CVE-2019-16928
Exim Out-of-bounds Write Vulnerability
Description
CVE-2019-16928 is a critical-severity out-of-bounds write vulnerability affecting Exim Exim Internet Mailer. Exim contains an out-of-bounds write vulnerability which can allow for remote code execution. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. With an EPSS score of 88.94% (99.5th percentile), this vulnerability has a notable probability of exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| exim | exim | >= 4.92, <= 4.92.2 |
| canonical | ubuntu linux | 19.04 |
| debian | debian linux | 10.0 |
| fedoraproject | fedora | 29; 30; 31 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://www.openwall.com/lists/oss-security/2019/09/28/1(Exploit, Mailing List, Mitigation, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2019/09/28/2(Exploit, Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2019/09/28/3(Mailing List, Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2019/09/28/4(Mailing List, Third Party Advisory)
- https://bugs.exim.org/show_bug.cgi?id=2449(Issue Tracking, Patch, Vendor Advisory)
- https://git.exim.org/exim.git/commit/478effbfd9c3cc5a627fc671d4bf94d13670d65f(Patch)
- https://lists.exim.org/lurker/message/20190927.032457.c1044d4c.en.html(Vendor Advisory)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EED7HM3MFIBAP5OIMJAFJ35JAJABTVSC/(Release Notes)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T3TJW4HPYH3O5HZCWGD6NSHTEBTTAPDC/(Release Notes)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UY6HPRW7MR3KBQ5JFHH6OXM7YCZBJCOB/(Release Notes)
- https://seclists.org/bugtraq/2019/Sep/60(Mailing List, Third Party Advisory)
- https://security.gentoo.org/glsa/202003-47(Third Party Advisory)
- https://usn.ubuntu.com/4141-1/(Third Party Advisory)
- https://www.debian.org/security/2019/dsa-4536(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-16928(US Government Resource)
Weakness Type
CWE-787: Out-of-bounds Write
Out-of-bounds Write is a vulnerability that occurs when software writes data to a memory location outside the intended boundaries of a buffer. This can happen through buffer overflows, incorrect array indexing, pointer arithmetic errors, or integer overflows affecting size calculations.
Learn more: CWE-787 — Out-of-bounds Write
Impact Analysis
CVE-2019-16928 carries a CVSS 3.1 score of 9.8 (CRITICAL), indicating a maximum-severity threat. The vulnerability is exploitable over the network with low attack complexity and requires no authentication. Successful exploitation can severely compromise data confidentiality, and allow unauthorized modification of data and systems, and cause complete service disruption. Organizations running affected Exim Internet Mailer deployments face significant operational risk if this vulnerability remains unpatched.
Exploit Maturity
CVE-2019-16928 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog. The EPSS score of 88.94% (99.5th percentile) reflects an exceptionally high probability of exploitation. Public exploit code is available, which lowers the barrier for attackers and increases the urgency of remediation. Federal agencies were required to remediate this vulnerability by 2022-03-17 per CISA's binding operational directive.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions.
- Verify that all instances of affected products (exim exim >= 4.92, <= 4.92.2; canonical ubuntu linux 19.04; debian debian linux 10.0) have been updated to patched versions.
- If immediate patching is not possible, restrict network access to affected systems using firewall rules and network segmentation to limit exposure.
- Monitor systems for indicators of compromise, including unusual process activity, unexpected network connections, and unauthorized configuration changes.
- Review security logs and conduct threat hunting to determine if the vulnerability was exploited prior to patching.
Technical Details
CVE-2019-16928 affects Exim Exim Internet Mailer. Exim contains an out-of-bounds write vulnerability which can allow for remote code execution. The attack vector is network-based, meaning an attacker can exploit this vulnerability remotely without physical access to the target system. The maximum CVSS score of 9.8 reflects the combination of easy exploitability and severe impact across confidentiality, integrity, and availability.
Frequently Asked Questions
Is CVE-2019-16928 being actively exploited?
Yes. CVE-2019-16928 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation. The EPSS score of 88.94% (99.5th percentile) further indicates a very high exploitation probability.
What products are affected by CVE-2019-16928?
CVE-2019-16928 affects Exim Exim Internet Mailer. Specifically affected products include: exim exim (>= 4.92, <= 4.92.2), canonical ubuntu linux (19.04), debian debian linux (10.0), fedoraproject fedora (29; 30; 31).
How do I fix CVE-2019-16928?
Apply updates per vendor instructions. Ensure all affected systems are updated to the latest patched versions. If patching is not immediately possible, implement network-level mitigations to limit exposure.
How severe is CVE-2019-16928?
CVE-2019-16928 has a CVSS 3.1 score of 9.8 (CRITICAL). This is a critical-severity vulnerability that requires immediate attention and remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.