SecPod

Learn Search

Search across all Learn content

← Back to Expressions & POVs
The Exim Mail Server Trilogy

The Exim Mail Server Trilogy

Sep 30, 2019By Vidita V Koushik2 min read

Exim is the most used MX server with more than 57% of installations on mail servers reachable on the Internet. Exim has released an urgent security update today. The vendor had released an early security warning to install the updates immediately after release. The vulnerability is tracked as CVE-2019-16928 and classified as heap-based buffer overflow (CWE-122) using a vulnerability scanning tool.

The flaw exists in ‘string_vformat’ in file string.c‘. Heap based buffer overflow allows attackers to potentially execute arbitrary code or crash the application. The bug is essentially a simple coding error where the length of the EHLO string taken into consideration and corrected with a one line fix handling the length of string sent to the buffer. A patch management tool can patch this bug.

fig. fixed patch for vulnerability

Proof of Concept

A Proof of Concept published by Jeremy Harris of Exim Development Team. While this exploit uses a specially crafted EHLO string to only crash the Exim process, there could be other commands to execute arbitrary code. However, an unauthenticated remote attacker can cause denial of service by sending an extended EHLO string with large amounts of data.

A month ago, Exim mail server patched for a criticalremote code execution vulnerability (CVE-2019-15846) which allowed a remote unauthenticated attacker to execute programs with root privileges. In July, Exim patched for another critical remote command execution vulnerability (CVE-2019-10149) which actively exploited in the wild. Get detailed information about these vulnerabilities in our blogs on CVE-2019-15846 and CVE-2019-10149. We request system administrators to install the latest updates for Exim Mail Server as soon as possible.

Affected Products by heap based buffer overflow:
Exim Mail Server versions 4.92 through 4.92.2.

Impact:
An attacker can execute arbitrary code or cause a denial of service.

Solution to heap based buffer overflow:
Also, please refer to this KB Article, which now replaced by KB Article, to apply the patches using SanerNow.

Featured Posts

Open The Most Effective Vulnerability Assessment Framework What Makes One Effective
The Most Effective Vulnerability Assessment Framework What Makes One Effective

Point of View

The Most Effective Vulnerability Assessment Framework What Makes One Effective

No single named standard makes a vulnerability assessment framework effective. This piece covers NIST, ISO, and CIS Controls, then breaks down what actually separates a working framework from a checklist, coverage, risk based prioritization, cadence, ownership, and a feedback loop.

Sep 11, 2026

Open Threat and Vulnerability Assessment How Risk Actually Gets Calculated
Threat and Vulnerability Assessment How Risk Actually Gets Calculated

Point of View

Threat and Vulnerability Assessment How Risk Actually Gets Calculated

A vulnerability alone doesn't tell the whole risk story. This piece breaks down how a threat and vulnerability assessment pairs technical weaknesses with real attacker context, walks through the six step process, and covers frameworks like NIST 800-30 and ISO 27005.

Sep 11, 2026

Open Vulnerability Assessment Services: What to Look For
Vulnerability Assessment Services: What to Look For

Point of View

Vulnerability Assessment Services: What to Look For

Choosing a vulnerability assessment provider means asking about actual coverage, scan frequency, and whether findings come with real prioritization or just a CVSS dump. This piece breaks down what strong vulnerability assessment services include, red flags to avoid, and questions to ask before signing.

Sep 11, 2026

Open Agentic AI Vulnerability Assessment What Changes and What Does Not
Agentic AI Vulnerability Assessment What Changes and What Does Not

Point of View

Agentic AI Vulnerability Assessment What Changes and What Does Not

Agentic AI is expanding what a vulnerability assessment needs to cover, autonomous agents bring their own credentials, tool access, and memory, adding a genuinely new asset class alongside servers and endpoints. It's also compressing attacker timelines and introducing risk categories like goal hijacking and tool misuse that don't map to a traditional CVE. But the core discipline hasn't changed: the same lifecycle of scoping, scanning, prioritizing, and remediating still applies, human judgment still drives prioritization, and accountability still sits with the people who deployed the agent, not the agent itself.

Sep 9, 2026