 |
| Over 1.5 Million Email Servers at Risk Due to Critical Exim Vulnerability CVE-2024-39929 |
More than 1.5 million email servers are susceptible to attacks that can deliver executable attachments to user accounts, according to security researchers. These servers run versions of the Exim mail transfer agent that are vulnerable to a critical flaw, CVE-2024-39929, discovered 10 days ago. This vulnerability, with a severity rating of 9.1 out of 10, allows threat actors to easily bypass protections designed to prevent the sending of malicious attachments, which are a primary defense against malware-laden emails.
Researchers from security firm Censys reported on Wednesday that out of the 6.5 million public-facing SMTP email servers found in internet scans, 4.8 million (about 74%) run Exim. Notably, over 1.5 million of these Exim servers, or around 31%, are running a vulnerable version of the open-source mail app.
CVE-2024-39929 stems from an error in how Exim parses multiline headers as specified in RFC 2231. This flaw allows attackers to bypass extension blocking and deliver executable attachments in emails to end users. The vulnerability affects all Exim versions up to and including 4.97.1, but a fix is available in the Release Candidate 3 of Exim 4.98.
Although there are no known reports of active exploitation yet, the ease of attack and the large number of vulnerable servers suggest it’s only a matter of time before active targeting begins. This situation echoes a similar incident in 2020, when the Kremlin-backed Sandworm group exploited a severe Exim vulnerability (CVE-2019-10149) to execute malicious code with root system rights, highlighting the potential risks.
Despite the necessity for users to click on an executable attachment for the attack to succeed, social engineering remains a highly effective method for threat actors. Heiko Schlittermann of the Exim project team confirmed the seriousness of this issue, emphasizing the need for admins to prioritize updating to the latest version.
0 Comments