CVE-2023-42119

What it actually does

Out-of-bounds read in Exim's dnsdb handling within the SMTP service allows reading past an allocated buffer, disclosing sensitive memory contents to network-adjacent unauthenticated attackers.

Why it matters to the business

Attackers on the same network segment may obtain internal configuration or data fragments from the mail server; combined with additional vulnerabilities this can lead to service compromise and operational disruption.

How an attack unfolds

An attacker on the local network connects to the Exim SMTP listener on TCP 25, supplies crafted input that triggers the dnsdb out-of-bounds read, and extracts leaked memory contents; the disclosed data may then be used to craft follow-on attacks that achieve code execution under the service account.

How to fix it

Upgrade Exim to the commit de76e9b07d0b6e463f0d6c24b3695966218809dd or later; apply the corresponding fixed packages for any affected distributions; restrict network access to TCP 25 to trusted adjacent hosts until patches are deployed.

How to confirm the fix worked

Verify the running Exim binary or source matches the fixed commit de76e9b07d0b6e463f0d6c24b3695966218809dd; attempt reproduction of the out-of-bounds read with a test SMTP transaction and confirm no excess data is returned.

Typical attack path

1. Locate an Exim instance reachable on the local network segment
2. Establish an unauthenticated TCP connection to port 25
3. Send SMTP commands containing data that exercises the vulnerable dnsdb code path
4. Observe the out-of-bounds memory disclosure in server responses
5. Leverage obtained information with additional exploits to execute arbitrary code

How to detect it

Review SMTP transaction logs on port 25 for unusual or malformed DNS-related queries; inspect process memory dumps or core files for unexpected buffer contents following SMTP sessions; correlate with network flow data showing repeated connections from adjacent hosts.

What your security team should do

• Apply the fixed Exim commit immediately on all internet-facing and internal mail servers
• Restrict SMTP listener access to authorized network segments via firewall rules
• Monitor for any new public exploit code and reassess EPSS score weekly
• Audit mail server configurations for unnecessary dnsdb lookups