CVE-2023-42116

What it actually does

Stack-based buffer overflow in Exim's handling of NTLM challenge requests due to missing length validation on user-supplied data copied into a fixed-size stack buffer, enabling remote code execution in the context of the Exim service account without authentication.

Why it matters to the business

Compromise of mail servers can lead to unauthorized access to email traffic, data exfiltration, or use as a foothold for further network attacks; the vulnerability has been public for over two years with slowly rising exploit probability.

How an attack unfolds

An unauthenticated attacker connects to an exposed Exim SMTP service and sends a specially crafted NTLM challenge request containing oversized data; the lack of bounds checking overflows the stack buffer, allowing the attacker to overwrite the return address and execute arbitrary code.

How to fix it

Upgrade Exim to the commit b9e0b12d9b665bbff996382264d4ba97d1a61efd or later; rebuild from the fixed GIT source and redeploy; disable NTLM authentication if not required until patched.

How to confirm the fix worked

Verify the running Exim binary or source matches commit b9e0b12d9b665bbff996382264d4ba97d1a61efd; test SMTP AUTH NTLM handling with crafted oversized challenges in a lab environment to confirm absence of crash or code execution.

Typical attack path

1. Establish TCP connection to Exim SMTP listener (typically port 25/587)
2. Issue AUTH NTLM or equivalent challenge initiation command
3. Supply oversized NTLM challenge data exceeding buffer capacity
4. Trigger return-address overwrite to redirect execution to attacker-controlled payload
5. Achieve code execution within the Exim process context

How to detect it

Inspect Exim SMTP logs and network captures for NTLM AUTH sequences containing unusually large challenge payloads; correlate with process crashes or unexpected child process spawns under the Exim service account.

• NTLM challenge lengths exceeding typical 1-2 KB in SMTP AUTH transactions
• Exim process segfault or abort signals immediately following AUTH NTLM commands
• Unexpected execution of /bin/sh or similar shells spawned from the Exim daemon

What your security team should do

• Immediately upgrade all Exim installations to the fixed commit b9e0b12d9b665bbff996382264d4ba97d1a61efd
• Restrict inbound SMTP access to trusted sources until patches are applied
• Monitor EPSS trend and threat intelligence feeds for any increase in exploitation activity
• Review mail server logs for anomalous NTLM authentication attempts