Several vulnerabilities affecting the Exim mail transfer agent (MTA) have been exploited by Russia-linked hackers, and administrators have been urged to patch immediately, but hundreds of thousands of servers remain unpatched.
The U.S. National Security Agency (NSA) issued an alert last week to urge users to update their Exim servers to version 4.93 or newer, as earlier versions are impacted by vulnerabilities that have been exploited by a hacker group with ties to the Russian military.
The NSA mentioned CVE-2019-10149, an Exim vulnerability that allows remote code execution as root. The flaw was patched in February 2019 with the release of version 4.92, but it was only identified as a vulnerability in May 2019 and its impact was made public the next month. According to the NSA, it has been exploited by Russian state-sponsored hackers since at least August 2019.
However, threat intelligence company RiskIQ says there are two other Exim vulnerabilities that have been exploited in the same campaign: CVE-2019-15846, a remote code execution vulnerability patched in September 2019 that impacts version 4.92.1 and earlier, and CVE-2019-16928, a DoS and code execution vulnerability affecting versions 4.92 through 4.92.2.
Over the course of May, RiskIQ said it identified more than 900,000 vulnerable Exim servers. While a majority are running Exim 4.92, which patches CVE-2019-10149, the other two vulnerabilities still expose servers to attacks, which is likely why the NSA has advised users to update to version 4.93.
RiskIQ noted that the number of vulnerable servers steadily decreased in May, but there are still hundreds of thousands of vulnerable servers.
A Shodan search currently shows over one million Exim servers running version 4.92 and more than 250,000 instances with version 4.91.
The threat group exploiting these vulnerabilities is tracked as Sandworm and TeleBots, and it has been linked to Russia’s General Staff Main Intelligence Directorate (GRU). While the NSA has not released any information on the targets of this campaign, Sandworm has been known to attack a wide range of organizations in Europe and the United States.
Related: Russian Hackers Target European Governments Ahead of Elections: FireEye
Related: Hackers Target Recent Vulnerability in Exim Mail Server
Related: NSA: Russian Agents Have Been Hacking Major Email Program
