🚨 SOC Alert – Zero-day vulnerability in the EXIM software

Apply the patches immediately!

Vulnerabilities have been discovered in the EXIM email server software.
The affected versions are those prior to 4.96.1 and 4.97.

What is this about?

EXIM MTA is an open-source email server used on UNIX systems. Several vulnerabilities have been discovered in versions of EXIM prior to versions 4.96.1 and 4.97.

A lack of validation of user input allows an attacker to perform various manipulations, including memory corruption, in order to steal confidential data.
For vulnerabilities for which the vendor has released a patch, the flaws lie in the NTLM authentication protocol.
For vulnerabilities for which the vendor has not yet released patches, these include vulnerabilities in messaging protocols (SMTP, SPF macros).
The attacks are carried out without the need for authentication.

Affected products:
EXIM versions prior to 4.96.1 or 4.97.

Potential consequences:

– Security policy violation
– Remote code execution
– Leakage of sensitive information
– Data integrity breach

Corrective Actions:

• Update the Exim software to version 4.96.1 or 4.97 to address vulnerabilities related to CVE-2023-42114, CVE-2023-42115, and CVE-2023-42116
• Awaiting patches from the vendor to address the vulnerabilities associated with CVE-2023-42117, CVE-2023-42118, and CVE-2023-42119.

Temporary fixes:

For CVE-2023-42117, CVE-2023-42118, and CVE-2023-42119, temporary workarounds can be applied while waiting for a software update from the vendor.
– CVE-2023-42117: Use a trusted relay (or proxy) that uses the
PROXY protocol.
– CVE-2023-42118: Avoid using SPF macros.
– CVE-2023-42119: Use a trusted DNS resolver capable of validating
data based on DNS record types.

Additional recommendations:

Use the information system's security measures:SIEM,EDR, or contact your cybersecurity monitoring provider (managedSOC).

> Don't leave these types of services exposed and unprotected. ITrust offers tools to detect cyber threats, ransomware, viruses, and abnormal behavior within your IT infrastructure, such as ourReveelium UEBA SIEM.

> Scan your network regularly to detect security vulnerabilities and identify patches that need to be applied. OurIKare vulnerability scanner, available as a free trial, helps detect new security vulnerabilities.

If you need help fixing these issues, give us a call. (05.67.34.67.80)

*Sources:
https://www.zerodayinitiative.com/advisories/ZDI-23-1468/https://www.zerodayinitiative.com/advisories/ZDI-23-1469/https://www.zerodayinitiative.com/advisories/ZDI-23-1470/https://www.zerodayinitiative.com/advisories/ZDI-23-1471/https://www.zerodayinitiative.com/advisories/ZDI-23-1472/https://www.zerodayinitiative.com/advisories/ZDI-23-1473/https://www.securityweek.com/unpatched-exim-vulnerabilities-expose-many-mail-servers-to-attacks/https://thehackernews.com/2023/09/new-critical-security-flaws-expose-exim.html