Added: 05/16/2018
CVE: CVE-2018-6789
BID: 103049
Exim is a mail transfer agent used on Unix-like operating systems.
Exim 5.90 and earlier are vulnerable to a one-character buffer overflow in the **base64d()**
function in the SMTP listener.
Upgrade to Exim 4.90.1 or higher, apply the update from your system vendor, or apply the patch supplied by Exim.
<https://devco.re/blog/2018/03/06/exim-off-by-one-RCE-exploiting-CVE-2018-6789-en/>
<https://exim.org/static/doc/security/CVE-2018-6789.txt>
<https://bugzilla.redhat.com/show_bug.cgi?id=1543268>
<https://bugzilla.novell.com/show_bug.cgi?id=1079832>
Exploit works on Exim 4.89 and 4.88 on Debian stretch and Ubuntu zesty.
The target Exim configuration must have an authenticator using base64 enabled. CRAM-MD5 authenticator uses base64 and is enabled by default.
Linux