September 27th, 2023

(0Day) Exim SMTP Challenge Stack-based Buffer Overflow Remote Code Execution
Vulnerability

  ZDI-23-1470
  ZDI-CAN-17515

   CVE ID              CVE-2023-42116
   CVSS SCORE          8.1, (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
   AFFECTED VENDORS    Exim
   AFFECTED PRODUCTS   Exim
                       This vulnerability allows remote attackers to execute
                       arbitrary code on affected installations of Exim.
                       Authentication is not required to exploit this
                       vulnerability.
   VULNERABILITY
   DETAILS             The specific flaw exists within the handling of NTLM
                       challenge requests. The issue results from the lack of
                       proper validation of the length of user-supplied data
                       prior to copying it to a fixed-length stack-based
                       buffer. An attacker can leverage this vulnerability to
                       execute code in the context of the service account.
                       06/06/22 - ZDI requested a PSIRT contact.

                       06/14/22 - ZDI reported the vulnerability to the
                       vendor.

                       04/25/23 - ZDI asked for an update.

                       04/25/23 - The vendor asked us to re-send the reports.
   ADDITIONAL DETAILS
                       05/10/23 - ZDI sent the vulnerability to the vendor.

                       09/25/23 - ZDI asked for an update and informed the
                       vendor that we intend to publish the case as a
                       zero-day advisory on 09/27/23.

                       -- Mitigation: Given the nature of the vulnerability,
                       the only salient mitigation strategy is to restrict
                       interaction with the application.
                         * 2022-06-14 - Vulnerability reported to vendor
   DISCLOSURE TIMELINE   * 2023-09-27 - Coordinated public release of
                           advisory
   CREDIT              Anonymous

References

   Visible links
   . https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-42116
   . http://nvd.nist.gov/cvss.cfm?calculator&version=3.0&vector=(AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
   . https://exim.org/
   . https://www.zerodayinitiative.com/advisories/
   . mailto:zdi@trendmicro.com
   . https://twitter.com/thezdi
   . https://infosec.exchange/@thezdi