What We Do
How We Do
Resources
Company
Partners
Get Started
Security advisories

CVE-2019-10149 Exploited in the Wild

June 19, 2019 | 1 MIN READ

Speak With A Security Expert Now

TALK TO AN EXPERT

Linux Exim mail servers version 4.87 – 4.91 (inclusive) is at risk of exploitation via CVE-2019-10149 [1]. This vulnerability is currently being exploited by threat actors in the wild [2]. Successful exploitation of CVE-2019-10149 allows remote, unauthenticated threat actors to perform remote code execution on vulnerable systems. Attacks in the wild include a wormable exploit, which after successful exploitation may spread to additional vulnerable EXIMservers.

There is a high confidence rating that vulnerable Linux EXIM mail servers will be affected by this exploit. Organizations need to apply the official security patch as soon as possible to avoid potential compromise.

eSentire has not observed attacks against client companies at this time.

What we’re doing about it

What you should do about it

Additional information

CVE-2019-10149 was weaponized by threat actors rapidly; the vulnerability was announced publicly on June 3rd and exploited by June 9th. The fast adoption rate isdue to both the wide availability of vulnerable servers and the potential,high value of remote command execution. Based on Shodan scans, there are approximately 3,134,631 vulnerable servers exposed to the web at the time of writing.

Current externally observed campaigns leveraging this vulnerability have been identified as crypto-mining campaigns, but remote code execution could be used to necessitate further compromise of any impacted system.

References:

[1] https://nvd.nist.gov/vuln/detail/CVE-2019-10149

[2] https://www.cyber.gc.ca/en/alerts/active-exploitation-exim-vulnerability-observed-wild

View Most Recent Advisories