Views:

Vendor Solution

The vulnerability has been patched in version 4.92, which is currently available.

In addition, the maintainers for Exim have announced a public fix for the vulnerability which can be backported to all affected versions (4.87 - 4.91), although these are now technically said to be no longer officially supported.

 

Trend Micro Recommendation and Solutions

As with any vulnerability, Trend Micro highly recommends that users apply all critical patches and fixes that vendors provide for security issues as soon as possible. These patches will provide the strongest level of defense against any potential attacks.

 
Since this vulnerability potentially impacts a critical component in many environments (MTA) - it is strongly recommended that patches or upgrades are applied as quickly as possible.
 

Fortunately, Trend Micro has analyzed the information to see if proactive protection rules and filters may be created to help protect against potential attacks, and has deployed the following:

 

ProductProtection TypeIdentifier
Deep SecurityIntrusion Prevention Rule1009797 - Exim 'deliver_message' Command Injection Vulnerability (CVE-2019-10149)
TippingPointDigitalVaccine (DV) Filter35520: SMTP: Exim Internet Mailer Command Injection Vulnerability
Anti-Malware  ProductsPattern File DetectionTrojan.SH.MIXBASH.A
 
As previously mentioned, there is now news of an active Linux worm exploiting this particular vulnerability which makes getting protection in place as soon as possible critical.  Trend Micro is actively monitoring and researching to ensure protection against these new exploits are in place.

 

Reference(s)

Keywords: Exim