CVE-2023-42115

What it actually does

Out-of-bounds write in Exim SMTP AUTH command processing on TCP port 25 allows remote unauthenticated attackers to overwrite memory and execute arbitrary code in the service account context.

Why it matters to the business

Successful exploitation can fully compromise mail servers, leading to email interception, data exfiltration, service outages, and potential lateral movement with high urgency due to rising exploit probability.

How an attack unfolds

An unauthenticated remote attacker connects to the exposed SMTP service and submits a crafted AUTH command that bypasses input validation, causing an out-of-bounds write that corrupts adjacent memory structures and redirects execution to attacker-controlled code.

How to fix it

Upgrade all Exim installations to the fixed commit b9e0b12d9b665bbff996382264d4ba97d1a61efd or later; rebuild from the patched GIT source and restart the service.

How to confirm the fix worked

Confirm the running Exim binary was built from a tree containing commit b9e0b12d9b665bbff996382264d4ba97d1a61efd and perform authenticated version checks or fuzzing against the AUTH handler.

Typical attack path

1. Scan for publicly reachable Exim SMTP listeners on TCP 25
2. Send malformed AUTH command to trigger the out-of-bounds write
3. Overwrite return addresses or function pointers with shellcode
4. Execute arbitrary commands under the Exim service account
5. Establish persistence or pivot within the environment

How to detect it

Inspect Exim main and panic logs for repeated or malformed AUTH attempts, unexpected process terminations, or memory-corruption related errors around SMTP connections.

What your security team should do

• Apply the upstream fix immediately given the critical CVSS and increasing EPSS trend
• Temporarily restrict unauthenticated SMTP access via firewall rules until patched
• Enable enhanced logging of AUTH commands and monitor for service crashes
• Scan the environment for any remaining vulnerable Exim versions