CVE-2017-1000369

What it actually does

Exim's handling of multiple -p command line arguments results in repeated malloc allocations that are never freed, enabling memory corruption that can be chained with other issues to achieve arbitrary code execution on affected versions 4.89 and earlier.

Why it matters to the business

Compromised mail servers could allow attackers to run malicious code, risking email data exposure, service outages, or use as an entry point for further network access; the issue has been public for years with minimal observed exploitation.

How an attack unfolds

An attacker invokes the Exim binary locally or via a wrapper with repeated -p arguments; the resulting unfreed allocations are leveraged alongside other memory issues to corrupt control structures and redirect execution to attacker-controlled code.

How to fix it

Upgrade exim/exim to the commit 65e061b76867a9ea7aeeb535341b790b90ae6c21 or later; for Chainguard and Wolfi kargo packages, ensure the fixed version 0 or newer is deployed.

How to confirm the fix worked

Confirm the installed Exim binary reports a version containing commit 65e061b76867a9ea7aeeb535341b790b90ae6c21; review build logs or package manifests to verify the patch is present.

Typical attack path

1. Invoke Exim with multiple -p command line arguments
2. Trigger repeated malloc without corresponding free operations
3. Combine with additional memory corruption primitives
4. Achieve arbitrary code execution within the Exim process

How to detect it

Search process execution and command-line audit logs for Exim invocations containing multiple -p flags; examine core dumps or memory traces for patterns of repeated allocations without frees around Exim startup.

• exim.*-p.*-p
• multiple -p arguments in exim command line

What your security team should do

• Apply the referenced upstream commit or updated package immediately on all Exim deployments
• Restrict local access to the Exim binary to only trusted users and processes
• Audit command-line invocation logs for repeated -p arguments
• Replace Exim with a maintained MTA if long-term support is uncertain