CVE-2020-28020
published 2021-05-06CVE-2020-28020: Exim 4 before 4.92 allows Integer Overflow to Buffer Overflow, in which an unauthenticated remote attacker can execute arbitrary code by leveraging the…
PriorityP261critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
7.80%
93.9th percentile
Exim 4 before 4.92 allows Integer Overflow to Buffer Overflow, in which an unauthenticated remote attacker can execute arbitrary code by leveraging the mishandling of continuation lines during header-length restriction.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | exim4 | < exim4 4.92~RC5-1 (bookworm) | exim4 4.92~RC5-1 (bookworm) |
| exim | exim | >= 4.00 < 4.92 | 4.92 |
Detection & IOCsextracted from sources · hover to see the quote
snort
alert smtp any any -> [$HOME_NET,$HTTP_SERVERS,$SMTP_SERVERS] any (msg:"ET EXPLOIT Exim receive_msg Integer Overflow Attempt Inbound M1 (CVE-2020-28020)"; flow:established,to_server; content:"|0a 20|"; content:"|0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a|"; fast_pattern; isdataat:50000,relative; reference:url,www.qualys.com/2021/05/04/21nails/21nails.txt; reference:cve,2020-28020; classtype:attempted-admin; sid:2032898; rev:1; metadata:attack_target SMTP_Server, created_at 2021_05_04, cve CVE_2020_28020, deployment Perimeter, deployment Internal, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_05_04;)
snort
alert smtp any any -> [$HOME_NET,$HTTP_SERVERS,$SMTP_SERVERS] any (msg:"ET EXPLOIT Exim receive_msg Integer Overflow Attempt Inbound M2 (CVE-2020-28020)"; flow:established,to_server; content:"|0a 09|"; content:"|0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a|"; fast_pattern; isdataat:50000,relative; reference:url,www.qualys.com/2021/05/04/21nails/21nails.txt; reference:cve,2020-28020; classtype:attempted-admin; sid:2032899; rev:1; metadata:attack_target SMTP_Server, created_at 2021_05_04, cve CVE_2020_28020, deployment Perimeter, deployment Internal, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_05_04;)
bytes
|0a 20| followed by |0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a| with isdataat:50000,relative (M1)
bytes
|0a 09| followed by |0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a| with isdataat:50000,relative (M2)
- →Target inbound SMTP traffic to server assets; exploit arrives as an unauthenticated inbound SMTP connection carrying malformed continuation lines (LF+SPACE or LF+TAB) followed by a long run of bare LF bytes (≥17) with at least 50,000 additional bytes following — indicative of the integer overflow trigger in Exim's receive_msg header-length handling.
- →The vulnerability is exploitable by an unauthenticated remote attacker, so no prior authentication or session state is required — monitor for the byte patterns even at the very start of an SMTP DATA phase.
- ·Affected versions are Exim 4 before 4.92; upgrade to 4.92 or later (Debian fixed at 4.92~RC5-1) to remediate.
- ·Snort rules use 'isdataat:50000,relative' after the bare-LF sequence, meaning the rule only fires when at least 50,000 bytes follow that pattern — tune threshold carefully in high-volume SMTP environments to avoid performance impact.
- ·Rules are classified 'confidence Medium' by Proofpoint Nexus; validate against your SMTP traffic baseline before enabling in block mode.
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_ubuntu9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Exim vulnerabilities
vendor_ubuntu·2021-05-06·CVSS 9.8
CVE-2020-28011 [CRITICAL] Exim vulnerabilities
Title: Exim vulnerabilities
Summary: Several security issues were fixed in Exim.
USN-4934-1 fixed several vulnerabilities in Exim. This update provides
the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.
CVE-2020-28026 only affected Ubuntu 16.04 ESM.
Original advisory details:
It was discovered that Exim contained multiple security issues. An attacker
could use these issues to cause a denial of service, execute arbitrary
code remotely, obtain sensitive information, or escalate local privileges.
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
Exim vulnerabilities
vendor_ubuntu·2021-05-04
CVE-2020-28022 Exim vulnerabilities
Title: Exim vulnerabilities
Summary: Several security issues were fixed in Exim.
It was discovered that Exim contained multiple security issues. An attacker
could use these issues to cause a denial of service, execute arbitrary
code remotely, obtain sensitive information, or escalate local privileges.
Instructions: In general, a standard system update will make all the necessary changes.
Debian
CVE-2020-28020: exim4 - Exim 4 before 4.92 allows Integer Overflow to Buffer Overflow, in which an unaut...
vendor_debian·2020·CVSS 9.8
CVE-2020-28020 [CRITICAL] CVE-2020-28020: exim4 - Exim 4 before 4.92 allows Integer Overflow to Buffer Overflow, in which an unaut...
Exim 4 before 4.92 allows Integer Overflow to Buffer Overflow, in which an unauthenticated remote attacker can execute arbitrary code by leveraging the mishandling of continuation lines during header-length restriction.
Scope: local
bookworm: resolved (fixed in 4.92~RC5-1)
bullseye: resolved (fixed in 4.92~RC5-1)
forky: resolved (fixed in 4.92~RC5-1)
sid: resolved (fixed in 4.92~RC5-1)
trixie: resolved (fixed in 4.92~RC5-1)
GHSA
GHSA-p795-3xjq-48vx: Exim 4 before 4
ghsa_unreviewed·2022-05-24
CVE-2020-28020 [CRITICAL] CWE-190 GHSA-p795-3xjq-48vx: Exim 4 before 4
Exim 4 before 4.92 allows Integer Overflow to Buffer Overflow, in which an unauthenticated remote attacker can execute arbitrary code by leveraging the mishandling of continuation lines during header-length restriction.
OSV
CVE-2020-28020: Exim 4 before 4
osv·2021-05-06·CVSS 9.8
CVE-2020-28020 [CRITICAL] CVE-2020-28020: Exim 4 before 4
Exim 4 before 4.92 allows Integer Overflow to Buffer Overflow, in which an unauthenticated remote attacker can execute arbitrary code by leveraging the mishandling of continuation lines during header-length restriction.
Suricata
ET EXPLOIT Exim receive_msg Integer Overflow Attempt Inbound M1 (CVE-2020-28020)
suricata·2021-05-04·CVSS 9.8
CVE-2020-28020 [CRITICAL] ET EXPLOIT Exim receive_msg Integer Overflow Attempt Inbound M1 (CVE-2020-28020)
ET EXPLOIT Exim receive_msg Integer Overflow Attempt Inbound M1 (CVE-2020-28020)
Rule: alert smtp any any -> [$HOME_NET,$HTTP_SERVERS,$SMTP_SERVERS] any (msg:"ET EXPLOIT Exim receive_msg Integer Overflow Attempt Inbound M1 (CVE-2020-28020)"; flow:established,to_server; content:"|0a 20|"; content:"|0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a|"; fast_pattern; isdataat:50000,relative; reference:url,www.qualys.com/2021/05/04/21nails/21nails.txt; reference:cve,2020-28020; classtype:attempted-admin; sid:2032898; rev:1; metadata:attack_target SMTP_Server, created_at 2021_05_04, cve CVE_2020_28020, deployment Perimeter, deployment Internal, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_05_04;)
Suricata
ET EXPLOIT Exim receive_msg Integer Overflow Attempt Inbound M2 (CVE-2020-28020)
suricata·2021-05-04·CVSS 9.8
CVE-2020-28020 [CRITICAL] ET EXPLOIT Exim receive_msg Integer Overflow Attempt Inbound M2 (CVE-2020-28020)
ET EXPLOIT Exim receive_msg Integer Overflow Attempt Inbound M2 (CVE-2020-28020)
Rule: alert smtp any any -> [$HOME_NET,$HTTP_SERVERS,$SMTP_SERVERS] any (msg:"ET EXPLOIT Exim receive_msg Integer Overflow Attempt Inbound M2 (CVE-2020-28020)"; flow:established,to_server; content:"|0a 09|"; content:"|0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a|"; fast_pattern; isdataat:50000,relative; reference:url,www.qualys.com/2021/05/04/21nails/21nails.txt; reference:cve,2020-28020; classtype:attempted-admin; sid:2032899; rev:1; metadata:attack_target SMTP_Server, created_at 2021_05_04, cve CVE_2020_28020, deployment Perimeter, deployment Internal, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2021_05_04;)
No public exploits indexed.
http://www.openwall.com/lists/oss-security/2021/07/25/1http://www.openwall.com/lists/oss-security/2021/08/03/1https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28020-HSIZE.txthttp://www.openwall.com/lists/oss-security/2021/07/25/1http://www.openwall.com/lists/oss-security/2021/08/03/1https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28020-HSIZE.txt
2021-05-06
Published