CVE-2023-42115
Published: 03 May 2024
Summary
CVE-2023-42115 is a critical-severity Out-of-bounds Write (CWE-787) vulnerability in Exim Exim. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 1.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2023-42115 is an out-of-bounds write vulnerability in the SMTP service of Exim mail transfer agent installations. The flaw resides in the handling of AUTH commands on the default TCP port 25 listener and results from missing validation of attacker-supplied data, which permits a write past the end of an allocated buffer. It was originally reported as ZDI-CAN-17434 and carries a CVSS v3 score of 9.8.
Unauthenticated remote attackers can send specially crafted SMTP traffic to trigger the flaw and achieve arbitrary code execution in the context of the Exim service account. No user interaction or prior authentication is required for successful exploitation.
The referenced Zero Day Initiative advisory ZDI-23-1469 documents the issue but does not detail specific patch versions or mitigation steps in the supplied information. The associated EPSS score has reached a peak of 0.7290 with a current value of 0.6581.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-46574
Vulnerability details
Exim AUTH Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Exim. Authentication is not required to exploit this vulnerability. The specific flaw exists within the smtp service, which listens…
more
on TCP port 25 by default. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of a buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. . Was ZDI-CAN-17434.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Out-of-bounds writes that corrupt control flow or inject shellcode are rendered non-executable by the same memory protections.