CVE-2020-28019
📋 TL;DR
This vulnerability in Exim mail servers allows remote attackers to cause a denial of service through stack consumption via specially crafted BDAT commands. It affects Exim installations that accept BDAT commands instead of traditional DATA commands. The improper initialization can lead to recursion that exhausts stack memory.
💻 Affected Systems
- Exim
📦 What is this software?
Exim by Exim
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution or complete system crash due to stack overflow, potentially allowing attacker takeover of the mail server.
Likely Case
Denial of service causing mail server crash and service disruption, requiring manual restart.
If Mitigated
Minimal impact with proper network segmentation and monitoring; service interruption limited to mail processing.
🎯 Exploit Status
Exploitation requires sending specially crafted BDAT commands; proof-of-concept code is publicly available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Exim 4.94.2
Vendor Advisory: https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28019-BDATA.txt
Restart Required: Yes
Instructions:
1. Download Exim 4.94.2 or later from exim.org. 2. Compile and install following Exim documentation. 3. Restart Exim service. 4. Verify version with 'exim -bV'.
🔧 Temporary Workarounds
Disable BDAT command support
linuxConfigure Exim to reject BDAT commands and only accept traditional DATA commands
Add 'disable_bdat = true' to Exim configuration file
Rate limit BDAT commands
linuxImplement rate limiting on BDAT commands to prevent exploitation attempts
Configure appropriate ACL rules in Exim to limit BDAT command frequency
🧯 If You Can't Patch
- Implement network segmentation to restrict access to Exim servers
- Deploy intrusion detection systems to monitor for BDAT exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check Exim version with 'exim -bV | head -1' and compare to vulnerable versions (before 4.94.2)Check Version:
exim -bV | head -1Verify Fix Applied:
Verify version is 4.94.2 or later with 'exim -bV | head -1' and test BDAT command handling📡 Detection & Monitoring
Log Indicators:
- Multiple BDAT command failures
- Stack overflow errors in system logs
- Exim process crashes
Network Indicators:
- Unusual BDAT command patterns
- Multiple BDAT commands from single source
SIEM Query:
source="exim.log" AND ("BDAT" OR "stack overflow" OR "segmentation fault")