CVE-2023-42116: Exim SMTP Buffer Overflow RCE Vulnerability

CVE-2023-42116 Overview

CVE-2023-42116 is a stack-based buffer overflow vulnerability in Exim, one of the most widely deployed mail transfer agents (MTAs) on the internet. This vulnerability allows remote attackers to execute arbitrary code on affected Exim installations without requiring authentication. The flaw exists within the handling of NTLM challenge requests, where improper validation of user-supplied data length allows attackers to overflow a fixed-length stack-based buffer and achieve code execution in the context of the Exim service account.

Critical Impact

Unauthenticated remote code execution on mail servers running vulnerable Exim installations. Successful exploitation grants attackers full control over the mail server, potentially compromising all email communications and providing a foothold for lateral movement within the network.

Affected Products

• Exim Mail Transfer Agent (all vulnerable versions)
• Linux distributions using Exim as the default MTA
• Debian-based systems with unpatched Exim installations

Discovery Timeline

• 2023-10 - Debian LTS security announcement released
• 2024-05-03 - CVE-2023-42116 published to NVD
• 2025-11-04 - Last updated in NVD database

Technical Details for CVE-2023-42116

Vulnerability Analysis

This vulnerability (tracked as ZDI-CAN-17515) resides in Exim's NTLM authentication mechanism. When processing NTLM challenge requests during SMTP authentication, Exim fails to properly validate the length of user-supplied data before copying it into a fixed-length stack-based buffer. This classic stack-based buffer overflow (CWE-121) enables attackers to overwrite the return address and potentially inject shellcode or ROP chains to achieve arbitrary code execution.

The attack can be conducted remotely over the network without any form of authentication, making it particularly dangerous for internet-facing mail servers. Given that Exim handles email traffic on TCP port 25 (SMTP), 587 (submission), and 465 (SMTPS), any exposed Exim server with NTLM authentication enabled is potentially vulnerable.

Root Cause

The root cause is the lack of proper bounds checking when handling NTLM challenge data in Exim's SMTP authentication code. User-controlled input is copied to a stack buffer without validating that the data length does not exceed the buffer's allocated size. This allows an attacker to supply oversized data that overflows the buffer boundary, corrupting adjacent stack memory including saved return addresses.

Attack Vector

The attack is network-based and can be executed by any remote attacker who can establish a TCP connection to the vulnerable Exim SMTP service. The attacker initiates an SMTP session and triggers the NTLM authentication flow. By sending a specially crafted NTLM challenge response containing oversized data, the attacker can overflow the stack buffer. The overflow can be precisely controlled to overwrite the function's return address, redirecting execution flow to attacker-controlled code. Since no authentication is required, any internet-accessible Exim server with NTLM authentication enabled is at risk.

The vulnerability mechanism involves the NTLM challenge handling routine failing to validate input length against buffer capacity. When the crafted payload exceeds the buffer boundaries, it overwrites critical stack data structures. Technical implementation details are available in the Zero Day Initiative Advisory ZDI-23-1470.

Detection Methods for CVE-2023-42116

Indicators of Compromise

• Unexpected crashes or core dumps from the Exim process, particularly during SMTP authentication
• Anomalous NTLM authentication attempts in Exim logs with unusually large data payloads
• Suspicious outbound connections or process spawning from the Exim service account
• Evidence of unauthorized mail relay activity or configuration changes

Detection Strategies

• Deploy network intrusion detection signatures to identify malformed NTLM challenge responses targeting Exim SMTP services
• Monitor Exim log files for authentication errors or abnormal NTLM negotiation patterns
• Implement host-based monitoring to detect unexpected child processes spawned by the Exim daemon
• Configure SentinelOne Singularity to detect and alert on buffer overflow exploitation attempts and anomalous process behavior from mail services

Monitoring Recommendations

• Enable detailed SMTP authentication logging in Exim configuration
• Set up real-time alerting for Exim process crashes or segmentation faults
• Monitor network traffic on ports 25, 587, and 465 for unusual NTLM authentication patterns
• Implement file integrity monitoring for Exim binaries and configuration files

How to Mitigate CVE-2023-42116

Immediate Actions Required

• Apply the latest Exim security patches immediately to all affected servers
• If NTLM authentication is not required, disable it in Exim configuration to eliminate the attack surface
• Restrict network access to SMTP services using firewall rules to limit exposure
• Deploy SentinelOne Singularity for runtime protection against exploitation attempts

Patch Information

Security patches addressing CVE-2023-42116 have been released. Debian users should consult the Debian LTS Announcement for specific package versions. Organizations should update Exim to the latest patched version available from their distribution's package repositories or the upstream Exim project. The Zero Day Initiative Advisory provides additional details on affected versions.

Workarounds

• Disable NTLM authentication in Exim by removing or commenting out NTLM-related authenticator configurations in exim.conf
• Implement network segmentation to restrict direct access to mail servers from untrusted networks
• Use a firewall or reverse proxy to filter incoming SMTP connections and limit exposure
• Consider temporarily using alternative authentication mechanisms until patching is complete

# Disable NTLM authentication in Exim configuration
# In /etc/exim4/exim4.conf or equivalent, comment out or remove NTLM authenticator blocks:

# ntlm:
#   driver = cyrus_sasl
#   public_name = NTLM
#   server_hostname = ${primary_hostname}
#   server_set_id = $auth1

# Restart Exim after configuration changes
sudo systemctl restart exim4