PT-2024-4731

CVE-2024-39929

تاريخ النشر

2024-07-04

تاريخ التحديث

2026-10-01

الوصف من

CVSS 2.0

6.4

متوسطة

المقاييسAV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions:

Exim versions prior to 4.98 Exim versions 4.97.1 and earlier Exim versions 4.93-13ubuntu1.12 and earlier Exim versions 4.94.2-7+deb11u3 and earlier Exim versions 4.96-15+deb12u5 and earlier

Description:

Exim is vulnerable to a parsing error in multiline RFC 2231 header filenames. This allows remote attackers to bypass the $mime filename extension-blocking protection mechanism and potentially deliver executable attachments to user mailboxes. Approximately 1.56 million servers are potentially affected, with a significant concentration in the U.S., Russia, and Canada.

Recommendations:

Exim versions prior to 4.98: Upgrade to version 4.98 or later. Exim versions 4.97.1 and earlier: Upgrade to version 4.98 or later. Exim versions 4.93-13ubuntu1.12 and earlier: Upgrade to version 4.93-13ubuntu1.12 or later. Exim versions 4.94.2-7+deb11u3 and earlier: Upgrade to version 4.94.2-7+deb11u3 or later. Exim versions 4.96-15+deb12u5 and earlier: Upgrade to version 4.96-15+deb12u5 or later.

قابلية الاستغلال

استغلال

إصلاح

التأثيرات

الباحثون

المورّدون