Mohamed Sharaf
Menu
Infrastructure

Exim mail servers are being taken over

A critical Exim bug disclosed this month is now mass-exploited. Many cPanel and Linux mail servers run it.

· 1 min read

Earlier this month a critical bug in the Exim mail server was disclosed (CVE-2019-10149). It lets an attacker run commands as root by sending a crafted email. Within days, mass exploitation started.

Exim is the default mail server on many Linux systems and on cPanel servers, so a lot of shared hosting runs it.

  1. Check your version with exim -bV. Versions 4.87 to 4.91 are affected.
  2. Update to 4.92 or later, or install your distribution’s patched package. cPanel has released updates.
  3. Look for signs of compromise: new cron jobs, new root SSH keys, unknown processes.
  4. If compromised, rebuild the server. Attackers install persistence quickly.

Mail servers face the whole internet by design. They deserve the fastest patching you have.

ShareWhatsAppLinkedInXTelegramFacebook