back in 2022 (!) ... and still nothing. — Open source is great, but this... is not great. … X: @heybr0scientist : 🧵A zero-day RCE vulnerability in Exim mail servers has been unearthed, posing a significant threat to millions of servers. Let's delve into the technical facets of this vulnerability and discuss mitigation steps. #InfoSec #EximVulnerability 🧵 @cyberetweet : Based on the meeting notes, there are multiple security vulnerabilities in the Exim mail transfer agent. These vulnerabilities, reported anonymously in June 2022, could potentially lead to information disclosure and remote code execution. One specific vulnerability mentioned... [image] Ryne Andal / @ryne_andal : Oh cool, a 9.8 RCE on software that is ubiquitous. #ThisIsFine I don't like how ZDI gets so accusatory towards GNU maintainers though, dedicated support is one of the most glaring flaws regarding FOSS. They could just contribute a patch themselves. https://thehackernews.com/... Fredrik Dahlgren / @fegge : Unauthenticated RCE in the mail server Exim. This disclosure timeline really tells you everything you need to know. 🙄 [image] @bleepincomputer : As there is no patch available for the Exim CVE-2023-42115 zero-day, the only mitigation is to restrict access to the server or turn it off. @bleepincomputer : A Shodan query shows that are just over 3.5 million Exim servers exposed online, with most of them in the United States, followed by Russia and Germany. [image] Forums: Ars OpenForum : Critical vulnerabilities in Exim threaten over 250k email servers worldwide
Context & Ripple Effects
Exim has faced repeated code-execution disclosures: a 2018 Exim RCE finding affected a far larger reported server population, while a later flaw was fixed in version 4.92 before it was identified as a vulnerability. The new disclosures extend that security history into the current codebase.
What makes this episode consequential is the remediation split: one unauthenticated RCE has a fix, but two disclosed RCEs do not. That leaves operators to distinguish between a patchable exposure and risks that may require temporary operational controls.
First-order effects
- Organizations running Exim must identify affected deployments and apply the available fix for the unauthenticated RCE; servers exposed to the two unpatched RCEs remain at risk of remote compromise.
- Exim maintainers face immediate pressure to produce and communicate fixes for the remaining CVEs, following the earlier root-code-execution issue patched in Exim 4.92.2.
Second-order effects
- Mail-service operators and hosting providers may increase monitoring, configuration review, and isolation of Exim systems while patches are incomplete, adding operational work beyond a normal update cycle.
- The disclosure reinforces scrutiny of vulnerability triage in open-source infrastructure, particularly given the earlier Exim flaw fixed before it was formally identified as a vulnerability.
Third-order effects
- If recurring RCE disclosures continue, operators may treat mail-transfer software as a higher-priority security dependency, with more formal asset inventories and patch governance for externally reachable services.
- The episode adds to a broader challenge for open-source infrastructure: public vulnerability disclosure can accelerate defensive remediation while also making unpatched flaws easier for attackers to evaluate.
The trend: This is one data point in the growing emphasis on managing security risk in widely deployed, externally exposed open-source infrastructure.