Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Cybercrime

Several Exim Vulnerabilities Exploited in Russia-Linked Attacks

Several vulnerabilities affecting the Exim mail transfer agent (MTA) have been exploited by Russia-linked hackers, and administrators have been urged to patch immediately, but hundreds of thousands of servers remain unpatched.

Several vulnerabilities affecting the Exim mail transfer agent (MTA) have been exploited by Russia-linked hackers, and administrators have been urged to patch immediately, but hundreds of thousands of servers remain unpatched.

The U.S. National Security Agency (NSA) issued an alert last week to urge users to update their Exim servers to version 4.93 or newer, as earlier versions are impacted by vulnerabilities that have been exploited by a hacker group with ties to the Russian military.

The NSA mentioned CVE-2019-10149, an Exim vulnerability that allows remote code execution as root. The flaw was patched in February 2019 with the release of version 4.92, but it was only identified as a vulnerability in May 2019 and its impact was made public the next month. According to the NSA, it has been exploited by Russian state-sponsored hackers since at least August 2019.

However, threat intelligence company RiskIQ says there are two other Exim vulnerabilities that have been exploited in the same campaign: CVE-2019-15846, a remote code execution vulnerability patched in September 2019 that impacts version 4.92.1 and earlier, and CVE-2019-16928, a DoS and code execution vulnerability affecting versions 4.92 through 4.92.2.

Over the course of May, RiskIQ said it identified more than 900,000 vulnerable Exim servers. While a majority are running Exim 4.92, which patches CVE-2019-10149, the other two vulnerabilities still expose servers to attacks, which is likely why the NSA has advised users to update to version 4.93.

RiskIQ noted that the number of vulnerable servers steadily decreased in May, but there are still hundreds of thousands of vulnerable servers.

A Shodan search currently shows over one million Exim servers running version 4.92 and more than 250,000 instances with version 4.91.

The threat group exploiting these vulnerabilities is tracked as Sandworm and TeleBots, and it has been linked to Russia’s General Staff Main Intelligence Directorate (GRU). While the NSA has not released any information on the targets of this campaign, Sandworm has been known to attack a wide range of organizations in Europe and the United States.

Advertisement. Scroll to continue reading.

Related: Russian Hackers Target European Governments Ahead of Elections: FireEye

Related: Hackers Target Recent Vulnerability in Exim Mail Server

Related: NSA: Russian Agents Have Been Hacking Major Email Program

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Understand how to go beyond effectively communicating new security strategies and recommendations.

Register

Join us for an in depth exploration of the critical nature of software and vendor supply chain security issues with a focus on understanding how attacks against identity infrastructure come with major cascading effects.

Register

Expert Insights

Related Content

Vulnerabilities

Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Cybercrime

The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.

Cybercrime

As it evolves, web3 will contain and increase all the security issues of web2 – and perhaps add a few more.

Cybercrime

A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...

Cybercrime

Luxury retailer Neiman Marcus Group informed some customers last week that their online accounts had been breached by hackers.

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

Cyberwarfare

WASHINGTON - Cyberattacks are the most serious threat facing the United States, even more so than terrorism, according to American defense experts. Almost half...

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...