September 27th, 2023

(0Day) Exim NTLM Challenge Out-Of-Bounds Read Information Disclosure
Vulnerability

  ZDI-23-1468
  ZDI-CAN-17433

   CVE ID              CVE-2023-42114
   CVSS SCORE          3.7, (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
   AFFECTED VENDORS    Exim
   AFFECTED PRODUCTS   Exim
                       This vulnerability allows remote attackers to disclose
                       sensitive information on affected installations of
                       Exim. Authentication is not required to exploit this
                       vulnerability.

   VULNERABILITY       The specific flaw exists within the handling of NTLM
   DETAILS             challenge requests. The issue results from the lack of
                       proper validation of user-supplied data, which can
                       result in a read past the end of an allocated data
                       structure. An attacker can leverage this vulnerability
                       to disclose information in the context of the service
                       account.
                       06/06/22 - ZDI requested a PSIRT contact.

                       06/14/22 - ZDI reported the vulnerability to the
                       vendor.

                       04/25/23 - ZDI asked for an update.

                       04/25/23 - The vendor asked us to re-send the reports.
   ADDITIONAL DETAILS
                       05/10/23 - ZDI sent the vulnerability to the vendor.

                       09/25/23 - ZDI asked for an update and informed the
                       vendor that we intend to publish the case as a
                       zero-day advisory on 09/27/23.

                       -- Mitigation: Given the nature of the vulnerability,
                       the only salient mitigation strategy is to restrict
                       interaction with the application.
                         * 2022-06-14 - Vulnerability reported to vendor
   DISCLOSURE TIMELINE   * 2023-09-27 - Coordinated public release of
                           advisory
   CREDIT              Anonymous

References

   Visible links
   . https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-42114
   . http://nvd.nist.gov/cvss.cfm?calculator&version=3.0&vector=(AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
   . https://exim.org/
   . https://www.zerodayinitiative.com/advisories/
   . mailto:zdi@trendmicro.com
   . https://twitter.com/thezdi
   . https://infosec.exchange/@thezdi