CVE-2023-42114

What it actually does

Out-of-bounds read in NTLM challenge request handling due to missing validation of user-supplied data, allowing disclosure of memory contents in the service account context.

Why it matters to the business

Attackers can obtain limited sensitive information from mail servers without authentication, increasing risk of further compromise; the flaw has been public for over two years with moderate exploit prediction scores.

How an attack unfolds

A remote unauthenticated attacker sends a specially crafted NTLM challenge request to the Exim server; the server fails to validate the supplied data length, reads past the end of an allocated structure, and returns memory contents to the attacker.

How to fix it

Upgrade Exim to the commit b9e0b12d9b665bbff996382264d4ba97d1a61efd or later; if immediate patching is not possible, restrict NTLM authentication or apply network access controls.

How to confirm the fix worked

Verify the installed Exim binary or source matches a build containing commit b9e0b12d9b665bbff996382264d4ba97d1a61efd; re-test NTLM challenge handling with boundary values after upgrade.

Typical attack path

1. Identify exposed Exim SMTP services
2. Craft and send a malformed NTLM challenge request
3. Trigger the out-of-bounds read during challenge processing
4. Receive leaked memory contents containing sensitive information

How to detect it

Search mail server logs for unusual or malformed NTLM challenge requests; inspect process memory dumps or network captures around the time of suspicious SMTP sessions for signs of unexpected data leakage.

What your security team should do

• Prioritize upgrade of all Exim instances to the fixed commit within the next maintenance window
• Review and restrict exposure of SMTP services accepting NTLM authentication
• Monitor EPSS trends and any new public exploits for this issue