CVE-2018-6789 : An issue was discovered in the base64d function in the SMTP listener in Exim bef

An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. By sending a handcrafted message, a buffer overflow may happen. This can be used to execute code remotely.

Published 2018-02-08 23:29:01

Updated 2024-07-25 13:47:23

Source MITRE

View at NVD, CVE.org

Vulnerability category: OverflowExecute code

Products affected by CVE-2018-6789

Debian » Debian Linux » Version: 7.0
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
Matching versions
Debian » Debian Linux » Version: 8.0
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
Matching versions
Debian » Debian Linux » Version: 9.0
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 14.04 ESM Edition
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 17.10
cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 16.04 ESM Edition
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
Matching versions
Exim » Exim
Versions before (<) 4.90.1
cpe:2.3:a:exim:exim:*:*:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2018-6789

Top countries where our scanners detected CVE-2018-6789

Top open port discovered on systems with this issue 80

IPs affected by CVE-2018-6789 22,354

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2018-6789!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

CVE-2018-6789 is in the CISA Known Exploited Vulnerabilities Catalog

This issue is known to have been leveraged as part of a ransomware campaign.

CISA vulnerability name:

Exim Buffer Overflow Vulnerability

CISA required action:

Apply updates per vendor instructions.

CISA description:

Exim contains a buffer overflow vulnerability in the base64d function part of the SMTP listener that may allow for remote code execution.

Notes:

https://nvd.nist.gov/vuln/detail/CVE-2018-6789

Added on 2021-11-03 Action due date 2022-05-03

Exploit prediction scoring system (EPSS) score for CVE-2018-6789

EPSS FAQ

94.06%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 99 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2018-6789

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P	10.0	6.4	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
9.8	CRITICAL	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST	2024-07-25
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2018-6789

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Assigned by: nvd@nist.gov (Primary)
CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2018-6789

https://usn.ubuntu.com/3565-1/

USN-3565-1: Exim vulnerability | Ubuntu security notices
Third Party Advisory
http://www.securitytracker.com/id/1040461

Exim Buffer Overflow in base64d() Lets Remote Users Execute Arbitrary Code - SecurityTracker
Broken Link;Third Party Advisory;VDB Entry
https://www.exploit-db.com/exploits/44571/

Exim < 4.90.1 - 'base64d' Remote Code Execution
Exploit;Third Party Advisory;VDB Entry
https://exim.org/static/doc/security/CVE-2018-6789.txt

Vendor Advisory
http://www.openwall.com/lists/oss-security/2018/02/07/2

oss-security - CVE-2018-6789 Exim 4.90 and earlier: buffer overflow
Mailing List;Third Party Advisory
https://git.exim.org/exim.git/commit/cf3cd306062a08969c41a1cdd32c6855f1abecf1

git.exim.org Git - exim.git/commit
Patch
https://devco.re/blog/2018/03/06/exim-off-by-one-RCE-exploiting-CVE-2018-6789-en/

Exim Off-by-one RCE: Exploiting CVE-2018-6789 with Fully Mitigations Bypassing | DEVCORE
Exploit;Third Party Advisory
http://www.securityfocus.com/bid/103049

Exim 'base64d()' Function Buffer Overflow Vulnerability
Broken Link;Third Party Advisory;VDB Entry
http://openwall.com/lists/oss-security/2018/02/10/2

oss-security - Exim 4.90.1 released. (Was: CVE-2018-6789 Exim 4.90 and earlier: buffer overflow)
Mailing List;Third Party Advisory
https://www.debian.org/security/2018/dsa-4110

Debian -- Security Information -- DSA-4110-1 exim4
Mailing List;Third Party Advisory
https://www.exploit-db.com/exploits/45671/

exim 4.90 - Remote Code Execution
Exploit;Third Party Advisory;VDB Entry
https://lists.debian.org/debian-lts-announce/2018/02/msg00009.html

[SECURITY] [DLA 1274-1] exim4 security update
Mailing List;Third Party Advisory
http://packetstormsecurity.com/files/162959/Exim-base64d-Buffer-Overflow.html

Exim base64d Buffer Overflow ≈ Packet Storm
Exploit;Third Party Advisory;VDB Entry

Jump to