CVE-2023-42114: (0Day) Exim NTLM Challenge Out-Of-Bounds Read Information Disclosure Vulnerability

Reference Links

• https://www.zerodayinitiative.com/advisories/ZDI-23-1468/
• https://bugs.exim.org/show_bug.cgi?id=3001
• https://git.exim.org/exim.git/log/refs/heads/exim-4.96%20security/exim.git/commit/ccf9816f54fb04ab5508eb8c7f00b08bc3531297
• https://www.openwall.com/lists/oss-security/2023/09/29/5
• https://www.openwall.com/lists/oss-security/2023/10/01/4
• https://exim.org/static/doc/security/CVE-2023-zdi.txt
• https://security-tracker.debian.org/tracker/CVE-2023-42114
• https://www.openwall.com/lists/oss-security/2023/10/02/3
• https://ubuntu.com/security/notices/USN-6411-1
• https://www.cve.org/CVERecord?id=CVE-2023-42114
• https://nvd.nist.gov/vuln/detail/CVE-2023-42114
• https://launchpad.net/bugs/cve/CVE-2023-42114
• https://ubuntu.com/security/CVE-2023-42114

Parent vulnerabilities

(Appears in the following advisories)

• USN-6411-1

Frequently Asked Questions

• What is CVE-2023-42114?

  CVE-2023-42114 is an Exim NTLM Challenge Out-Of-Bounds Read Information Disclosure Vulnerability.

• How does CVE-2023-42114 affect Exim?

  CVE-2023-42114 allows remote attackers to disclose sensitive information on affected installations of Exim.

• Is authentication required to exploit CVE-2023-42114?

  No, authentication is not required to exploit CVE-2023-42114.

• What is the severity of CVE-2023-42114?

  The severity of CVE-2023-42114 is low with a CVSS score of 3.7.

• Which versions of Exim are affected by CVE-2023-42114?

  Versions 4.90.1-1ubuntu1.10+, 4.93-13ubuntu1.8, 4.95-4ubuntu2.3, 4.96-14ubuntu1.2, 4.82-3ubuntu2.4+, 4.96.1, 4.86.2-2ubuntu2.6+, and some Debian versions are affected by CVE-2023-42114.

• How can I fix CVE-2023-42114?

  To fix CVE-2023-42114, update Exim to version 4.90.1-1ubuntu1.10+ or apply the appropriate security remediation provided by your distribution.