CVE-2023-42117

03.05.2024, 03:15

Exim Improper Neutralization of Special Elements Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Exim. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the smtp service, which listens on TCP port 25 by default. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17554.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	8.1 HIGH	NETWORK	HIGH	NONE	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
zdi	CNA	8.1 HIGH				CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA-ADP	ADP	---				---
CVE	ADP	---				---

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: 91%

Debian Releases

Debian Product

Codename

exim4

bullseye	vulnerable
buster	no-dsa
bullseye (security)	4.94.2-7+deb11u4 fixed
bookworm	4.96-15+deb12u6 fixed
bookworm (security)	4.96-15+deb12u5 fixed
sid	4.98-3 fixed
trixie	4.98-3 fixed

Ubuntu Releases

Ubuntu Product

Codename

exim4

mantic	Fixed 4.96-17ubuntu2.1 released
lunar	Fixed 4.96-14ubuntu1.3 released
jammy	Fixed 4.95-4ubuntu2.4 released
focal	Fixed 4.93-13ubuntu1.9 released
bionic	Fixed 4.90.1-1ubuntu1.10+esm2 released
xenial	Fixed 4.86.2-2ubuntu2.6+esm5 released
trusty	Fixed 4.82-3ubuntu2.4+esm7 released

Common Weakness Enumeration

CWE-138 - Improper Neutralization of Special Elements
The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as control elements or syntactic markers when they are sent to a downstream component.

References

https://www.zerodayinitiative.com/advisories/ZDI-23-1471/