Mail System Vulnerability Delivers Root Privileges
The vulnerability in Exim could allow an attacker to remotely execute code with root privileges.
Exim, the mail transfer agent used by more than half the email servers on the Internet, has a vulnerability. The flaw, found in versions from 4.80 through 4.92.1, allows a malicious actor to use an encrypted TLS connection to remotely execute code with root privileges.
The vulnerability, designated CVE-2019-15846, was discovered by researcher Zerons in late July. It takes advantage of the TLS ServerName Indicator (SNI), a feature that allows TLS to serve different certificates for various websites on a single server. A buffer overflow triggered by a relatively simple SNI request followed by a counterfeit client certificate are enough to exploit the vulnerability.
Responsible disclosure procedures were followed and a patch for the vulnerability has been made available in Exim 4.92.2.
For more, read here.
Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "8 Ways To Spot an Insider Threat"
About the Author(s)
You May Also Like
Beyond Spam Filters and Firewalls: Preventing Business Email Compromises in the Modern Enterprise
April 30, 2024Key Findings from the State of AppSec Report 2024
May 7, 2024Is AI Identifying Threats to Your Network?
May 14, 2024Where and Why Threat Intelligence Makes Sense for Your Enterprise Security Strategy
May 15, 2024Safeguarding Political Campaigns: Defending Against Mass Phishing Attacks
May 16, 2024
Black Hat USA - August 3-8 - Learn More
August 3, 2024Cybersecurity's Hottest New Technologies: What You Need To Know
March 21, 2024