HC3 TLP White Sector Alert: EXIM Mail Transfer Agent (MTA) Vulnerabilities - May 6, 2021

In October 2020, security researchers at Qualys discovered 21 unique vulnerabilities in EXIM, an open source MTA for Unix-like operating systems. Researchers provided a proof of concept that gave a breakdown of methods to exploit. According to researchers, 10 vulnerabilities can be exploited remotely and the remaining 11 could possibly be exploited locally. Researchers warned that some of the vulnerabilities can be chained together to obtain a full remote unauthenticated code execution and gain root privileges on the EXIM Server. On May 4, 2021, a coordinated security advisory was released confirming 21 vulnerabilities affecting EXIM. Proof of concept and intricate details of vulnerabilities can be found via Qualys Report. View the entire sector alert and feedback form under Key Resources.