CVE-2019-19920

What it actually does

The vulnerability permits arbitrary code execution because Greylisting.pm invokes Perl eval on untrusted data from .cf files or rules without taint checking or safe parsing.

Why it matters to the business

Compromise of mail servers allows attackers to run commands, access or alter email traffic, and pivot into the broader environment, causing service outages and data loss.

How an attack unfolds

An attacker writes a malicious .cf file or rule containing Perl code; when the greylisting module loads and evaluates the file, the injected code executes with the privileges of the mail process.

How to fix it

Remove or disable the vulnerable Greylisting.pm module, replace sa-exim with a maintained alternative, and ensure no untrusted configuration data reaches eval.

How to confirm the fix worked

Inspect installed sa-exim packages and Greylisting.pm source for direct eval usage on external input; verify that taint mode or safe parsing is enforced.

Typical attack path

1. Locate a writable directory used by sa-exim for .cf or rule files
2. Place attacker-controlled Perl code inside the file
3. Trigger greylisting evaluation (e.g., via SMTP transaction)
4. Achieve arbitrary command execution on the host

How to detect it

Review mail logs and process execution history for unexpected Perl evaluations or child processes spawned from the sa-exim context; search filesystem for recently added .cf files containing eval or system calls.

What your security team should do

• Audit all mail servers for presence of sa-exim and the Greylisting module
• Block or restrict write access to directories that feed .cf or rule files
• Implement application allow-listing for mail-filter processes