400,000 web servers at risk due to bug in message agent

A vulnerability in the Exim e-mail program puts up to 400,000 servers at risk of remote code execution. Admins of servers with Exim are advised to upgrade as soon as possible to version 4.90.1 as all earlier versions have a buffer overflow vulnerability that can be abused to remotely execute code. The updated version has been available since February 10.

A single byte of data resulting from an exploit "overwrites some critical data when the string fits some specific length," the researchers, from Devcore Security Consulting, wrote. "In addition, this byte is controllable, which makes exploitation more feasible. Base64 decoding is such a fundamental function, and therefore this bug can be triggered easily, causing remote code execution."

For their part, developers of Exim wrote in an advisory: "Currently, we're unsure about the severity" of the vulnerability. "We *believe* an exploit is difficult. A mitigation isn't known."

Source: ARS Technica