CVE-2019-10149
Exim Mail Transfer Agent (MTA) Improper Input Validation
Description
CVE-2019-10149 is a critical-severity OS command injection vulnerability in the Exim mail transfer agent (MTA), often referred to as "The Return of the WIZard." A flaw in the deliver_message() function in Exim versions 4.87 through 4.91 allows improper validation of recipient addresses, enabling remote command execution on the mail server. This command injection vulnerability in Exim MTA carries a maximum CVSS score of 9.8 and allows unauthenticated attackers to execute arbitrary commands with the privileges of the mail service. CISA has added CVE-2019-10149 to its Known Exploited Vulnerabilities catalog, and with an EPSS score of 93.93% (99.88th percentile), exploitation is near-certain.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| exim | exim | >= 4.87, <= 4.91 |
| canonical | ubuntu linux | 18.04; 18.10 |
| debian | debian linux | 9.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
References
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00020.html(Mailing List, Third Party Advisory)
- http://packetstormsecurity.com/files/153218/Exim-4.9.1-Remote-Command-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/153312/Exim-4.91-Local-Privilege-Escalation.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/154198/Exim-4.91-Local-Privilege-Escalation.html(Exploit, Third Party Advisory, VDB Entry)
- http://seclists.org/fulldisclosure/2019/Jun/16(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2019/06/05/2(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2019/06/05/3(Mailing List, Patch, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2019/06/05/4(Exploit, Mailing List)
- http://www.openwall.com/lists/oss-security/2019/06/06/1(Exploit, Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2019/07/25/6(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2019/07/25/7(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2019/07/26/4(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2021/05/04/7(Mailing List, Third Party Advisory)
- http://www.securityfocus.com/bid/108679(Broken Link, Third Party Advisory, VDB Entry)
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10149(Issue Tracking, Third Party Advisory)
- https://seclists.org/bugtraq/2019/Jun/5(Mailing List, Third Party Advisory)
- https://security.gentoo.org/glsa/201906-01(Third Party Advisory)
- https://usn.ubuntu.com/4010-1/(Third Party Advisory)
- https://www.debian.org/security/2019/dsa-4456(Third Party Advisory)
- https://www.exim.org/static/doc/security/CVE-2019-10149.txt(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-10149(US Government Resource)
Weakness Type
CWE-78: OS Command Injection
In the context of CVE-2019-10149, the Exim mail transfer agent fails to properly validate recipient addresses in the deliver_message() function, allowing attackers to inject operating system commands through specially crafted email recipient addresses. The injected commands execute with the privileges of the Exim process, which typically runs as a dedicated mail user and can escalate to root. OS command injection consistently ranks among the most dangerous software vulnerabilities due to the direct path to system compromise.
Learn more: CWE-78 — OS Command Injection
Impact Analysis
CVE-2019-10149 has a CVSS 3.1 score of 9.8 (CRITICAL), representing a maximum-severity threat to mail server infrastructure. The vulnerability is remotely exploitable over the network with low attack complexity, requires no authentication, and needs no user interaction, representing the worst-case exploitability scenario. Confidentiality (High): attackers can read all email data, configuration files, and potentially access sensitive credentials stored on the mail server. Integrity (High): arbitrary command execution allows attackers to modify email data, install backdoors, and alter system configurations. Availability (High): attackers can disrupt mail service operations, delete data, or use the compromised server as a pivot point for further attacks. The EPSS score of 93.93% (99.88th percentile) confirms near-certain exploitation activity, and Exim's widespread deployment as one of the most popular MTAs on the internet makes this vulnerability's impact particularly broad.
Exploit Maturity
CVE-2019-10149 has an extremely mature exploit landscape with multiple publicly available exploits. Public exploit code is available via Packet Storm Security for remote command execution, as well as local privilege escalation variants available at Packet Storm Security and additional exploit variants. Additional exploit details were published on the oss-security mailing list. CISA has confirmed active exploitation in the wild through its KEV catalog listing with a remediation deadline of 2022-07-10. The EPSS score of 93.93% (99.88th percentile) indicates near-certain exploitation activity, making this one of the most actively targeted MTA vulnerabilities.
Remediation
- Upgrade Exim immediately to version 4.92 or later as mandated by CISA KEV: Apply updates per vendor instructions. Version 4.92 addresses the command injection flaw in the deliver_message() function.
- Verify all Exim installations across the organization, specifically Exim versions 4.87 through 4.91 (inclusive), and ensure all are updated. Check Linux distributions that bundle Exim, including Debian 9.0, Ubuntu 18.04, and Ubuntu 18.10, for distribution-specific patches.
- If immediate patching is not possible, configure Exim to restrict which characters are permitted in recipient addresses and implement SMTP relay restrictions to limit exposure. Consider temporarily disabling remote delivery if the mail server is not critical.
- Review mail server logs for indicators of exploitation, including unusual recipient addresses containing shell metacharacters, unexpected process executions by the Exim user, and signs of privilege escalation. Check for evidence of backdoors or unauthorized system modifications.
- Implement defense-in-depth for mail infrastructure by running Exim with minimal privileges, deploying it in a chroot environment where possible, using network segmentation to isolate mail servers, and configuring intrusion detection systems to alert on command injection patterns in SMTP traffic.
Technical Details
CVE-2019-10149 is caused by CWE-78 (OS Command Injection) in the deliver_message() function located in /src/deliver.c of the Exim mail transfer agent. The function fails to properly validate recipient addresses, allowing attackers to inject shell commands through specially crafted email addresses that are processed during message delivery. The injected commands are executed by the operating system shell with the privileges of the Exim process. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects maximum exploitability: network-accessible over SMTP (port 25), low complexity, no authentication required, and no user interaction needed. The vulnerability affects Exim versions 4.87 through 4.91, a range spanning approximately three years of releases, and the attack can be triggered simply by sending an email with a malicious recipient address to the vulnerable server.
Frequently Asked Questions
Is CVE-2019-10149 being actively exploited?
Yes. CVE-2019-10149 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Multiple public exploits are available, including remote command execution and local privilege escalation variants. The EPSS score of 93.93% (99.88th percentile) indicates near-certain exploitation.
What products are affected by CVE-2019-10149?
CVE-2019-10149 affects Exim mail transfer agent versions 4.87 through 4.91 (inclusive). This also impacts Linux distributions that bundle Exim, including Canonical Ubuntu Linux 18.04 and 18.10, and Debian Linux 9.0.
How do I fix CVE-2019-10149?
Upgrade Exim to version 4.92 or later. For distribution-managed packages, apply the security updates provided by your Linux distribution. After patching, review mail server logs for signs of prior exploitation and check for unauthorized system modifications.
How severe is CVE-2019-10149?
CVE-2019-10149 has a CVSS 3.1 score of 9.8 (CRITICAL), the highest severity tier. It enables unauthenticated remote command execution on mail servers with no user interaction required. With an EPSS score in the 99.88th percentile, this is one of the most actively exploited mail server vulnerabilities.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.