# MA-731.062019: MyCERT Advisory - Advisory related to Exim CVE-2019-10149 vulnerability

**Date:** 14 Jun 2019  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-731.062019  
**Advisory ID:** MA-731.062019

---

**1.0 Introduction**
Recently, a critical vulnerability found in multiple versions of the Exim mail transfer agent (MTA) software. The flaw is caused by the improper validation of recipient addresses in the deliver\_message() function in /src/deliver.c which leads to Remote \*Command\* Execution (RCE) with same privileges of exim process on the mail server, which normally use root privileges. This flaw allow unauthenticated remote attackers to execute arbitrary commands on mail servers for some non-default server configurations.
**2.0 Impact**
Successful exploitation could lead to a full compromise of the Exim mail server, allowing an attacker to perform malicious activity through the mail server.
**3.0 Affected Products**
All Exim versions, between and including 4.87 to 4.91 .
**4.0 Recommendations**
MyCERT highly recommended users and administrators of affected products to update to version 4.92 immediately.
Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: [[email protected]](/cdn-cgi/l/email-protection#482b312a2d3a717171082b312a2d3a3b2d2b3d3a213c31662531) or [[email protected]](/cdn-cgi/l/email-protection#90fde9f3f5e2e4d0fde9f3f5e2e4beffe2f7befde9)
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 89453442
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 -18:00 MYT
Web: <http://www.mycert.org.my>
Twitter: <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps: [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**5.0    References**
<https://www.exim.org/static/doc/security/CVE-2019-10149.txt>
<https://nvd.nist.gov/vuln/detail/CVE-2019-10149>
<https://www.qualys.com/2019/06/05/cve-2019-10149/return-wizard-rce-exim.txt>
<https://www.bleepingcomputer.com/news/security/millions-of-exim-mail-servers-exposed-to-local-remote-attacks/>