Exim.And.Dovecot.Insecure.Configuration.Command.Injection

Description

This indicates an attack attempt to exploit a remote Command Execution vulnerability in Exim and Dovecot.
The vulnerability is due to insufficient sanitizing of user supplied inputs in the application when parsing crafted SMTP requests. A remote attacker may be able to exploit this to execute arbitrary OS commands within the context of the application, via a crafted SMTP request.

Affected Products

Exim and Dovecot

Impact

System Compromise: Remote attackers can gain control of vulnerable systems.

Recommended Actions

Update the Configuration as suggested by the vendor's wiki.
http://wiki.dovecot.org/LDA/Exim
http://wiki.dovecot.org/LDA/Exim?action=diff&rev2=12&rev1=11

References

https://isc.sans.edu/diary/Dovecot+Exim+Exploit+Detects/16243 http://www.exploit-db.com/exploits/25297/ https://www.redteam-pentesting.de/en/advisories/rt-sa-2013-001/-exim-with-dovecot-typical-misconfiguration-leads-to-remote-command-execution