Exim SMTP listener base64d function one-character buffer overflow

Added: 05/16/2018
CVE: CVE-2018-6789
BID: 103049

Background

Exim is a mail transfer agent used on Unix-like operating systems.

Problem

Exim 5.90 and earlier are vulnerable to a one-character buffer overflow in the **base64d()** function in the SMTP listener.

Resolution

Upgrade to Exim 4.90.1 or higher, apply the update from your system vendor, or apply the patch supplied by Exim.

References

<https://devco.re/blog/2018/03/06/exim-off-by-one-RCE-exploiting-CVE-2018-6789-en/&gt;
<https://exim.org/static/doc/security/CVE-2018-6789.txt&gt;
<https://bugzilla.redhat.com/show_bug.cgi?id=1543268&gt;
<https://bugzilla.novell.com/show_bug.cgi?id=1079832&gt;

Limitations

Exploit works on Exim 4.89 and 4.88 on Debian stretch and Ubuntu zesty.

The target Exim configuration must have an authenticator using base64 enabled. CRAM-MD5 authenticator uses base64 and is enabled by default.

Platforms

Linux