CVE-2018-6789

Exim is a program many servers use to send and receive email. This bug is like a mistake in how Exim decodes “base64” text inside an email: a crafted message can overwhelm the program and let an attacker take control of the server. The impact can range from the mail server being knocked offline to attackers running code on your system.

This matters if your business runs an Exim-based email server (or a server that uses Exim for SMTP handling), including Debian, Ubuntu, and Astra Linux installations. It is especially important because the weakness is reachable over the network without needing a username or password, so exposure depends mainly on whether your SMTP listener is reachable from the attacker. If your SMTP port isn’t reachable from the internet and is only accessible to trusted internal systems, the risk is lower—but if it is exposed, treat it as high risk.

This is a RED issue because attackers can exploit it remotely without authentication, and it is confirmed to have been used in ransomware campaigns (CISA KEV listing). With public exploits available, delay materially increases the chance of compromise. Apply the fix immediately—upgrade Exim to the fixed version.

1. Confirm whether Exim is installed and which version is running.
   • On the server hosting mail: check the Exim package/service version and confirm the live running version after any changes.
   • If your system is based on Debian/Ubuntu/Astra Linux, use your distro’s package information to identify the Exim version.
2. Determine exposure of the SMTP listener.
   • Check whether Exim’s SMTP ports (commonly 25, and possibly submission/relay ports depending on configuration) are reachable from untrusted networks.
   • Review firewall rules and network security groups to see whether inbound SMTP is internet-facing.
3. Upgrade to the fixed software.
   • Upgrade Exim to 4.90.1 or later (this is the vendor-fixed version).
   • Apply the update using your vendor/distro’s supported upgrade process so dependencies and configs remain consistent.
4. Verify the upgrade took effect.
   • Restart the Exim service as required by your update process.
   • Re-check the running Exim version and confirm SMTP connectivity works normally.
5. If patching is delayed (temporary containment).
   • Restrict inbound SMTP connectivity to only trusted IPs/hosts/networks.
   • If possible, disable external SMTP access until the upgrade is completed.
6. What to monitor after upgrading.
   • Look for unusual SMTP activity and unexpected process crashes/restarts.
   • Review system logs around the SMTP service timeframe for signs of exploitation attempts (for example, repeated malformed message patterns and service instability).

Severity is critical: a network-reachable buffer overflow in Exim’s SMTP listener base64d function can lead to remote code execution. The trigger is a specially crafted network message sent to the SMTP service; no authentication and no user interaction are required. This issue is listed in CISA KEV and was added on 2021-11-03, indicating confirmed real-world use, including in ransomware campaigns; the CISA remediation due date was 2022-05-03. Public exploits exist (multiple known), meaning this is not theoretical. The PATCH section identifies the fixed version as Exim 4.90.1. In this context, KEV supersedes any prediction-based likelihood metrics; exploitation has been observed.