Security News > 2020 > June > Several Exim Vulnerabilities Exploited in Russia-Linked Attacks

Several vulnerabilities affecting the Exim mail transfer agent have been exploited by Russia-linked hackers, and administrators have been urged to patch immediately, but hundreds of thousands of servers remain unpatched.

The U.S. National Security Agency issued an alert last week to urge users to update their Exim servers to version 4.93 or newer, as earlier versions are impacted by vulnerabilities that have been exploited by a hacker group with ties to the Russian military.

Threat intelligence company RiskIQ says there are two other Exim vulnerabilities that have been exploited in the same campaign: CVE-2019-15846, a remote code execution vulnerability patched in September 2019 that impacts version 4.92.1 and earlier, and CVE-2019-16928, a DoS and code execution vulnerability affecting versions 4.92 through 4.92.2.

While a majority are running Exim 4.92, which patches CVE-2019-10149, the other two vulnerabilities still expose servers to attacks, which is likely why the NSA has advised users to update to version 4.93.

The threat group exploiting these vulnerabilities is tracked as Sandworm and TeleBots, and it has been linked to Russia's General Staff Main Intelligence Directorate.

News URL

http://feedproxy.google.com/~r/Securityweek/~3/O734a89RrgY/several-exim-vulnerabilities-exploited-russia-linked-attacks