September 27th, 2023

(0Day) Exim Improper Neutralization of Special Elements Remote Code Execution
Vulnerability

  ZDI-23-1471
  ZDI-CAN-17554

   CVE ID              CVE-2023-42117
   CVSS SCORE          8.1, (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
   AFFECTED VENDORS    Exim
   AFFECTED PRODUCTS   Exim
                       This vulnerability allows remote attackers to execute
                       arbitrary code on affected installations of Exim.
                       Authentication is not required to exploit this
                       vulnerability.

   VULNERABILITY       The specific flaw exists within the smtp service,
   DETAILS             which listens on TCP port 25 by default. The issue
                       results from the lack of proper validation of
                       user-supplied data, which can result in a memory
                       corruption condition. An attacker can leverage this
                       vulnerability to execute code in the context of the
                       current process.
                       06/06/22 - ZDI requested a PSIRT contact.

                       06/14/22 - ZDI reported the vulnerability to the
                       vendor.

                       04/25/23 - ZDI asked for an update.

                       04/25/23 - The vendor asked us to re-send the reports.
   ADDITIONAL DETAILS
                       05/10/23 - ZDI sent the vulnerability to the vendor.

                       09/25/23 - ZDI asked for an update and informed the
                       vendor that we intend to publish the case as a
                       zero-day advisory on 09/27/23.

                       -- Mitigation: Given the nature of the vulnerability,
                       the only salient mitigation strategy is to restrict
                       interaction with the application.
                         * 2022-06-15 - Vulnerability reported to vendor
   DISCLOSURE TIMELINE   * 2023-09-27 - Coordinated public release of
                           advisory
   CREDIT              Anonymous

References

   Visible links
   . https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-42117
   . http://nvd.nist.gov/cvss.cfm?calculator&version=3.0&vector=(AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
   . https://exim.org/
   . https://www.zerodayinitiative.com/advisories/
   . mailto:zdi@trendmicro.com
   . https://twitter.com/thezdi
   . https://infosec.exchange/@thezdi