A critical vulnerability in the Exim service allows cybercriminals to deliver malicious attachments to users' inboxes .
The vulnerability, tracked as CVE-2024-39929, has a CVSS score of 9.1/10.0. The developers of the message transfer agent (MTA) patched the vulnerability in version 4.98.
See also: Palo Alto: Fixes critical vulnerability in Expedition Migration Tool
“Exim up to version 4.97.1 incorrectly parses a multiline RFC 2231 header filename, allowing remote attackers to bypass a protection $mime_filename extension-blocking and deliver executables, as attachments, to end-user mailboxes,” according to a description of the vulnerability.
If a user downloads or executes one of these malicious attachments, system may be compromised.
Currently, there are no reports of active exploitation of the Exim vulnerability. Users should apply the update immediately to prevent potential attacks.
See also: PHP vulnerability used to distribute malware and DDoS attacks
Exim is a free mail transfer agent, used on computers running Unix or Unix-like operating systems. It was first released in 1995 for use at the University of Cambridge.
According to Censys, 4,830,719 of the 6,540,044 public-facing SMTP mail servers are running Exim. As of July 12, 2024, 1,563,085 Exim servers with Internet access are running a potentially vulnerable version (4.97.1 or earlier). The majority of vulnerable devices are located in the United States, Russia, and Canada.
See also: MHTML: Zero-day vulnerability used in attacks for 18 months
The disclosure of the CVE-2024-39929 vulnerability highlights the importance of regularly updating and securing critical systems. With the rise of sophisticated cyberattacks ,it is vital for organizations to remain vigilant and ensure that their systems are protected from potential threats. By staying informed and implementing the necessary security measures, businesses can mitigate the risks posed by vulnerabilities like the one in Exim.
Source: thehackernews.com
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
