CVE-2018-6789

What is Exim?

Exim is a widely deployed open-source mail transfer agent (MTA) that has shipped as the default mailer on many Debian-based Linux distributions and is used by a large share of internet-facing mail servers. Because Exim listens directly on port 25 to accept and route SMTP mail, any memory-safety bug in its message-parsing code is reachable pre-authentication from the open internet, making Exim vulnerabilities historically some of the most impactful bugs discovered in mail infrastructure.

Overview

CVE-2018-6789 is a buffer overflow in the base64d() function used by Exim's SMTP listener to decode base64-encoded data during authentication and other protocol exchanges. An attacker who can reach the SMTP service can send a specially crafted, over-long base64 string that overflows the destination buffer, corrupting adjacent heap memory. Because the flaw sits in code that runs before authentication, it is exploitable by any anonymous host that can complete an SMTP handshake, and because Exim is frequently exposed directly to the internet, this made the bug particularly attractive to opportunistic scanning campaigns even years after it was patched. It was assigned a CVSS 3.1 score of 9.8 (Critical), and CISA added it to the KEV catalog in November 2021 based on confirmed exploitation, with a note that it has been used in ransomware campaigns.

Affected Versions

Technical Details

The root cause is CWE-120 (Buffer Copy without Checking Size of Input, i.e. classic buffer overflow): base64d() computes a destination buffer size based on an assumption about the maximum expanded length of decoded base64 data, but an attacker-controlled input string can exceed that assumption, causing the decode routine to write past the end of the allocated buffer. Because the corrupted memory is on the heap and adjacent structures can include function pointers and other control data used by Exim's SMTP state machine, careful heap grooming can turn the overflow into remote code execution running with the privileges of the Exim process — typically root or a dedicated but highly trusted mail user. The vulnerability requires no authentication and no user interaction, and can be triggered by a single crafted SMTP session.

Discovery

The bug was privately reported to the Exim maintainers, who released Exim 4.90.1 in February 2018 to correct the buffer-sizing logic in base64d().

Exploitation Context

CISA added CVE-2018-6789 to the Known Exploited Vulnerabilities catalog in November 2021, indicating confirmed real-world exploitation, and the catalog entry flags known use in ransomware operations. Unpatched, internet-facing Exim servers have long been a target of mass-scanning botnets that probe for known MTA vulnerabilities to gain initial footholds for cryptomining, spam relay abuse, or further lateral movement.

Remediation

1. Upgrade Exim to version 4.90.1 or later — nearly every modern Linux distribution has long since shipped a patched build in its package repositories.
2. Verify the running Exim version with exim -bV or your distribution's package manager and confirm it post-dates the fix.
3. Restrict direct SMTP exposure where feasible — place mail gateways behind rate limiting and monitor for anomalous connection patterns.
4. Review mail server logs for signs of crashes, unexpected restarts, or malformed authentication attempts that could indicate exploitation attempts.
5. Treat any Exim instance still running a pre-4.90.1 release as compromised if it has been internet-facing, and rebuild from a trusted image after patching.