CVE-2018-6789

Exim Buffer Overflow

9.8 CRITICALActively exploited (CISA KEV)Used in ransomwarePublic exploitEPSS 82.1%

Published8 Feb 2018
Added to CISA KEV3 Nov 2021
Remediation due3 May 2022

Description

An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. By sending a handcrafted message, a buffer overflow may happen. This can be used to execute code remotely.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Exim< 4.90.1

Canonical Ubuntu Linux14.04 · 16.04 · 17.10

Debian Linux7.0 · 8.0 · 9.0

Remediation

Fixed in

Exim≥ 4.90.1

Patch & vendor advisories

References

http://openwall.com/lists/oss-security/2018/02/10/2Mailing ListThird Party Advisory
http://packetstormsecurity.com/files/162959/Exim-base64d-Buffer-Overflow.htmlExploitThird Party AdvisoryVDB Entry
https://devco.re/blog/2018/03/06/exim-off-by-one-RCE-exploiting-CVE-2018-6789-en/ExploitThird Party Advisory
https://exim.org/static/doc/security/CVE-2018-6789.txtVendor Advisory
https://git.exim.org/exim.git/commit/cf3cd306062a08969c41a1cdd32c6855f1abecf1Patch
https://lists.debian.org/debian-lts-announce/2018/02/msg00009.htmlMailing ListThird Party Advisory
https://usn.ubuntu.com/3565-1/Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-6789US Government Resource
https://www.debian.org/security/2018/dsa-4110Mailing ListThird Party Advisory
https://www.exploit-db.com/exploits/44571/ExploitThird Party AdvisoryVDB Entry

and 4 more references

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2018-6789 being actively exploited?

Yes. CVE-2018-6789 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 3 Nov 2021. It has been used in ransomware campaigns.

How severe is CVE-2018-6789?

CVE-2018-6789 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 82.1% probability of exploitation.

Which products are affected by CVE-2018-6789?

Affected products include Exim, Canonical Ubuntu Linux, Debian Linux.

How do I fix CVE-2018-6789?

Upgrade affected software to a fixed version, for example Exim 4.90.1 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2018-6789 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.