CVE-2020-28020
📋 TL;DR
CVE-2020-28020 is an integer overflow vulnerability in Exim mail transfer agent that leads to buffer overflow, allowing unauthenticated remote attackers to execute arbitrary code by exploiting header continuation line handling. This affects Exim servers running versions before 4.92. The vulnerability is particularly dangerous because it can be exploited remotely without authentication.
💻 Affected Systems
- Exim
📦 What is this software?
Exim by Exim
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with root privileges leading to complete system compromise, data exfiltration, and persistent backdoor installation.
Likely Case
Remote code execution leading to mail server compromise, potential lateral movement within the network, and data theft.
If Mitigated
Exploit attempts detected and blocked by network controls, with minimal impact due to proper segmentation and monitoring.
🎯 Exploit Status
Exploit code is publicly available and relatively easy to weaponize due to the low complexity of exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Exim 4.92 and later
Vendor Advisory: https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28020-HSIZE.txt
Restart Required: Yes
Instructions:
1. Download Exim 4.92 or later from exim.org. 2. Stop Exim service. 3. Backup current configuration. 4. Install new version. 5. Restart Exim service.
🔧 Temporary Workarounds
Disable Exim service
linuxTemporarily disable Exim to prevent exploitation while patching
systemctl stop exim
systemctl disable exim
Network segmentation
linuxRestrict access to Exim ports (25, 465, 587) using firewall rules
iptables -A INPUT -p tcp --dport 25 -j DROP
iptables -A INPUT -p tcp --dport 465 -j DROP
iptables -A INPUT -p tcp --dport 587 -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Exim servers from critical systems
- Deploy intrusion detection systems to monitor for exploit attempts and block malicious traffic
🔍 How to Verify
Check if Vulnerable:
Check Exim version with 'exim --version' or 'exim -bV' and verify it's below 4.92Check Version:
exim --versionVerify Fix Applied:
Verify Exim version is 4.92 or higher using 'exim --version'📡 Detection & Monitoring
Log Indicators:
- Unusual header patterns in mail logs
- Multiple continuation lines in single messages
- Process crashes or abnormal Exim behavior
Network Indicators:
- Unusual traffic patterns to Exim ports
- Exploit-specific payloads in network traffic
SIEM Query:
source="exim.log" AND ("continuation" OR "header overflow" OR "buffer overflow")🔗 References
- http://www.openwall.com/lists/oss-security/2021/07/25/1
- http://www.openwall.com/lists/oss-security/2021/08/03/1
- https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28020-HSIZE.txt
- http://www.openwall.com/lists/oss-security/2021/07/25/1
- http://www.openwall.com/lists/oss-security/2021/08/03/1
- https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28020-HSIZE.txt
