CVE-2018-6789
Exim Buffer Overflow Vulnerability
Description
CVE-2018-6789 is a CRITICAL buffer overflow vulnerability in Exim's SMTP listener with a CVSS 3.1 score of 9.8. The vulnerability exists in the base64d function, which improperly handles base64 decoding operations. By sending a specially crafted message, an attacker can trigger a one-byte buffer overflow (off-by-one) that can be leveraged for remote code execution. Exim versions before 4.90.1 are affected. This CVE is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of 2022-05-03. The EPSS score of 0.86140 (99.394th percentile) demonstrates significant exploitation activity, and the vulnerability has been associated with ransomware campaigns.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| exim | exim | < 4.90.1 |
| debian | debian linux | 7.0; 8.0; 9.0 |
| canonical | ubuntu linux | 14.04; 16.04; 17.10 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://openwall.com/lists/oss-security/2018/02/10/2(Mailing List, Third Party Advisory)
- http://packetstormsecurity.com/files/162959/Exim-base64d-Buffer-Overflow.html(Exploit, Third Party Advisory, VDB Entry)
- http://www.openwall.com/lists/oss-security/2018/02/07/2(Mailing List, Third Party Advisory)
- http://www.securityfocus.com/bid/103049(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1040461(Broken Link, Third Party Advisory, VDB Entry)
- https://devco.re/blog/2018/03/06/exim-off-by-one-RCE-exploiting-CVE-2018-6789-en/(Exploit, Third Party Advisory)
- https://exim.org/static/doc/security/CVE-2018-6789.txt(Vendor Advisory)
- https://git.exim.org/exim.git/commit/cf3cd306062a08969c41a1cdd32c6855f1abecf1(Patch)
- https://lists.debian.org/debian-lts-announce/2018/02/msg00009.html(Mailing List, Third Party Advisory)
- https://usn.ubuntu.com/3565-1/(Third Party Advisory)
- https://www.debian.org/security/2018/dsa-4110(Mailing List, Third Party Advisory)
- https://www.exploit-db.com/exploits/44571/(Exploit, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/45671/(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-6789(US Government Resource)
Weakness Type
CWE-120: Buffer Copy without Checking Size of Input (Classic Buffer Overflow)
CVE-2018-6789 is classified under CWE-120 — Buffer Copy without Checking Size of Input. This weakness occurs when a program copies data from a source buffer to a destination buffer without first verifying that the data will fit within the destination's allocated memory. Classic buffer overflows allow attackers to overwrite adjacent memory, potentially corrupting data structures, modifying control flow, or injecting executable code.
In the context of Exim, the base64d function contained an off-by-one error in its buffer size calculation for base64 decoding. When base64-encoded input with a specific length is processed, the decoded output can exceed the allocated buffer by one byte. While a single-byte overflow may appear limited, skilled attackers can leverage heap manipulation techniques to turn this into full remote code execution. The vulnerability is particularly dangerous because it exists in the SMTP listener, which processes data from any connecting mail client without authentication.
Learn more: CWE-120 — Buffer Copy without Checking Size of Input
Impact Analysis
CVE-2018-6789 carries a CVSS 3.1 score of 9.8 (CRITICAL) with Unchanged Scope.
Confidentiality (HIGH): Successful exploitation allows complete access to all data accessible to the Exim mail server process, including email messages in transit and storage, mail server configurations, TLS certificates, authentication credentials, and potentially access to other services on the same host.
Integrity (HIGH): Attackers can modify email content in transit, alter mail routing, install persistent backdoors on the mail server, modify system configurations, and use the compromised server as a pivot point for further network attacks.
Availability (HIGH): Complete denial of mail service is possible, including crashing the Exim process, corrupting mail queues, encrypting server data, or using server resources for malicious purposes such as spam relay or botnet participation.
With an EPSS score of 0.86140 (99.394th percentile), this vulnerability ranks among the most exploited mail server vulnerabilities. Exim is one of the most widely deployed mail transfer agents globally, making the potential impact of this vulnerability enormous.
Exploit Maturity
CVE-2018-6789 has confirmed active exploitation in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog.
Exploit status: Multiple public exploits exist, including entries in Exploit-DB and detailed technical write-ups explaining the exploitation technique. The off-by-one overflow in base64d requires careful heap manipulation but has been successfully weaponized. Proof-of-concept exploits demonstrate full remote code execution against vulnerable Exim installations.
Ransomware association: This vulnerability has been confirmed as associated with ransomware campaigns. Mail servers are high-value targets for threat actors due to the sensitive data they process and their central role in organizational communication.
Attack surface: Exim mail servers are typically internet-facing on port 25/587/465, making them directly accessible to remote attackers. The vulnerability can be triggered during normal SMTP communication, requiring only the ability to send data to the SMTP listener. No authentication is needed.
KEV deadline: CISA required federal agencies to remediate this vulnerability by 2022-05-03. Organizations still running Exim versions before 4.90.1 should treat this as an emergency.
Remediation
- Update Exim immediately. Upgrade to Exim 4.90.1 or later. Consult the official Exim security advisory at CVE-2018-6789.txt and the patch commit for details.
- Identify all Exim installations in your environment. Use asset discovery to locate every Exim instance across your infrastructure, including backup MX servers, mail relays, and development systems. All versions before 4.90.1 are affected.
- Monitor mail server logs for suspicious activity. Review SMTP connection logs for unusual base64-encoded payloads, unexpected crashes or restarts, and signs of unauthorized access. The exploit may leave artifacts in mail queue processing logs.
- Implement network-level protections. Deploy intrusion detection signatures for known CVE-2018-6789 exploit patterns. Consider rate limiting SMTP connections and implementing mail-specific firewall rules.
- Assess for prior compromise. If patching was delayed, conduct a forensic investigation of the mail server. Check for unauthorized processes, unexpected network connections, modified binaries, and signs of data exfiltration.
- Harden mail server configuration. Restrict unnecessary Exim features, implement TLS enforcement, enable SMTP authentication requirements where appropriate, and ensure Exim runs with minimal system privileges.
Technical Details
CVE-2018-6789 is a CRITICAL vulnerability in the Exim mail transfer agent exploitable remotely over the network. The attack complexity is low, requiring no authentication or user interaction.
Technical mechanism: The vulnerability is a one-byte heap buffer overflow (off-by-one) in Exim's base64d function, which is responsible for decoding base64-encoded data in SMTP communications. The function calculates the output buffer size as 3*(len/4)+1, but when the input length is not a multiple of 4, the actual decoded output can exceed this allocation by one byte. This single byte overflow on the heap can corrupt adjacent heap metadata or application data.
Exploitation technique: Although an off-by-one overflow may seem minor, the attacker can manipulate the heap layout through carefully crafted SMTP interactions before triggering the overflow. By controlling what data is adjacent to the overflow buffer, the attacker can overwrite critical heap structures or function pointers. This heap manipulation technique converts the one-byte overflow into arbitrary code execution.
CVSS 3.1 vector analysis (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H): Network-accessible via SMTP, low complexity despite the heap manipulation requirement, no privileges or user interaction needed. Unchanged scope means impact is confined to the mail server.
Affected products: Exim (< 4.90.1), Debian Linux (7.0, 8.0, 9.0), Ubuntu Linux (14.04, 16.04, 17.10).
Frequently Asked Questions
Is CVE-2018-6789 being actively exploited?
Yes, CVE-2018-6789 is actively exploited and listed in CISA's KEV catalog. Public exploits are available, and the vulnerability has been linked to ransomware campaigns targeting mail servers. The EPSS score of 0.86140 (99.394th percentile) confirms high exploitation activity. Exim is one of the most widely deployed MTAs, making it a prime target.
What products are affected by CVE-2018-6789?
Exim versions before 4.90.1 are affected. This includes Exim installations on Debian Linux (7.0, 8.0, 9.0) and Ubuntu Linux (14.04, 16.04, 17.10) that shipped with vulnerable Exim packages. Any system running an unpatched Exim as its mail transfer agent is at risk.
How do I fix CVE-2018-6789?
Update Exim to version 4.90.1 or later. For Linux distributions, apply the security updates provided by your package manager. If patching was delayed, perform a forensic review of the mail server. Implement SMTP-level protections and monitor for indicators of compromise.
How severe is CVE-2018-6789?
CVE-2018-6789 is rated CRITICAL with a CVSS score of 9.8. It enables unauthenticated remote code execution against internet-facing mail servers through a buffer overflow in the SMTP listener. With confirmed ransomware associations and an EPSS score of 0.86140 (99.394th percentile), this is one of the most dangerous mail server vulnerabilities. CISA set a remediation deadline of 2022-05-03.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.