Exim 4.88 < 4.99.4 Information Disclosure

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(318666);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/06/04");

  script_cve_id("CVE-2026-48840");

  script_name(english:"Exim 4.88 < 4.99.4 Information Disclosure");

  script_set_attribute(attribute:"synopsis", value:
"The remote mail server is potentially affected by an information disclosure vulnerability.");
  script_set_attribute(attribute:"description", value:
"According to its banner, the version of Exim running on the remote host is 4.88 or later but prior to 4.99.4. It is,
therefore, potentially affected by an information disclosure vulnerability.

  - Exim 4.88 before 4.99.4, in some proxy configurations, mishandles certain short payloads, leading to disclosure
    of uninitialized stack memory values to a client. (CVE-2026-48840)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://www.exim.org/static/doc/security/EXIM-Security-2026-05-19.1/EXIM-Security-2026-05-19.1.txt
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8a32b012");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Exim 4.99.4 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-48840");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/05/29");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/05/29");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/06/04");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:exim:exim");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"SMTP problems");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("smtpserver_detect.nasl");
  script_require_keys("Settings/ParanoidReport");
  script_require_ports("Services/smtp", 25);

  exit(0);
}

include('compat_shared.inc');
include('smtp_func.inc');

# Requires SUPPORT_PROXY compiled in and hosts_proxy configured
if (report_paranoia < 2) audit(AUDIT_PARANOID);

var port = get_service(svc:'smtp', default:25, exit_on_fail:TRUE);

var banner = get_smtp_banner(port:port);
if (!banner) audit(AUDIT_NO_BANNER, port);
if ('Exim' >!< banner) audit(AUDIT_NOT_LISTEN, 'Exim', port);

var matches = pregmatch(pattern:"220.*Exim ([0-9\\._]+)", string:banner);
if (isnull(matches)) audit(AUDIT_SERVICE_VER_FAIL, 'Exim', port);

var version = matches[1];
# Underscore was added to the version
version = ereg_replace(string:version, pattern:'_', replace:'.');

if (ver_compare(ver:version, minver:'4.88', fix:'4.99.4', strict:FALSE) < 0)
{
  var items = {
    'Banner': banner,
    'Installed version': version,
    'Fixed version': '4.99.4'
  };
  var ordering = ['Banner', 'Installed version', 'Fixed version'];
  var report = report_items_str(report_items:items, ordered_fields:ordering);

  security_report_v4(port:port, severity:SECURITY_WARNING, extra:report);
}
else audit(AUDIT_LISTEN_NOT_VULN, 'Exim', port, version);