Partner with Censys and empower customers with the Internet context that powers the modern SOC. The Censys Partner Program offers opportunities to expand your reach, with support from Censys every step of the way.
Threat, vulnerability, and Internet intelligence built from expansive first-party visibility. The mission: to illuminate Internet behaviors that impact our world.
Partner with Censys and empower customers with the Internet context that powers the modern SOC. The Censys Partner Program offers opportunities to expand your reach, with support from Censys every step of the way.
Threat, vulnerability, and Internet intelligence built from expansive first-party visibility. The mission: to illuminate Internet behaviors that impact our world.
Issue Name and Description: A vulnerability in Exim MTA due to a bug in RFC 2231 header parsing could potentially allow remote attackers to deliver malicious attachments to user inboxes.
Asset Description:
Exim is a free mail transfer agent (MTA) that’s widely used on Unix-like operating systems. This vulnerability affects Exim releases up to and including 4.97.1
Of the 6,540,044 public facing SMTP mail servers Censys sees online, 4,830,719 (~74%) are running Exim, highlighting how widespread it is.
Vulnerability Impact: The vulnerability could allow a remote attacker to bypass filename extension blocking protection measures and deliver executable attachments directly to end-users’ mailboxes. If a user were to download or run one of these malicious files, the system could be compromised.
Exploitation Details: A PoC is available, but no active exploitation is known yet.
Censys Perspective: As of July 10, 2024, Censys observes 1,567,109 publicly exposed Exim servers running a potentially vulnerable version (4.97.1 or earlier), concentrated mostly in the United States, Russia, and Canada. So far, 82 public-facing servers show indications of running a patched release of 4.98.
Detection with Censys: The following queries can be leveraged to identify Censys-visible public-facing Exim instances running potentially vulnerable versions affected by this CVE.
