Attackers are already exploiting a bug in the Exim mailer to remotely execute code on compromised Linux machines, according to a pair of Linux security advisories.
Posted on US-Cert as Vulnerability Note VU #682457, the bug exists in Exim mail server software prior to version 4.70. Affected systems include Debian Linux, Novell’s SUSE Linux, and Canonical’s Ubuntu Linux.
Exim is a mail transfer agent popularly used on Unix-based machines.
“The internal string handling functions of the Exim software contain a function called string_format(). The version of this function included with Exim versions prior to 4.70 contains a flaw that can result in a buffer overflow. An attacker can exploit this vulnerability by crafting message headers that are subsequently supplied to Exim logging functions,” wrote Chad Dougherty on the US-CERT list.
When a rootkit is installed on a machine running the older version of Exim, the malware creates a number of temporary files, including a small C program. An attacker can remotely compile the program. When executed, it runs using Exim server’s privileges.
While bad, it’s not as bad as running as root, except for the fact there is yet another Exim bug.
A bug in the way Exim mail server handles configuration files allows local programs to get root-level privileges, according to Vulnerability Note VU #758489. Since the rootkit is running locally on the compromised machine, this bug allows the program to grant itself root privileges, giving the remote attacker complete control over the system.
This bug is currently affecting SUSE Linux, according to the advisory.
The bugs were discovered because of their “exploitation in the wild,” according to the advisories.
The first bug can be fixed by upgrading to version 4.7 or by applying an Exim patch.
As for the second bug, the software is built by default without specifying the ALT_CONFIG_ROOT_ONLY option, which allows all commands in the configuration file to execute as root. Clearly, administrators not needing to use multiple configuration files should build Exim on their systems ALT_CONFIG_ROOT_ONLY option enabled. However, this recommendation doesn’t help administrators who need to use more than one set of configurations on the mail server. In fact, Dougherty wrote there was currently “no practical solution” to the configuration file bug.
There is a simple way to suspect that the rootkit may be on the mail server: e-mail would stop working.