Severe Security Vulnerability in Email Transfer Agent Software Exim Affects About 1.5 Million Email Servers Worldwide

Mail Transfer Agent software (abbreviated as MTA) is primarily responsible for forwarding emails across the network. Exim, an open-source and free software, is a typical example and is widely used as a mail transfer agent.

Exim is designed for Unix and Unix-like systems such as Linux, and its flexibility and configurability make it the preferred mail transfer agent software for many system administrators.

According to internet traffic statistics, 74% of the world's 6.5 million SMTP mail servers can be accessed via Exim (i.e., about 4.83 million servers), and a recently discovered vulnerability in Exim affects over 1.5 million SMTP mail servers.

The cybersecurity company Censys discovered a security vulnerability in Exim, identified as CVE-2024-39929. Exploiting this vulnerability allows attackers to bypass protective mechanisms, enabling them to send unfiltered executable attachments to the end user's mailbox.

This vulnerability affects all versions of Exim, including version 4.97.1. However, not all servers using Exim may be detected due to configuration reasons, and intelligence systems have identified 1.56 million mail servers affected by this issue.

The root of the CVE-2024-39929 vulnerability lies in an error when parsing RFC-2231 headers, which manage the encoding and interpretation of filenames in email attachments. Once exploited, malicious attachments can bypass protective mechanisms and enter the user's mailbox.

Currently, there is no evidence of hackers actively exploiting this vulnerability. However, proof of concept has already appeared in the open-source community, making it only a matter of time before hackers might start exploiting this vulnerability.

On July 10th, Exim released version 4.98 to fix this vulnerability. Along with the fix, the new version of Exim also strengthened the parsing of DKIM DNS records. System administrators using Exim are advised to upgrade to the latest version as soon as possible to ensure security.