CVE-2019-16928
📋 TL;DR
CVE-2019-16928 is a heap-based buffer overflow vulnerability in Exim mail servers that allows remote attackers to execute arbitrary code by sending a specially crafted long EHLO command. This affects Exim installations running vulnerable versions, potentially compromising the entire mail server system. Organizations using Exim for email services are at risk.
💻 Affected Systems
- Exim
📦 What is this software?
Exim by Exim
Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
Ubuntu Linux by Canonical
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with root privileges, allowing attackers to install malware, exfiltrate data, pivot to internal networks, and maintain persistent access.
Likely Case
Remote code execution leading to mail server compromise, data theft, and potential use as a spam relay or foothold for further attacks.
If Mitigated
Limited impact with proper network segmentation and monitoring, potentially only affecting the Exim service itself.
🎯 Exploit Status
Exploitation is straightforward and has been observed in the wild.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.92.3 and later
Vendor Advisory: https://bugs.exim.org/show_bug.cgi?id=2449
Restart Required: Yes
Instructions:
1. Download Exim 4.92.3 or later from exim.org. 2. Compile and install the new version. 3. Restart the Exim service. 4. Verify the patch is applied.
🔧 Temporary Workarounds
Rate limiting EHLO commands
linuxLimit the length of EHLO commands accepted by Exim to prevent exploitation.
Add 'acl_smtp_ehlo = acl_check_ehlo' to exim.conf and create appropriate ACL rules
Network filtering
linuxBlock or filter long EHLO commands at network perimeter.
Use iptables or similar to drop packets with suspicious EHLO patterns
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Exim servers
- Deploy intrusion detection systems to monitor for exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check Exim version with 'exim --version' or 'exim -bV' and verify if it's between 4.92 and 4.92.2Check Version:
exim --versionVerify Fix Applied:
Confirm version is 4.92.3 or later using 'exim --version'📡 Detection & Monitoring
Log Indicators:
- Unusually long EHLO commands in mail logs
- Failed authentication attempts following long EHLO
- Process crashes or abnormal Exim behavior
Network Indicators:
- TCP connections to Exim port 25 with payloads exceeding normal EHLO length
- Multiple rapid connection attempts with varying EHLO strings
SIEM Query:
source="exim.log" EHLO* AND (length(EHLO) > 1000)🔗 References
- http://www.openwall.com/lists/oss-security/2019/09/28/1
- http://www.openwall.com/lists/oss-security/2019/09/28/2
- http://www.openwall.com/lists/oss-security/2019/09/28/3
- http://www.openwall.com/lists/oss-security/2019/09/28/4
- https://bugs.exim.org/show_bug.cgi?id=2449
- https://git.exim.org/exim.git/commit/478effbfd9c3cc5a627fc671d4bf94d13670d65f
- https://lists.exim.org/lurker/message/20190927.032457.c1044d4c.en.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EED7HM3MFIBAP5OIMJAFJ35JAJABTVSC/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T3TJW4HPYH3O5HZCWGD6NSHTEBTTAPDC/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UY6HPRW7MR3KBQ5JFHH6OXM7YCZBJCOB/
- https://seclists.org/bugtraq/2019/Sep/60
- https://security.gentoo.org/glsa/202003-47
- https://usn.ubuntu.com/4141-1/
- https://www.debian.org/security/2019/dsa-4536
- http://www.openwall.com/lists/oss-security/2019/09/28/1
- http://www.openwall.com/lists/oss-security/2019/09/28/2
- http://www.openwall.com/lists/oss-security/2019/09/28/3
- http://www.openwall.com/lists/oss-security/2019/09/28/4
- https://bugs.exim.org/show_bug.cgi?id=2449
- https://git.exim.org/exim.git/commit/478effbfd9c3cc5a627fc671d4bf94d13670d65f
- https://lists.exim.org/lurker/message/20190927.032457.c1044d4c.en.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EED7HM3MFIBAP5OIMJAFJ35JAJABTVSC/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T3TJW4HPYH3O5HZCWGD6NSHTEBTTAPDC/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UY6HPRW7MR3KBQ5JFHH6OXM7YCZBJCOB/
- https://seclists.org/bugtraq/2019/Sep/60
- https://security.gentoo.org/glsa/202003-47
- https://usn.ubuntu.com/4141-1/
- https://www.debian.org/security/2019/dsa-4536
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-16928
