InfoSecBulletin Cybersecurity for mankind
Censys has warned that more than 1.5 million Exim mail transfer agent (MTA) instances are vulnerable to a critical security issue. This vulnerability allows threat actors to bypass security filters.
Exim developers fixed a security flaw, tracked as CVE-2024-39929, impacting versions up to 4.97.1.
Workshop on “DDoS use cases & solutions for government & BFSI” held at BCS
Uganda confirms hack of central bank accounts, Refutes $17 Million Claim
CVE-2024-11667
Hackers actively exploiting Zyxel firewall to deploy Ransomware
Daily Security Update Dated: 29.11.2024
CIRT-in flags Critical Flaw in Oracle Agile PLM Framework
Microsoft patches four vulnerabilities in its services
Data broker exposes 600K+ passwordless sensitive files online
Cloudflare logs faces major failure, losing 55% of user data
VMware Patched critical flaw in Aria Operations
HDFC Life hit by data breach, begins investigation
The vulnerability is caused by not parsing multiline RFC2231 header filenames correctly, allowing remote attackers to send harmful executable attachments to end users’ mailboxes by bypassing the protection mechanism.
“If a user were to download or run one of these malicious files, the system could be compromised,” Censys warned, adding that “a PoC is available, but no active exploitation is known yet.”
“As of July 10, 2024, Censys observes 1,567,109 publicly exposed Exim servers running a potentially vulnerable version (4.97.1 or earlier), concentrated mostly in the United States, Russia, and Canada,” the company added.
59% of the 409,255 mail servers on the Internet were running Exim, which is more than 241,000 instances.
According to Shodan, there are over 3.3 million Exim servers exposed online, most in the United States, followed by Russia and the Netherlands. Censys found 6,540,044 public mail servers online, with roughly 74% of them running Exim.
