CVE-2019-15846
📋 TL;DR
CVE-2019-15846 is a critical remote code execution vulnerability in Exim mail servers where a trailing backslash in certain commands allows attackers to execute arbitrary code with root privileges. This affects Exim installations before version 4.92.2. Any organization running vulnerable Exim versions is at risk of complete system compromise.
💻 Affected Systems
- Exim
📦 What is this software?
Exim by Exim
⚠️ Risk & Real-World Impact
Worst Case
Remote unauthenticated attacker gains full root access to the mail server, enabling data theft, lateral movement, and persistent backdoor installation.
Likely Case
Attackers exploit the vulnerability to install cryptocurrency miners, ransomware, or botnet malware on vulnerable servers.
If Mitigated
With proper network segmentation and least privilege, impact is limited to the mail server itself, though data exfiltration remains possible.
🎯 Exploit Status
Multiple public exploits exist and have been used in real-world attacks. The vulnerability is easily exploitable with minimal technical skill.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.92.2
Vendor Advisory: http://exim.org/static/doc/security/CVE-2019-15846.txt
Restart Required: Yes
Instructions:
1. Backup Exim configuration files. 2. Download and compile Exim 4.92.2 or later from exim.org. 3. Stop Exim service. 4. Install new version. 5. Restart Exim service. 6. Verify version with 'exim -bV'.
🔧 Temporary Workarounds
Disable vulnerable commands
linuxRemove or restrict access to affected commands in Exim configuration
Edit exim.conf and comment out or remove 'acl_smtp_rcpt' and 'acl_smtp_mail' lines with vulnerable patterns
Network filtering
linuxBlock SMTP commands containing trailing backslashes at network perimeter
iptables -A INPUT -p tcp --dport 25 -m string --string "\\" --algo bm -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Exim server from critical systems
- Deploy intrusion detection rules to alert on exploitation attempts and monitor for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Run 'exim -bV' and check if version is below 4.92.2Check Version:
exim -bV | head -1Verify Fix Applied:
Run 'exim -bV' and confirm version is 4.92.2 or higher📡 Detection & Monitoring
Log Indicators:
- SMTP commands with trailing backslashes in Exim logs
- Unusual process execution from Exim user
- Failed authentication attempts followed by command execution
Network Indicators:
- SMTP traffic containing backslash characters in command parameters
- Unexpected outbound connections from mail server
SIEM Query:
source="exim.log" AND "\\" AND ("MAIL" OR "RCPT")🔗 References
- http://exim.org/static/doc/security/CVE-2019-15846.txt
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00024.html
- http://www.openwall.com/lists/oss-security/2019/09/06/2
- http://www.openwall.com/lists/oss-security/2019/09/06/4
- http://www.openwall.com/lists/oss-security/2019/09/06/5
- http://www.openwall.com/lists/oss-security/2019/09/06/6
- http://www.openwall.com/lists/oss-security/2019/09/06/8
- http://www.openwall.com/lists/oss-security/2019/09/07/1
- http://www.openwall.com/lists/oss-security/2019/09/07/2
- http://www.openwall.com/lists/oss-security/2019/09/08/1
- http://www.openwall.com/lists/oss-security/2019/09/09/1
- https://exim.org/static/doc/security/CVE-2019-15846.txt
- https://lists.debian.org/debian-lts-announce/2019/09/msg00004.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FT3GY7V7SR2RHKNZNQCGXFWUSILVSZNU/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NDF37AUNETIOXY6ZLQAUBGBVUTMMV242/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SBNHDAF74RI6VK2JVSEIE3VYNL7JJDYM/
- https://seclists.org/bugtraq/2019/Sep/13
- https://security.gentoo.org/glsa/201909-06
- https://usn.ubuntu.com/4124-1/
- https://usn.ubuntu.com/4124-2/
- https://www.debian.org/security/2019/dsa-4517
- https://www.kb.cert.org/vuls/id/672565
- https://www.openwall.com/lists/oss-security/2019/09/06/1
- http://exim.org/static/doc/security/CVE-2019-15846.txt
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00024.html
- http://www.openwall.com/lists/oss-security/2019/09/06/2
- http://www.openwall.com/lists/oss-security/2019/09/06/4
- http://www.openwall.com/lists/oss-security/2019/09/06/5
- http://www.openwall.com/lists/oss-security/2019/09/06/6
- http://www.openwall.com/lists/oss-security/2019/09/06/8
- http://www.openwall.com/lists/oss-security/2019/09/07/1
- http://www.openwall.com/lists/oss-security/2019/09/07/2
- http://www.openwall.com/lists/oss-security/2019/09/08/1
- http://www.openwall.com/lists/oss-security/2019/09/09/1
- https://exim.org/static/doc/security/CVE-2019-15846.txt
- https://lists.debian.org/debian-lts-announce/2019/09/msg00004.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FT3GY7V7SR2RHKNZNQCGXFWUSILVSZNU/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NDF37AUNETIOXY6ZLQAUBGBVUTMMV242/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SBNHDAF74RI6VK2JVSEIE3VYNL7JJDYM/
- https://seclists.org/bugtraq/2019/Sep/13
- https://security.gentoo.org/glsa/201909-06
- https://usn.ubuntu.com/4124-1/
- https://usn.ubuntu.com/4124-2/
- https://www.debian.org/security/2019/dsa-4517
- https://www.kb.cert.org/vuls/id/672565
- https://www.openwall.com/lists/oss-security/2019/09/06/1
