EXIM has some issues

[mattg]

A number of Zero day exploits that have not been addressed in over a year have been made public.

https://www.zerodayinitiative.com/advis ... I-23-1469/

Reported to vendor in June 2022 apparently.

[palinka]

I'll play it safe and stick with hmailserver.

[Dravion]

A number of Zero day exploits that have not been addressed in over a year have been made public.

https://www.zerodayinitiative.com/advis ... I-23-1469/

Reported to vendor in June 2022 apparently.

This is really Dangerous, it's a RCE Bug (Remote Code Execution). A Attacker can use a peace of Assembly code (a so called exploit) and target this bug by simply using a script (for example a python script) to connect to Exim.on port 25 and execute the exploit within the Exim process (which runs under root/ Super user permissions).

This can be used to takeover the entire Machine with Operating System Superuser permissions. A Attacker can do anything, delete files, modify anything, install new software or install a crypto miner to generate bitcoins or use the box as zombie bot for DDOS Attacks, can modify or delete legit user accounts, steal all the Emails plus Attachements etc. it''s a real Sysadmin Nightmare.

[SorenR]

A number of Zero day exploits that have not been addressed in over a year have been made public.

https://www.zerodayinitiative.com/advis ... I-23-1469/

Reported to vendor in June 2022 apparently.

This is really Dangerous, it's a RCE Bug (Remote Code Execution). A Attacker can use a peace of Assembly code (a so called exploit) and target this bug by simply using a script (for example a python script) to connect to Exim.on port 25 and execute the exploit within the Exim process (which runs under root/ Super user permissions).

This can be used to takeover the entire Machine with Operating System Superuser permissions. A Attacker can do anything, delete files, modify anything, install new software or install a crypto miner to generate bitcoins or use the box as zombie bot for DDOS Attacks, can modify or delete legit user accounts, steal all the Emails plus Attachements etc. it''s a real Sysadmin Nightmare.

So the moral of the story is; Run hMailServer under a low-privilege account.

[Bob.Dig]

So the moral of the story is; Run hMailServer under a low-privilege account.

Doesn't it run as system or something like that? I don't care anymore because for me it is not facing the internet, it is only in the back-end.