CVE DatabaseCVE-2018-6789

Updated 2026-06-17한국어 권고문 →

CVE-2018-67899.8/CRITICALCISA KEVCWE-120CWE-120

Exim SMTP Mail Server base64d Buffer Overflow Remote Code Execution (RCE) Vulnerability (CVE-2018-6789)

⚡ Jump to Patch

Affected Vendors

exim

Affected Components

exim

Published Date

2018-02-08

CVSS v3.1

9.8

CRITICAL

EPSS (30d)

82.1%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

All Exim versions before 4.90.1 with active SMTP listener

Impact

Unauthenticated remote attackers can execute arbitrary code with root privileges by sending specially crafted Base64 messages

Mitigation

Immediately upgrade Exim mail servers to the latest stable version (4.90.1 or higher) and restrict SMTP access

Affected Products & Version Scope

All Exim versions prior to 4.90.1

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

The primary remediation is upgrading the Exim package to version 4.90.1 or later. Use the system package manager to apply the update.

bash

# For Debian/Ubuntu-based systems
sudo apt-get update
sudo apt-get install --only-upgrade exim4 -y

# For RHEL/CentOS-based systems
sudo yum update exim -y
# Or using dnf
sudo dnf upgrade exim -y

# Restart Exim service and verify the version
sudo systemctl restart exim4 || sudo systemctl restart exim
exim -bV | grep 'Exim version'

2. Temporary Workaround & Hardening Configuration

If immediate patching is not feasible, restrict access to SMTP ports (25, 465, 587) using firewalls, or temporarily disable vulnerable authentication mechanisms in the Exim configuration.

bash

# Restrict SMTP access to trusted IP ranges using iptables
sudo iptables -A INPUT -p tcp -s 192.168.1.0/24 --dport 25 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 25 -j DROP

# Review and temporarily disable unused AUTH mechanisms in Exim configuration
# (e.g., /etc/exim4/exim4.conf or /etc/exim/exim.conf)

3. Log Audit & IoC Verification Commands

Inspect Exim log files for abnormal AUTH requests, extremely long Base64 strings, or unexpected process crashes.

bash

# Search for abnormal AUTH attempts or segmentation faults in Exim logs
sudo grep -i -E 'auth|segmentation fault|core dumped' /var/log/exim4/mainlog /var/log/exim4/paniclog 2>/dev/null

# Script to check if the running Exim version is vulnerable
CURRENT_VER=$(exim -bV | head -n 1 | awk '{print $3}')
REQUIRED_VER='4.90.1'
if [ '$(printf '%s\
%s' "$REQUIRED_VER" "$CURRENT_VER" | sort -V | head -n1)' != "$REQUIRED_VER" ]; then
  echo '[WARNING] Current Exim version '$CURRENT_VER' is vulnerable. Upgrade is required.'
else
  echo '[OK] Exim version '$CURRENT_VER' is secure.'
fi

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

NordLayer / Zero-Trust Network Access

As this vulnerability is actively exploited in the wild (CISA KEV), immediately verify your Exim installation and upgrade to version 4.90.1 or higher.

Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access

Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.

90% Attack Surface Reduction · Hardware-Free

Explore Zero-Trust Network Access Plans

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability is a heap-based buffer overflow in the base64d function within the SMTP listener of the Exim Mail Transfer Agent (MTA). During the Base64 decoding process, an 'Off-by-one' calculation error occurs when determining the buffer size required to store the decoded data. This miscalculation leads to writing beyond the allocated buffer, corrupting the metadata of adjacent heap chunks.

2. Exploitation Mechanics & Attack Scenario

An attacker initiates an SMTP session and triggers a mechanism that requires Base64 decoding, such as AUTH CRAM-MD5 or AUTH PLAIN. By transmitting a meticulously sized Base64 string, the attacker triggers the off-by-one overflow in base64d, overwriting the size header of an adjacent free heap chunk. Through precise heap grooming, the attacker can manipulate Exim's internal memory allocator to overwrite function pointers, ultimately achieving arbitrary remote code execution (RCE).

3. Infrastructure & Business Impact

Exim is one of the most widely deployed MTAs globally. This vulnerability has a critical CVSS score of 9.8 and is listed in the CISA KEV (Known Exploited Vulnerabilities) catalog, indicating active exploitation in the wild. Since exploitation does not require authentication and can be executed remotely over standard SMTP ports (25, 465, 587), successful attacks can lead to complete server compromise, data exfiltration, and lateral movement within the enterprise network.

Official Vendor Advisories & References

NVD Original English Description

An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. By sending a handcrafted message, a buffer overflow may happen. This can be used to execute code remotely.

http://openwall.com/lists/oss-security/2018/02/10/2

Source: cve@mitre.org · Mailing List, Third Party Advisory

http://packetstormsecurity.com/files/162959/Exim-base64d-Buffer-Overflow.html

Source: cve@mitre.org · Exploit, Third Party Advisory, VDB Entry

http://www.openwall.com/lists/oss-security/2018/02/07/2

Source: cve@mitre.org · Mailing List, Third Party Advisory

http://www.securityfocus.com/bid/103049

Source: cve@mitre.org · Broken Link, Third Party Advisory, VDB Entry

http://www.securitytracker.com/id/1040461

Source: cve@mitre.org · Broken Link, Third Party Advisory, VDB Entry

https://devco.re/blog/2018/03/06/exim-off-by-one-RCE-exploiting-CVE-2018-6789-en/

Source: cve@mitre.org · Exploit, Third Party Advisory

Frequently Asked SecOps Questions (CVE-2018-6789)

FAQ

Q1. How critical is CVE-2018-6789 and is it actively exploited in the wild?

CVE-2018-6789 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 82.1%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2018-6789?

Primary impacted vendors include exim across exim. Scope summary: All Exim versions prior to 4.90.1

Q3. What temporary mitigations or workarounds exist for CVE-2018-6789 before patching?

[Mitigation] Immediately upgrade Exim mail servers to the latest stable version (4.90.1 or higher) and restrict SMTP access Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION