Exim Servers Vulnerable to Remote Command Execution Flaw

Researchers at Qualys discovered a remote command execution vulnerability, CVE-2019-10149, that affects Exim, a mail transfer agent which, as of June 2019, runs on over half of all mail servers visible on the internet. The vulnerability affects installations of version 4.87 to 4.91 and could allow a remote or local threat actor to run commands on the Exim server as root and take over systems. The NJCCIC recommends administrators update their Exim servers to version 4.92, released in February 2019. More information can be found in the Qualys security advisory.

AdvisoryNJCCICmail, exim