Multiple vulnerabilities in Exim (October 2, 2023)

unknownCVE-2023-42117 CVE-2023-42118 CVE-2023-42119 CVE-2023-42114 CVE-2023-42115 CVE-2023-42116

On September 27, 2023, Zero Day Initiative (ZDI) published six security advisories [1] regarding zero-day vulnerabilities affecting versions prior to 4.96.1 or 4.97 of the Exim Mail Transfer Agent (MTA). On October 1, 2023, the vendor...

CSIRTS triage

vendor: null product: EximOtheraffected: prior to 4.96.1 or 4.97

What: Multiple zero-day vulnerabilities have been identified.
Who is affected: Deployments of Exim versions prior to 4.96.1 or 4.97.
Urgency: Remediation is urgent due to the presence of zero-day vulnerabilities.
Action: Upgrade to Exim version 4.96.1 or 4.97.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Exim

Get an email when a new Exim advisory drops — max one per day, one-click unsubscribe.

Details

Source: CERT-FR Alertes de sécurité (FR · national-cert · site)
Severity: unknown
Published: 2023-10-02
Exploitation: Not in CISA KEV at last sync
Language: Machine-translated to English — verify against the original

Original advisory: https://www.cert.ssi.gouv.fr/alerte/CERTFR-2023-ALE-010/

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Moderate exploitation riskCVE-2023-421175.7% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 92% of all scored CVEs.
Exploitation likely imminentCVE-2023-42118EPSS puts this in the most-targeted tier (51.5% 30-day exploitation probability). Prioritize alongside KEV items. Riskier than 99% of all scored CVEs.
Moderate exploitation riskCVE-2023-421191.6% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 73% of all scored CVEs.
Elevated exploitation riskCVE-2023-4211428.1% 30-day exploitation probability — well above the norm. Schedule remediation this cycle. Riskier than 98% of all scored CVEs.
Elevated exploitation riskCVE-2023-4211510.0% 30-day exploitation probability — well above the norm. Schedule remediation this cycle. Riskier than 95% of all scored CVEs.
Moderate exploitation riskCVE-2023-421163.2% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 86% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2023-42117	coverage & exploitation status	NVD · CVE.org
CVE-2023-42118	coverage & exploitation status	NVD · CVE.org
CVE-2023-42119	coverage & exploitation status	NVD · CVE.org
CVE-2023-42114	coverage & exploitation status	NVD · CVE.org
CVE-2023-42115	coverage & exploitation status	NVD · CVE.org
CVE-2023-42116	coverage & exploitation status	NVD · CVE.org

Recent advisories for Exim

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

criticalexploitedCVE-2010-4344: Exim Heap-Based Buffer Overflow Vulnerabilitycisa-kev · 2022-03-25
criticalexploitedCVE-2010-4345: Exim Privilege Escalation Vulnerabilitycisa-kev · 2022-03-25
criticalexploitedCVE-2019-16928: Exim Out-of-bounds Write Vulnerabilitycisa-kev · 2022-03-03
criticalexploitedCVE-2019-10149: Exim Mail Transfer Agent (MTA) Improper Input Validationcisa-kev · 2022-01-10
criticalexploitedCVE-2018-6789: Exim Buffer Overflow Vulnerabilitycisa-kev · 2021-11-03