CVE-2021-38371
📋 TL;DR
This vulnerability in Exim's STARTTLS implementation allows attackers to inject malicious responses during SMTP communication by exploiting buffering issues. It affects Exim mail servers using STARTTLS for encrypted connections. Attackers can potentially manipulate email delivery or execute commands.
💻 Affected Systems
- Exim
📦 What is this software?
Exim by Exim
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, email interception, or mail server takeover.
Likely Case
Email manipulation, SMTP command injection, or denial of service affecting mail delivery.
If Mitigated
Limited impact with proper network segmentation and monitoring, potentially only affecting mail processing.
🎯 Exploit Status
Exploitation requires network access to SMTP port and STARTTLS usage. Public proof-of-concept available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.94.3 and later
Vendor Advisory: https://www.exim.org/static/doc/security/CVE-2021-38371.txt
Restart Required: Yes
Instructions:
1. Download Exim 4.94.3 or later from exim.org. 2. Compile and install following official documentation. 3. Restart Exim service. 4. Verify version with 'exim -bV'.
🔧 Temporary Workarounds
Disable STARTTLS
linuxTemporarily disable STARTTLS feature to prevent exploitation
Edit Exim configuration and set 'tls_advertise_hosts =' to empty or comment out STARTTLS options
Network filtering
linuxBlock or restrict access to SMTP port from untrusted networks
iptables -A INPUT -p tcp --dport 25 -s untrusted_network -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to limit SMTP access
- Enable comprehensive logging and monitoring for SMTP anomalies
🔍 How to Verify
Check if Vulnerable:
Check Exim version with 'exim -bV'. If version is 4.94.2 or earlier and STARTTLS is enabled, system is vulnerable.Check Version:
exim -bV | grep 'Exim version'Verify Fix Applied:
Verify version is 4.94.3 or later with 'exim -bV' and confirm STARTTLS functionality works properly.📡 Detection & Monitoring
Log Indicators:
- Unusual SMTP command sequences
- STARTTLS negotiation failures
- Unexpected response injections in mail logs
Network Indicators:
- Abnormal SMTP traffic patterns
- STARTTLS manipulation attempts
- Unexpected command sequences on port 25/587
SIEM Query:
source="exim.log" AND ("STARTTLS" OR "SMTP injection")