CVE-2010-4344
Exim Heap-Based Buffer Overflow Vulnerability
Description
CVE-2010-4344 is a critical out-of-bounds write vulnerability affecting Exim Exim (versions < 4.70). Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session. CISA has added CVE-2010-4344 to the Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. With an EPSS score of 61.98% (98.3rd percentile), this vulnerability has a very high probability of being exploited.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| exim | exim | < 4.70 |
| opensuse | opensuse | 11.1; 11.2; 11.3 |
| debian | debian linux | 5.0 |
| canonical | ubuntu linux | 6.06; 8.04; 9.10 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- ftp://ftp.exim.org/pub/exim/ChangeLogs/ChangeLog-4.70(Broken Link)
- http://atmail.com/blog/2010/atmail-6204-now-available/(Broken Link)
- http://bugs.exim.org/show_bug.cgi?id=787(Issue Tracking, Patch)
- http://git.exim.org/exim.git/commit/24c929a27415c7cfc7126c47e4cad39acf3efa6b(Mailing List, Patch)
- http://lists.exim.org/lurker/message/20101210.164935.385e04d0.en.html(Mailing List, Patch)
- http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00003.html(Mailing List, Third Party Advisory)
- http://openwall.com/lists/oss-security/2010/12/10/1(Mailing List, Third Party Advisory)
- http://secunia.com/advisories/40019(Broken Link, Vendor Advisory)
- http://secunia.com/advisories/42576(Broken Link, Vendor Advisory)
- http://secunia.com/advisories/42586(Broken Link, Vendor Advisory)
- http://secunia.com/advisories/42587(Broken Link, Vendor Advisory)
- http://secunia.com/advisories/42589(Broken Link, Vendor Advisory)
- http://www.cpanel.net/2010/12/exim-remote-memory-corruption-vulnerability-notification-cve-2010-4344.html(Broken Link)
- http://www.debian.org/security/2010/dsa-2131(Mailing List, Third Party Advisory)
- http://www.exim.org/lurker/message/20101207.215955.bb32d4f2.en.html(Exploit, Mailing List)
- http://www.kb.cert.org/vuls/id/682457(Third Party Advisory, US Government Resource)
- http://www.metasploit.com/modules/exploit/unix/smtp/exim4_string_format(Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2021/05/04/7(Exploit, Mailing List)
- http://www.osvdb.org/69685(Broken Link, Exploit, Patch)
- http://www.redhat.com/support/errata/RHSA-2010-0970.html(Broken Link)
- http://www.securityfocus.com/archive/1/515172/100/0/threaded(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securityfocus.com/bid/45308(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id?1024858(Broken Link, Third Party Advisory, VDB Entry)
- http://www.theregister.co.uk/2010/12/11/exim_code_execution_peril/(Press/Media Coverage)
- http://www.ubuntu.com/usn/USN-1032-1(Third Party Advisory)
- http://www.vupen.com/english/advisories/2010/3171(Broken Link, Vendor Advisory)
- http://www.vupen.com/english/advisories/2010/3172(Broken Link, Vendor Advisory)
- http://www.vupen.com/english/advisories/2010/3181(Broken Link, Vendor Advisory)
- http://www.vupen.com/english/advisories/2010/3186(Broken Link, Vendor Advisory)
- http://www.vupen.com/english/advisories/2010/3204(Broken Link, Vendor Advisory)
- http://www.vupen.com/english/advisories/2010/3246(Broken Link, Vendor Advisory)
- http://www.vupen.com/english/advisories/2010/3317(Broken Link)
- https://bugzilla.redhat.com/show_bug.cgi?id=661756(Exploit, Issue Tracking)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-4344(US Government Resource)
Weakness Type
CWE-787: Out-of-bounds Write
Out-of-bounds Write is a vulnerability that occurs when software writes data to a memory location outside the intended boundaries of a buffer. This can happen through buffer overflows, incorrect array indexing, pointer arithmetic errors, or integer overflows affecting size calculations. In the case of CVE-2010-4344, this weakness manifests in Exim Exim where heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session.
Learn more: CWE-787 — Out-of-bounds Write
Impact Analysis
CVE-2010-4344 poses a critical threat to organizations running Exim Exim, with a CVSS score of 9.8 reflecting maximum impact across confidentiality, integrity, and availability. Successful exploitation can fully compromise the confidentiality, integrity, and availability of affected systems. Attackers can access sensitive data, modify system configurations or data, and disrupt service availability. The network-based attack vector requiring no authentication makes this vulnerability particularly accessible to opportunistic attackers and automated scanning tools.
Exploit Maturity
CVE-2010-4344 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming real-world exploitation. The EPSS score of 61.98% (98.3rd percentile) places it among the most likely vulnerabilities to be exploited, reflecting widespread and active exploitation activity. Public exploit code is available, lowering the barrier for attackers and increasing the urgency to patch. Despite being over 16 years old, this vulnerability continues to be relevant due to the persistence of unpatched legacy systems in production environments.
Remediation
- Apply vendor patches immediately as required by CISA KEV: Apply updates per vendor instructions. Upgrade Exim Exim from affected versions (< 4.70) to the latest patched release.
- If immediate patching is not possible, restrict network access to the affected Exim service using firewall rules, ACLs, or network segmentation to limit exposure to trusted networks only.
- Monitor affected systems for signs of compromise by reviewing security logs for anomalous activity, unauthorized access attempts, and unexpected system changes related to Exim.
- Evaluate whether affected Exim Exim deployments are still within vendor support. End-of-life systems should be prioritized for migration to supported alternatives.
- Review and update your organization's vulnerability management process to ensure CISA KEV entries with a remediation deadline of 2022-04-15 are addressed within the required timeframe.
Technical Details
CVE-2010-4344 is classified under CWE-787 (Out-of-bounds Write) affecting Exim Exim in versions < 4.70. Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session. The vulnerability is exploitable remotely over the network, with low attack complexity, requiring no prior authentication. The CVSS 3.1 base score of 9.8 (CRITICAL) reflects high confidentiality impact, high integrity impact, and high availability impact.
Frequently Asked Questions
Is CVE-2010-4344 being actively exploited?
Yes. CVE-2010-4344 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 61.98% (98.3rd percentile) indicates a very high probability of exploitation. Public exploit code is available, further increasing the risk.
What products are affected by CVE-2010-4344?
CVE-2010-4344 primarily affects Exim Exim, as well as Opensuse Opensuse, Debian Debian Linux, Canonical Ubuntu Linux. The affected versions include < 4.70. Organizations should check whether any instances of the affected software are running in their environment.
How do I fix CVE-2010-4344?
Apply updates per vendor instructions. Specifically, upgrade from the affected versions (< 4.70) to the latest patched release from Exim. As an interim measure, restrict network access to the affected service to trusted networks only.
How severe is CVE-2010-4344?
CVE-2010-4344 has a CVSS 3.1 score of 9.8, rated CRITICAL. This critical rating reflects the vulnerability's potential for complete system compromise. The inclusion in the CISA KEV catalog means organizations are required to remediate this vulnerability within the specified deadline.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.