CVE-2019-10149

Description

A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.

References

https://www.tenable.com/cyber-exposure/2020-threat-landscape-retrospective

https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-296a

https://www.tenable.com/blog/government-agencies-warn-of-state-sponsored-actors-exploiting-publicly-known-vulnerabilities

https://www.tenable.com/blog/government-agencies-warn-of-state-sponsored-actors-exploiting-publicly-known-vulnerabilities

https://www.tenable.com/blog/cve-2019-10149-critical-remote-command-execution-vulnerability-discovered-in-exim

https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%2020200528.pdf

https://www.exim.org/static/doc/security/CVE-2019-10149.txt

https://www.debian.org/security/2019/dsa-4456

https://usn.ubuntu.com/4010-1/

https://security.gentoo.org/glsa/201906-01

https://seclists.org/bugtraq/2019/Jun/5

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10149

http://www.openwall.com/lists/oss-security/2021/05/04/7

http://www.openwall.com/lists/oss-security/2019/07/26/4

http://www.openwall.com/lists/oss-security/2019/07/25/7

http://www.openwall.com/lists/oss-security/2019/07/25/6

http://www.openwall.com/lists/oss-security/2019/06/05/3

http://www.openwall.com/lists/oss-security/2019/06/05/2

http://seclists.org/fulldisclosure/2019/Jun/16

http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00020.html

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3