{"data":{"case":{"actions":{"de":["Prüfe die Exim-Version auf deinen Mailservern mit `exim -bV`: Eine Version von **4.87 bis 4.91** ohne den Patch deiner Distribution vom Juni 2019 ist für diese Sicherheitslücke offen.","Aktualisiere Exim über die Sicherheitsupdates deiner Distribution oder auf die aktuelle Version **4.100.1** (Stand: 1. November 2026); das Exim-Projekt betrachtet alle älteren Versionen als veraltet.","Wenn eine verwundbare Version aus dem Internet erreichbar war, such nach Spuren eines Angriffs: unbekannte Cronjobs, unbekannte SSH-Schlüssel für root, neue Benutzer mit Administratorrechten und geänderte Firewall-Regeln.","Durchsuche deine Mail-Logs nach Absender- oder Empfängeradressen, die `${run{` enthalten: Das sind Versuche, die Sicherheitslücke auszunutzen."],"en":["Check the Exim version on your mail servers with `exim -bV`: a version from **4.87 to 4.91** without your distribution's patch of June 2019 is open to this flaw.","Update Exim through your distribution's security updates or to the current release, **4.100.1** (as of November 1, 2026); the Exim project considers all older releases obsolete.","If a vulnerable version was reachable from the internet, look for signs of an attack: unknown cron jobs, unknown SSH keys for root, new users with admin rights and changed firewall rules.","Search your mail logs for sender or recipient addresses that contain `${run{`: they are attempts to exploit the flaw."]},"criteria":{"damage":{"de":"Eine Gesamtsumme des Schadens ist nicht dokumentiert; die Behörden berichten von Krypto-Minern auf gekaperten Servern, von kanadischen Opfern noch im Mai 2020 und von Angriffen einer russischen Hackergruppe des Militärs, aber ohne Zahlen (NCSC; Canadian Centre for Cyber Security; CISA).","en":"No damage total is documented; the agencies report crypto miners on hijacked servers, Canadian victims as recently as May 2020 and attacks by a Russian military hacking group, without figures (NCSC; Canadian Centre for Cyber Security; CISA).","met":false},"exploitation":{"de":"Ein Wurm verbreitete sich selbstständig: Ein Skript auf gekaperten Servern durchsuchte das Internet nach verwundbaren Exim-Servern und griff sie an (Canadian Centre for Cyber Security, 14. Juni 2019); Microsoft bestätigte den aktiven Wurm am 13. Juni 2019 (Microsoft Security Response Center).","en":"A worm spread on its own: a script on hijacked servers searched the internet for vulnerable Exim servers and attacked them (Canadian Centre for Cyber Security, June 14, 2019); Microsoft confirmed the active worm on June 13, 2019 (Microsoft Security Response Center).","met":true},"reach":{"de":"Eine Shodan-Suche fand einen Tag nach dem Fix mehr als 4,1 Millionen Systeme mit Exim 4.87 bis 4.91, gegenüber 475.591 mit der korrigierten Version 4.92 (Tenable, Anbieterdaten, Juni 2019); im Oktober 2019 waren allein in Großbritannien noch mehr als 174.000 Exim-Server für diese oder zwei spätere Exim-Lücken offen (NCSC).","en":"A Shodan search found more than 4.1 million systems with Exim 4.87 to 4.91 one day after the fix, against 475,591 with the fixed 4.92 (Tenable, vendor data, June 2019); in October 2019, more than 174,000 Exim servers in the UK alone were still open to this or two later Exim flaws (NCSC).","met":true},"response":{"de":"Behörden in den USA, in Großbritannien und in Kanada warnten, und das NCSC informierte betroffene britische Anbieter; eine Notfallanweisung oder die höchste Warnstufe ist jedoch nicht dokumentiert (CISA; NCSC; Canadian Centre for Cyber Security).","en":"Agencies in the US, the UK and Canada warned, and the NCSC notified affected UK providers, but no emergency directive or highest warning level is documented (CISA; NCSC; Canadian Centre for Cyber Security).","met":false}},"cves":["CVE-2019-10149"],"cvss":9.8,"cvss_version":"3.1","cwe":"CWE-78","dates":[{"date":"2016-04-06","de":"Exim 4.87 schaltet den fehlerhaften Code standardmäßig ein","en":"Exim 4.87 switches the flawed code on by default"},{"date":"2019-02-10","de":"Exim 4.92 behebt den Fehler, doch niemand bemerkt, dass er eine Sicherheitslücke war","en":"Exim 4.92 removes the flaw, but nobody notices that it was a security hole"},{"date":"2019-05-27","key":"reported"},{"date":"2019-06-03","de":"Exim warnt vor einem möglichen Angriff aus der Ferne, noch ohne Details","en":"Exim warns of a possible remote exploit, still without details"},{"date":"2019-06-05","key":"disclosed"},{"date":"2019-06-05","key":"patched"},{"date":"2019-06-09","key":"exploited"},{"date":"2019-06-13","de":"Microsoft bestätigt einen aktiven Wurm, der sich über die Sicherheitslücke verbreitet","en":"Microsoft confirms an active worm that spreads through the flaw"},{"date":"2019-08-23","de":"Ein fertiges Metasploit-Modul macht den Angriff leicht","en":"A ready-made Metasploit module makes the attack easy"},{"date":"2020-05-28","de":"Die NSA meldet, dass der russische Militärgeheimdienst die Sicherheitslücke seit mindestens August 2019 ausnutzt","en":"The NSA reports that Russia's military intelligence has exploited the flaw since at least August 2019"},{"date":"2022-01-10","key":"kev"}],"de":{"credit":"Qualys Research Labs","fixed":"Exim 4.92 (10. Februar 2019, unbemerkt); Patch für die Versionen 4.87 bis 4.91 (5. Juni 2019)","product":"Exim, ein Mailserver für Linux- und Unix-Systeme","summary":"Eine Sicherheitslücke im Mailserver Exim ließ Angreifer Befehle als root ausführen, die sie in eine E-Mail-Adresse schrieben; binnen weniger Tage verbreitete sich ein Wurm über die Lücke."},"disclosed":"2019-06-05","en":{"credit":"Qualys Research Labs","fixed":"Exim 4.92 (February 10, 2019, unnoticed); patch for versions 4.87 to 4.91 (June 5, 2019)","product":"Exim, a mail server for Linux and Unix systems","summary":"A flaw in the Exim mail server let attackers run commands as root by writing them into an email address; within days, a worm spread through it."},"figures":[{"de":"Millionen Systeme zeigten im Juni 2019 in den Suchergebnissen von Shodan eine verwundbare Exim-Version (mehr als; Daten von Tenable)","en":"million systems showed a vulnerable Exim version in Shodan search results in June 2019 (more than; Tenable data)","value":"4.1"},{"de":"Tage nach der Veröffentlichung warnte Microsoft vor einem aktiven Wurm","en":"days after disclosure, Microsoft warned of an active worm","value":"8"},{"de":"Tage vergingen zwischen dem unbemerkten Fix in Exim 4.92 und der Veröffentlichung der Sicherheitslücke","en":"days passed between the unnoticed fix in Exim 4.92 and the disclosure of the flaw","value":"115"},{"de":"Exim-Server allein in Großbritannien waren im Oktober 2019 noch für diese oder zwei spätere Exim-Lücken offen (mehr als; NCSC)","en":"Exim servers in the UK alone were still open to this or two later Exim flaws in October 2019 (more than; NCSC)","value":"174,000"}],"kev":"2022-01-10","key":"exim","name":"Exim","product":"Exim","sources":[{"de":"Qualys: The Return of the WIZard, der Sicherheitshinweis der Entdecker","title":"Qualys: The Return of the WIZard, the finders' advisory","url":"https://www.qualys.com/2019/06/05/cve-2019-10149/return-wizard-rce-exim.txt"},{"de":"Exim-Projekt: Hinweis und Zeitleiste zu CVE-2019-10149","title":"Exim project: notice and timeline for CVE-2019-10149","url":"https://www.exim.org/static/doc/security/CVE-2019-10149.txt"},{"de":"oss-security: Exim veröffentlicht den Fix vorzeitig, weil Details durchgesickert waren (5. Juni 2019)","title":"oss-security: Exim publishes the fix early because details leaked (June 5, 2019)","url":"https://www.openwall.com/lists/oss-security/2019/06/05/3"},{"de":"Debian-Sicherheitshinweis DSA-4456 (5. Juni 2019)","title":"Debian security advisory DSA-4456 (June 5, 2019)","url":"https://www.debian.org/security/2019/dsa-4456"},{"de":"NVD: CVE-2019-10149","title":"NVD: CVE-2019-10149","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10149"},{"de":"Tenable: Shodan-Zählung nach Exim-Version und erste Angriffe (Anbieterdaten)","title":"Tenable: Shodan counts by Exim version and first attacks (vendor data)","url":"https://www.tenable.com/blog/cve-2019-10149-critical-remote-command-execution-vulnerability-discovered-in-exim"},{"de":"Microsoft Security Response Center: Ein aktiver Linux-Wurm nutzt Exim aus (13. Juni 2019)","title":"Microsoft Security Response Center: an active Linux worm exploits Exim (June 13, 2019)","url":"https://www.microsoft.com/en-us/msrc/blog/2019/06/prevent-the-impact-of-a-linux-worm-by-updating-exim-cve-2019-10149"},{"de":"Canadian Centre for Cyber Security: Warnung AL19-012 zum Wurm (14. Juni 2019)","title":"Canadian Centre for Cyber Security: alert AL19-012 on the worm (June 14, 2019)","url":"https://www.cyber.gc.ca/en/alerts/active-exploitation-exim-vulnerability-observed-wild"},{"de":"NCSC: Sicherheitshinweis zu Schwachstellen in Exim-Mailservern (4. Oktober 2019)","title":"NCSC: advisory on Exim mail server vulnerabilities (October 4, 2019)","url":"https://www.ncsc.gov.uk/news/exim-mail-server-vulnerabilities-advisory"},{"de":"CISA: NSA-Warnung zur Ausnutzung der Exim-Lücke durch Sandworm (28. Mai 2020)","title":"CISA: NSA advisory on Sandworm exploiting the Exim flaw (May 28, 2020)","url":"https://www.cisa.gov/news-events/alerts/2020/05/28/nsa-releases-advisory-sandworm-actors-exploiting-exim-vulnerability"},{"de":"NCSC: Stellungnahme zur Warnung der NSA (28. Mai 2020)","title":"NCSC: statement supporting the NSA advisory (May 28, 2020)","url":"https://www.ncsc.gov.uk/news/ncsc-supports-sandworm-advisory"},{"de":"Canadian Centre for Cyber Security: Warnung AL20-017 zu anhaltenden Angriffen (3. Juni 2020)","title":"Canadian Centre for Cyber Security: alert AL20-017 on continued attacks (June 3, 2020)","url":"https://www.cyber.gc.ca/en/alerts-advisories/continued-exploitation-exim-vulnerability"},{"de":"Rapid7: Mailserver im Internet, 2020 (Anbieterdaten)","title":"Rapid7: internet exposure of mail servers, 2020 (vendor data)","url":"https://www.rapid7.com/blog/post/2020/10/02/nicer-protocol-deep-dive-internet-exposure-of-smtp/"},{"de":"Exim-Projekt: die aktuelle Version","title":"Exim project: the current version","url":"https://www.exim.org/"}],"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","year":2019}},"description":"In 2019, a flaw in the Exim mail server let attackers run commands as root by hiding them in an email address. How it worked, the worm, the fix.","language":"en","latest_measurement":"2026-11-01","method":"latency-v3","method_page":"https://crackthe.net/method/","source":"https://crackthe.net/","text":"On June 5, 2019, the Exim project published a fix for a flaw that let attackers run any command on a mail server with the rights of root, the administrator account, by hiding it in an email address. Exim is a mail server: the program on a Linux or Unix machine that accepts email from the internet and delivers it. The security company Qualys found the flaw and called it “The Return of the WIZard”. Eight days later, Microsoft warned of a worm, a program that spreads on its own, that used the flaw to move from server to server.\nHow it worked Exim has a small built-in language for its settings. Text written as ${...} is filled in while a mail is handled, much like a form letter. One of these items, ${run{...}}, starts a program.\nSince version 4.87, released on April 6, 2016, Exim ran the recipient address of a mail through this function when it could not deliver the mail in certain ways. An attacker only had to write a command into the address, as in ${run{...}}@localhost, and make the mail fail. One way was to add more than 30 “Received” lines, the stamps that each mail server adds on the way, so that Exim treated the mail as stuck in a loop. Exim then ran the command as root, because by default it keeps these rights while it delivers mail. No memory trick was needed: Exim simply ran the command.\nOn the server itself, any user could do this at once. From the internet it was harder, because Exim\u0026rsquo;s standard settings accept only the addresses of real users on the server. But some changes to these settings removed that obstacle, for example when a server accepted mail for another domain as its backup mail server. Even with the standard settings, Qualys found a way. The attacker made Exim send an error message to a server under the attacker\u0026rsquo;s control and kept that connection open for seven days, sending one byte every four minutes. After seven days, Exim gave up on the message and ran the command.\nAttackersends a mail with a command in the recipient address Eximcannot deliver the mail and handles the failure Expansionreads the address as a template and finds the run command Serverruns the command as root On the server itself the attack worked at once; from the internet it needed a changed setting or a connection kept open for seven days. The name refers to WIZ and DEBUG, two old flaws in Sendmail, an older mail server, that also let outsiders run commands.\nReach and attacks Because nobody had recognized the bug as a security flaw, most operating systems still shipped an affected version, Qualys wrote; it showed the attack on an up-to-date Debian 9.9. One day after the fix, the security company Tenable searched Shodan, a search engine that records what servers on the internet reveal about themselves. It found more than 4.1 million systems with Exim 4.87 to 4.91 and 475,591 with the fixed version 4.92, so nearly 90 % of the Exim systems found were open to the flaw.\nExim versions in Shodan search results, June 2019 Exim 4.87206,024 Exim 4.8824,608 Exim 4.89206,571 Exim 4.905,480 Exim 4.913,738,863 Exim 4.92, fixed475,591 Systems that showed each version one day after the fix; versions 4.87 to 4.91 had the flaw. Vendor data from Tenable.\nSuch counts rely on the version number that a server shows. Debian, for example, fixed its Exim 4.89 with an update on June 5, 2019, without changing that number, so not every system counted stayed open.\nThe attacks began quickly. On June 9, four days after the fix, a security researcher reported the first attempts to exploit the flaw. On June 13, Microsoft confirmed an active worm and urged customers of its Azure cloud to patch their virtual servers or restrict access to them. The Canadian Centre for Cyber Security, Canada\u0026rsquo;s cyber security agency, described the attacks on June 14. A first email made the server download malware. A scheduled task then kept the attackers on the server, an added key let them log in as root over SSH, the service for remote logins, and a script searched the internet for more vulnerable Exim servers and attacked them. To hide, the attackers used Tor, a network for anonymous connections.\nMost of these attacks installed crypto miners, programs that use a hijacked server to create cryptocurrency, the UK\u0026rsquo;s National Cyber Security Centre (NCSC) wrote in October 2019. Since August 23, 2019, a ready-made module for Metasploit, a widely used attack toolkit, had made the attack easy. The NCSC counted more than 174,000 Exim servers in the UK alone that were still open to this flaw or to two Exim flaws found in September 2019.\nIn May 2020, the US National Security Agency (NSA) reported that Sandworm, a hacking group of the GRU, Russia\u0026rsquo;s military intelligence service, had exploited the flaw since at least August 2019. The NCSC backed the finding and notified the affected providers in the UK. A few days later, the Canadian cyber centre reported Canadian victims from as recently as May 2020. In 2020, the security company Rapid7 still found about 87,500 servers with a vulnerable version on the internet. How much damage the attacks caused is not documented.\nThe fix and the response The strangest part of the story is that the flaw had already been fixed. Exim 4.92, released on February 10, 2019, had changed the code, but nobody noticed that the change closed a security hole. Qualys found the flaw while reviewing the latest Exim changes and reported it on May 27, 2019, and the Exim team wrote a patch the same day.\nOn June 3, the team warned of a “possible remote exploit”, still without details, and planned a coordinated release for June 11, so that Linux distributions could prepare their updates. After details leaked, it published the fix early, on June 5 at 15:15 UTC. Debian released its update the same day. Qualys published its advisory that day, at first without the attack methods, and the full version on June 6.\nThe Exim team made no new release for the old versions, because it considered them outdated: operators had to install their distribution\u0026rsquo;s update or move to version 4.92. In May 2020, the NCSC advised providers to install version 4.93 or newer at once.\nThe National Vulnerability Database (NVD) rates the flaw 9.8 out of 10 on CVSS 3.1, “critical”. Red Hat gives it 9.0 on the older CVSS 3.0 and rates the attack as harder to carry out. The US cyber agency CISA added the flaw to its catalog of exploited vulnerabilities on January 10, 2022.","title":"Exim: the email address that took over mail servers","url":"https://crackthe.net/vulnerabilities/exim/"}