PT-2019-2859 · Exim+2 · Exim+2

Pedro Sampaio · Published 2018-03-12 · Updated 2025-12-23 · CVE-2019-10149

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Exim versions 4.87 through 4.91

Description The issue is related to improper validation of recipient addresses in the deliver message() function, located in /src/deliver.c, which may lead to remote command execution. This flaw can be exploited by an attacker to execute arbitrary code on the server with root privileges. The vulnerability has been reportedly exploited by the Sandworm Team, a group of Russian hackers, to compromise mail servers worldwide. It is estimated that millions of Exim mail servers are vulnerable to this issue.

Recommendations For Exim versions 4.87 through 4.91, update to a version that includes the fix for this issue. As a temporary workaround, consider disabling the deliver message() function until a patch is available. Restrict access to the /src/deliver.c module to minimize the risk of exploitation. Avoid using the vulnerable deliver message() function in the affected Exim versions until the issue is resolved.

Exploit

Fix

OS Command Injection

RCE

Weakness Enumeration

CWE-78

CWE-20

Related Identifiers

ALT-PU-2018-1409

ALT-PU-2020-2318

ALT-PU-2021-1764

ALT-PU-2022-2269

BDU:2019-02827

CVE-2019-10149

DSA-4456-1

OPENSUSE-SU-2019:1524-1

OPENSUSE-SU-2019_1524-1

OPENSUSE-SU-2021:0753-1

OPENSUSE-SU-2021_0677-1

OPENSUSE-SU-2024:10746-1

USN-4010-1

Affected Products

Exim

Suse

Ubuntu

References · 121

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/local/exim_perl_startup.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/exim4_deliver_message_priv_esc.rb · Exploit
• 🔥 https://github.com/qazbnm456/awesome-cve-poc/blob/master/Stack-Clash.md · Exploit
• 🔥 https://github.com/lucky/bad_actor_poc · Exploit
• 🔥 https://github.com/synacktiv/Exim-CVE-2019-15846 · Exploit
• 🔥 https://github.com/LetUsFsck/PoC-Exploit-Mirror/tree/master/CVE-2017-16944 · Exploit
• 🔥 https://github.com/bananaphones/exim-rce-quickfix · Exploit
• 🔥 https://github.com/Diefunction/CVE-2019-10149 · Exploit
• 🔥 https://github.com/cowbe0x004/eximrce-CVE-2019-10149 · Exploit
• 🔥 https://github.com/MNEMO-CERT/PoC--CVE-2019-10149_Exim · Exploit
• 🔥 https://github.com/martinclauss/exim-rce-cve-2018-6789 · Exploit
• 🔥 https://github.com/synacktiv/Exim-CVE-2018-6789 · Exploit
• 🔥 https://github.com/AzizMea/CVE-2019-10149-privilege-escalation · Exploit
• 🔥 https://github.com/darsigovrustam/CVE-2019-10149 · Exploit
• 🔥 https://github.com/dorkerdevil/CVE-2020-28018 · Exploit