5 ms·

21Nails: Multiple Critical Vulnerabilities in Exim Mail Server

26 points by upofadown 6y ago

mjevans 6y ago
DSA tracks which versions of exim4 have these fixes applied. https://security-tracker.debian.org/tracker/source-package/exim4 https://security-tracker.debian.org/tracker/source-package/e... Please remember to update your mailservers.
jeffbee 6y ago
Proving, again, that “given enough eyeballs, all bugs are shallow” is a lie.
- bokchoi 6y ago
  I hate this maxim. It's my guess that it is only perpetuated by those who haven't worked in software professionally.
- ncmncm 6y ago
  Only one of many falsehoods promoted by ESR, and far from the worst.
  - ldiracdelta 6y ago
    "Erhard Seminars Training"?
_hyn3 6y ago
Exim has had so many serious security vulns. No idea why it is the default in Debian over something far more secure like Postfix.
- gerdesj 6y ago
  What do you think is the worst security vulnerability that email MTAs have to deal with? The MTA itself or the end user? The most secure smtpd will still deliver a nasty email. Note also that someone has actually bothered to do an assessment and published results. Does your preferred MTA enjoy that sort of attention?
- pabs3 6y ago
  Debian has had many discussions over the years about this, they all devolved into bikeshedding about dropping an MTA from the default install vs switching to postfix etc.
tptacek 6y ago
A lot of people believe that Exim is a, let's say, 2nd generation MTA, like qmail and Postfix, both of which were written with security in mind as a reaction to the Sendmail security debacle --- Sendmail holding the title for many years in the 1990s as the most popular and important vector for remote code execution on the Internet. But Exim is much more closely related to Sendmail (I believe it's technically a fork of Smail, which was a Sendmail competitor) than to Postfix or qmail. It parses haphazardly and, as, you can see, it isn't meaningfully privilege-separated. It rides atop all the quirks of the circa-1999 standard C library. Nobody should be running Exim in 2021. In reality, the world is moving on past even the 2nd generation MTAs, which, though their track records are pretty strong, are still built in memory-unsafe languages. Serverside software written in Java, Go, and Rust handle workloads far more difficult than even an ambitious Postfix deployment deals with. Still: it's baffling how we've ended up in a place where Exim --- whose security has been a running joke since the 1990s --- is one of the most popular Unix MTAs. Nobody would have called this outcome in 1999! The funniest part of this advisory starts at "Exim's memory allocator"; just read on for a special Exim bug class. This is great work, and a great writeup.
- gerdesj 6y ago
  "Nobody should be running Exim in 2021." Maybe, yet it still shuffles a lot of email around the place. It deals with a lot of corner cases. When I say corner cases I mean orthogonality that might put off a top class mathematician fresh from fiddling with spherical cows in n dimensions. Email is not simply a bit odd but downright pathologically weird. We all know what email is and it's just so simple. You can use telnet and point it at a smtpd and send a message. HELO me ... mail from: .... rcpt to: .... data .... . (blah blah message_id:x) Yet, for some reason an MTA is a massive edifice of oddities. You could make an MTA that simply shuffles a text stream from a to b but what sort of text stream? MIME encoded doesn't mean what you think it does in quite a lot of cases. MIME is nearly formally defined but as always the beauty is in the eye of the programmer. As well as moving text around a bit, MTAs are asked to do a firewall's role and also integrate with AV and anti spam. Ideally they should also be capable of reading minds. I could go on. Exim is probably not the most beautiful example of modern security practice but it is actively developed by people who do give a shit and are trying to keep something that no one will ever allow to go away working, as best they can. RFC822 (etc, int al, ad nauseam) can never be considered a modern communication technique that will ever lend itself to secure programming practices. Email is never going to be "secure" by worrying about what language an MTA is written in and I think you might have forgotten the worst part of the security circus here: The end user. You can call out the MTA as much as you like but your Go or Rust jobbie will still deliver an email that my Financial Controller clicks on and dumps my bank account. Nobody should be using email in 2021 (discuss ... 8)
technion 6y ago
The largest deployment of this will be web hosting companies running cPanel/WHM (ie, the majority of them). It's part of the default installation there.
posix_me_less 5y ago
Exim is full of bugs, but it is hard to switch to something else. I'd prefer some pragmatic mitigation instead. Anybody using some general mitigations for exim, like running in chroot or in containers? How to set up such thing on CentOS?

26 points by upofadown 6y ago

DSA tracks which versions of exim4 have these fixes applied. https://security-tracker.debian.org/tracker/source-package/exim4 https://security-tracker.debian.org/tracker/source-package/e... Please remember to update your mailservers.

jeffbee 6y ago

Proving, again, that “given enough eyeballs, all bugs are shallow” is a lie.

bokchoi 6y ago
I hate this maxim. It's my guess that it is only perpetuated by those who haven't worked in software professionally.
ncmncm 6y ago
Only one of many falsehoods promoted by ESR, and far from the worst.
- ldiracdelta 6y ago
  "Erhard Seminars Training"?

_hyn3 6y ago

Exim has had so many serious security vulns. No idea why it is the default in Debian over something far more secure like Postfix.

gerdesj 6y ago
What do you think is the worst security vulnerability that email MTAs have to deal with? The MTA itself or the end user? The most secure smtpd will still deliver a nasty email. Note also that someone has actually bothered to do an assessment and published results. Does your preferred MTA enjoy that sort of attention?
pabs3 6y ago
Debian has had many discussions over the years about this, they all devolved into bikeshedding about dropping an MTA from the default install vs switching to postfix etc.

tptacek 6y ago

A lot of people believe that Exim is a, let's say, 2nd generation MTA, like qmail and Postfix, both of which were written with security in mind as a reaction to the Sendmail security debacle --- Sendmail holding the title for many years in the 1990s as the most popular and important vector for remote code execution on the Internet. But Exim is much more closely related to Sendmail (I believe it's technically a fork of Smail, which was a Sendmail competitor) than to Postfix or qmail. It parses haphazardly and, as, you can see, it isn't meaningfully privilege-separated. It rides atop all the quirks of the circa-1999 standard C library. Nobody should be running Exim in 2021. In reality, the world is moving on past even the 2nd generation MTAs, which, though their track records are pretty strong, are still built in memory-unsafe languages. Serverside software written in Java, Go, and Rust handle workloads far more difficult than even an ambitious Postfix deployment deals with. Still: it's baffling how we've ended up in a place where Exim --- whose security has been a running joke since the 1990s --- is one of the most popular Unix MTAs. Nobody would have called this outcome in 1999! The funniest part of this advisory starts at "Exim's memory allocator"; just read on for a special Exim bug class. This is great work, and a great writeup.

gerdesj 6y ago
"Nobody should be running Exim in 2021." Maybe, yet it still shuffles a lot of email around the place. It deals with a lot of corner cases. When I say corner cases I mean orthogonality that might put off a top class mathematician fresh from fiddling with spherical cows in n dimensions. Email is not simply a bit odd but downright pathologically weird. We all know what email is and it's just so simple. You can use telnet and point it at a smtpd and send a message. HELO me ... mail from: .... rcpt to: .... data .... . (blah blah message_id:x) Yet, for some reason an MTA is a massive edifice of oddities. You could make an MTA that simply shuffles a text stream from a to b but what sort of text stream? MIME encoded doesn't mean what you think it does in quite a lot of cases. MIME is nearly formally defined but as always the beauty is in the eye of the programmer. As well as moving text around a bit, MTAs are asked to do a firewall's role and also integrate with AV and anti spam. Ideally they should also be capable of reading minds. I could go on. Exim is probably not the most beautiful example of modern security practice but it is actively developed by people who do give a shit and are trying to keep something that no one will ever allow to go away working, as best they can. RFC822 (etc, int al, ad nauseam) can never be considered a modern communication technique that will ever lend itself to secure programming practices. Email is never going to be "secure" by worrying about what language an MTA is written in and I think you might have forgotten the worst part of the security circus here: The end user. You can call out the MTA as much as you like but your Go or Rust jobbie will still deliver an email that my Financial Controller clicks on and dumps my bank account. Nobody should be using email in 2021 (discuss ... 8)

technion 6y ago

The largest deployment of this will be web hosting companies running cPanel/WHM (ie, the majority of them). It's part of the default installation there.

posix_me_less 5y ago

Exim is full of bugs, but it is hard to switch to something else. I'd prefer some pragmatic mitigation instead. Anybody using some general mitigations for exim, like running in chroot or in containers? How to set up such thing on CentOS?