21Nails
- Product
- Exim Exim MTA
- CVE
- CVE-2020-28017CVE-2020-28018CVE-2020-28019CVE-2020-28020CVE-2020-28021CVE-2020-28022CVE-2020-28023CVE-2020-28024CVE-2020-28025CVE-2020-28026
- Disclosed
- 2021-05-04
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- no
- Affected
- All Exim versions before 4.94.2 (some bugs date back to 2004).
- Fixed
- Exim 4.94.2.
Summary
Qualys disclosed 21 bugs in Exim at once: 10 remotely exploitable and 11 local. Chained together, several give unauthenticated root code execution on a default Exim install.
Root cause
Remote bugs include an integer overflow in receive_add_recipient() (CVE-2020-28017, needs ~50 million recipients and >25 GB of memory), an integer overflow in receive_msg() header handling (CVE-2020-28020, Exim < 4.92), a use-after-free in tls-openssl.c for OpenSSL builds (CVE-2020-28018, 4.90 to 4.93), and heap out-of-bounds read/write in extract_option() and smtp_setup_msg() (CVE-2020-28022, -28023). Qualys exploited -28020 and -28018 for unauthenticated RCE as the exim user, then local bugs (CVE-2020-28007, -28008) to reach root.
Impact
Unauthenticated remote code execution on Exim servers, escalable to root.
Detection
Check exim -bV for versions below 4.94.2; banner-based nuclei/nmap version checks.
Mitigation
Upgrade to Exim 4.94.2 or later.