* . *
  • About
  • Advertise
  • Privacy & Policy
  • Contact
Monday, July 7, 2025
Earth-News
  • Home
  • Business
  • Entertainment
    Magicians and Battlebots light up Las Vegas entertainment scene – KSNV

    Magicians and Battlebots Take Las Vegas Entertainment by Storm

    Max-Matching Entertainments & Longhua District form partnership for new entertainment complex – Blooloop

    Max-Matching Entertainments and Longhua District Unite to Launch Thrilling New Entertainment Complex

    Kennedy Publishing, MGA Entertainment Launch Yummiland Magazine – License Global

    Kennedy Publishing, MGA Entertainment Launch Yummiland Magazine – License Global

    MAY HER SOUL REST IN PEACE 🙏 Veteran entertainment columnist and talent manager Lolit Solis has passed away. She was 78 years old. https://tinyurl.com/6kumarkx | LatestChika.com – Facebook

    Beloved Entertainment Icon Lolit Solis Passes Away at 78 – A Life Remembered with Love and Respect 🙏

    Neil Young Plays Rare Full-Band ‘Ambulance Blues’ With The Chrome Hearts – Yahoo

    Neil Young Stuns Fans with Rare Full-Band Performance of ‘Ambulance Blues’ Alongside The Chrome Hearts

    BTS Announce Their Big Return and Yes, They Already Have Some Major Plans in the Works – Yahoo

    BTS Announce Their Big Return and Yes, They Already Have Some Major Plans in the Works – Yahoo

  • General
  • Health
  • News

    Cracking the Code: Why China’s Economic Challenges Aren’t Shaking Markets, Unlike America’s” – Bloomberg

    Trump’s Narrow Window to Spread the Truth About Harris

    Trump’s Narrow Window to Spread the Truth About Harris

    Israel-Gaza war live updates: Hamas leader Ismail Haniyeh assassinated in Iran, group says

    Israel-Gaza war live updates: Hamas leader Ismail Haniyeh assassinated in Iran, group says

    PAP Boss to Niger Delta Youths, Stay Away from the Protest

    PAP Boss to Niger Delta Youths, Stay Away from the Protest

    Court Restricts Protests In Lagos To Freedom, Peace Park

    Court Restricts Protests In Lagos To Freedom, Peace Park

    Fans React to Jazz Jennings’ Inspiring Weight Loss Journey

    Fans React to Jazz Jennings’ Inspiring Weight Loss Journey

    Trending Tags

    • Trump Inauguration
    • United Stated
    • White House
    • Market Stories
    • Election Results
  • Science
  • Sports
  • Technology
    Column: Teach kupuna new technology skills – Honolulu Star-Advertiser

    Empowering Kupuna: Unlocking New Technology Skills for a Connected Future

    EIFO invests $5 million in D3, the Ukraine-focused defence technology venture fund – sUAS News

    EIFO Pledges $5 Million to Supercharge Ukraine-Focused Defense Technology Fund

    New Technology for Water Efficiency and Working with Mexico on Screwworm – AG INFORMATION NETWORK OF THE WEST

    Revolutionary Water Efficiency Technology and Cross-Border Collaboration to Defeat Screwworm

    Environmental cognitive distance, R&D capability distance, and supply chain green technology innovation – Nature

    Bridging Gaps: How Environmental and R&D Differences Drive Green Technology Innovation in Supply Chains

    LG Innotek CEO Moon Hyuksoo: “Our Next-gen Substrate Technology Will Change the Industry Paradigm” – TechPowerUp

    LG Innotek CEO Moon Hyuksoo: “Our Next-Gen Substrate Technology Will Revolutionize the Industry” Revolutionizing the Future: LG Innotek’s CEO Unveils Game-Changing Next-Gen Substrate Technology

    Inspira Technologies Secures Landmark $22.5M Deal: Major Revenue Breakthrough After FDA Clearance – Stock Titan

    Inspira Technologies Secures Landmark $22.5M Deal: Major Revenue Breakthrough After FDA Clearance – Stock Titan

    Trending Tags

    • Nintendo Switch
    • CES 2017
    • Playstation 4 Pro
    • Mark Zuckerberg
No Result
View All Result
  • Home
  • Business
  • Entertainment
    Magicians and Battlebots light up Las Vegas entertainment scene – KSNV

    Magicians and Battlebots Take Las Vegas Entertainment by Storm

    Max-Matching Entertainments & Longhua District form partnership for new entertainment complex – Blooloop

    Max-Matching Entertainments and Longhua District Unite to Launch Thrilling New Entertainment Complex

    Kennedy Publishing, MGA Entertainment Launch Yummiland Magazine – License Global

    Kennedy Publishing, MGA Entertainment Launch Yummiland Magazine – License Global

    MAY HER SOUL REST IN PEACE 🙏 Veteran entertainment columnist and talent manager Lolit Solis has passed away. She was 78 years old. https://tinyurl.com/6kumarkx | LatestChika.com – Facebook

    Beloved Entertainment Icon Lolit Solis Passes Away at 78 – A Life Remembered with Love and Respect 🙏

    Neil Young Plays Rare Full-Band ‘Ambulance Blues’ With The Chrome Hearts – Yahoo

    Neil Young Stuns Fans with Rare Full-Band Performance of ‘Ambulance Blues’ Alongside The Chrome Hearts

    BTS Announce Their Big Return and Yes, They Already Have Some Major Plans in the Works – Yahoo

    BTS Announce Their Big Return and Yes, They Already Have Some Major Plans in the Works – Yahoo

  • General
  • Health
  • News

    Cracking the Code: Why China’s Economic Challenges Aren’t Shaking Markets, Unlike America’s” – Bloomberg

    Trump’s Narrow Window to Spread the Truth About Harris

    Trump’s Narrow Window to Spread the Truth About Harris

    Israel-Gaza war live updates: Hamas leader Ismail Haniyeh assassinated in Iran, group says

    Israel-Gaza war live updates: Hamas leader Ismail Haniyeh assassinated in Iran, group says

    PAP Boss to Niger Delta Youths, Stay Away from the Protest

    PAP Boss to Niger Delta Youths, Stay Away from the Protest

    Court Restricts Protests In Lagos To Freedom, Peace Park

    Court Restricts Protests In Lagos To Freedom, Peace Park

    Fans React to Jazz Jennings’ Inspiring Weight Loss Journey

    Fans React to Jazz Jennings’ Inspiring Weight Loss Journey

    Trending Tags

    • Trump Inauguration
    • United Stated
    • White House
    • Market Stories
    • Election Results
  • Science
  • Sports
  • Technology
    Column: Teach kupuna new technology skills – Honolulu Star-Advertiser

    Empowering Kupuna: Unlocking New Technology Skills for a Connected Future

    EIFO invests $5 million in D3, the Ukraine-focused defence technology venture fund – sUAS News

    EIFO Pledges $5 Million to Supercharge Ukraine-Focused Defense Technology Fund

    New Technology for Water Efficiency and Working with Mexico on Screwworm – AG INFORMATION NETWORK OF THE WEST

    Revolutionary Water Efficiency Technology and Cross-Border Collaboration to Defeat Screwworm

    Environmental cognitive distance, R&D capability distance, and supply chain green technology innovation – Nature

    Bridging Gaps: How Environmental and R&D Differences Drive Green Technology Innovation in Supply Chains

    LG Innotek CEO Moon Hyuksoo: “Our Next-gen Substrate Technology Will Change the Industry Paradigm” – TechPowerUp

    LG Innotek CEO Moon Hyuksoo: “Our Next-Gen Substrate Technology Will Revolutionize the Industry” Revolutionizing the Future: LG Innotek’s CEO Unveils Game-Changing Next-Gen Substrate Technology

    Inspira Technologies Secures Landmark $22.5M Deal: Major Revenue Breakthrough After FDA Clearance – Stock Titan

    Inspira Technologies Secures Landmark $22.5M Deal: Major Revenue Breakthrough After FDA Clearance – Stock Titan

    Trending Tags

    • Nintendo Switch
    • CES 2017
    • Playstation 4 Pro
    • Mark Zuckerberg
No Result
View All Result
Earth-News
No Result
View All Result
Home Technology

Critical vulnerabilities in Exim threaten over 250k email servers worldwide

September 30, 2023
in Technology
Critical vulnerabilities in Exim threaten over 250k email servers worldwide
Share on FacebookShare on Twitter

NOT A GOOD LOOK —

Remote code execution requiring no authentication fixed. 2 other RCEs remain unpatched.

Dan Goodin
– Sep 29, 2023 10:59 pm UTC

Critical vulnerabilities in Exim threaten over 250k email servers worldwide

Getty Images

Thousands of servers running the Exim mail transfer agent are vulnerable to potential attacks that exploit critical vulnerabilities, allowing remote execution of malicious code with little or no user interaction.

The vulnerabilities were reported on Wednesday by Zero Day Initiative, but they largely escaped notice until Friday when they surfaced in a security mail list. Four of the six bugs allow for remote code execution and carry severity ratings of 7.5 to 9.8 out of a possible 10. Exim said it has made patches for three of the vulnerabilities available in a private repository. The status of patches for the remaining three vulnerabilities—two of which allow for RCE—are unknown. Exim is an open source mail transfer agent that is used by as many as 253,000 servers on the Internet.

“Sloppy handling” on both sides

ZDI provided no indication that Exim has published patches for any of the vulnerabilities, and at the time this post went live on Ars, the Exim website made no mention of any of the vulnerabilities or patches. On the OSS-Sec mail list on Friday, an Exim project team member said that fixes for two of the most severe vulnerabilities and a third, less severe one are available in a “protected repository and are ready to be applied by the distribution maintainers.”

There were no more details about the fixes, precisely how admins obtain them, or if there are mitigations available for those who can’t patch right away. Exim project team members didn’t respond to an email asking for additional information.

The most severe of the vulnerabilities, tracked as CVE-2023-42115, is among those that the Exim team member said have been patched. ZDI described it as an out-of-bounds flaw in an Exim component that handles authentication.

“This vulnerability allows remote attackers to execute arbitrary code on affected installations of Exim,” Wednesday’s advisory stated. “Authentication is not required to exploit this vulnerability.”

Another patched vulnerability, tracked as CVE-2023-42116, is a stack-based overflow in the Exim challenge component. Its severity rating is 8.1 and also allows for RCE.

“The specific flaw exists within the handling of NTLM challenge requests,” ZDI said. “The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account.”

The third fixed vulnerability is tracked as CVE-2023-42114, which allows for disclosure of sensitive information. It carries a rating of 3.7.

Some critics have called out the Exim project for not transparently disclosing the vulnerabilities. Adding more fuel to the critiques, the ZDI disclosures provided a timeline that indicated company representatives notified Exim project members of the vulnerabilities in June 2022. A handful of back-and-forth interactions occurred over the intervening months until ZDI disclosed them Wednesday.

In a post on Friday to the OSS-Sec mail list, Exim project team member Heiko Schlittermann said that after receiving the private ZDI report in June 2022, team members asked for additional details “but didn’t get answers we were able to work with.” The next contact didn’t occur until May 2023. “Right after this contact we created project bug tracker for 3 of the 6 issues,” Schlittermann said. “The remaining issues are debatable or miss information we need to fix them.”

Some people participating in the discussion criticized both sides.

“This looks like sloppy handling of these issues so far by both ZDI and Exim—neither team pinging the other for 10 months, then Exim taking 4 months to fix even the 2 high-scored issues it did have sufficient info on,” the distinguished security researcher known as Solar Designer wrote. “What are you doing to improve the handling from this point on?”

The critic also asked Schlittermann when OS distributions will be permitted to make the Exim updates public since the fixes are currently in a protected repository. “I suggest that you set a specific date/time e.g. in 2 days from now when both the Exim project will make the repo and the fixed bug entries … public _and_ distros will release updates.”

No one from Exim responded to those questions or, as mentioned earlier, to questions Ars sent by email shortly afterward.

With only a limited number of details becoming available so late on a Friday, patching and potential mitigations may not be as straightforward as some admins might hope. Despite any potential hardships, the vulnerabilities sound serious. In 2020, the National Security Agency reported that hackers in Sandworm, an elite threat actor backed by the Kremlin, had been exploiting a critical Exim vulnerability to compromise networks belonging to the US government and its partners. Now that new Exim vulnerabilities have come to light, it wouldn’t be surprising if threat actors hope to capitalize on them.

>>> Read full article>>>
Copyright for syndicated content belongs to the linked Source : Ars Technica – https://arstechnica.com/?p=1972409

Tags: criticaltechnologyvulnerabilities
Previous Post

WHO says flu vaccines should ditch strain that vanished during COVID

Next Post

Archaeologists discover ancient sandals buried in a bat cave 6000 years ago

Intl forum on ecology opens with over 1,000 domestic and foreign guests – China Daily

Intl forum on ecology opens with over 1,000 domestic and foreign guests – China Daily

July 7, 2025
How New DNA Science Could Help More Families of the Missing – The New York Times

How New DNA Science Could Help More Families of the Missing – The New York Times

July 7, 2025
Letter | Dismissing science comes at a cost – thegazette.com

The High Cost of Ignoring Science

July 7, 2025
Hyatt Pushes Lifestyle Brands Into Asia Pacific Region – Luxury Travel Advisor

Hyatt Pushes Lifestyle Brands Into Asia Pacific Region – Luxury Travel Advisor

July 7, 2025
Kylian Mbappé’s stunning bicycle kick propels Real Madrid to win over Borussia Dortmund, and Club World Cup semifinals – CNN

Kylian Mbappé’s Spectacular Bicycle Kick Secures Real Madrid’s Victory Over Borussia Dortmund and Spot in Club World Cup Semifinals

July 7, 2025
Inside Iran’s war economy – The Economist

Inside the Secret Power Struggles Fueling Iran’s War Economy

July 7, 2025

Santa Cruz Shakespeare Launches Exciting New Monday Night Series

July 7, 2025
When it comes to vaccines, how are pediatricians restoring trust? – NPR

How Pediatricians Are Rebuilding Trust in Vaccines for Children

July 7, 2025
The battle to sway voters over Trump’s ‘big, beautiful bill’ begins – CNN

The battle to sway voters over Trump’s ‘big, beautiful bill’ begins – CNN

July 7, 2025
Column: Teach kupuna new technology skills – Honolulu Star-Advertiser

Empowering Kupuna: Unlocking New Technology Skills for a Connected Future

July 6, 2025

Categories

Archives

July 2025
MTWTFSS
 123456
78910111213
14151617181920
21222324252627
28293031 
« Jun    
Earth-News.info

The Earth News is an independent English-language daily published Website from all around the World News

Browse by Category

  • Business (20,132)
  • Ecology (708)
  • Economy (733)
  • Entertainment (21,621)
  • General (15,750)
  • Health (9,771)
  • Lifestyle (738)
  • News (22,149)
  • People (734)
  • Politics (742)
  • Science (15,950)
  • Sports (21,232)
  • Technology (15,717)
  • World (714)

Recent News

Intl forum on ecology opens with over 1,000 domestic and foreign guests – China Daily

Intl forum on ecology opens with over 1,000 domestic and foreign guests – China Daily

July 7, 2025
How New DNA Science Could Help More Families of the Missing – The New York Times

How New DNA Science Could Help More Families of the Missing – The New York Times

July 7, 2025
  • About
  • Advertise
  • Privacy & Policy
  • Contact

© 2023 earth-news.info

No Result
View All Result

© 2023 earth-news.info

No Result
View All Result

© 2023 earth-news.info

Go to mobile version