Critical vulnerability that bypasss attachment filter found in Exim Mail Transfer

Exim, a widely-used mail transfer agent, has been identified with a critical vulnerability that allows attackers to bypass its attachment filter, potentially enabling the delivery of malicious code attachments to users' mailboxes.

The vulnerability is tracked as CVE-2024-39929 (CVSS score 9.1) arises when Exim processes multiline header filenames according to RFC 2231. This flaw allows attackers to bypass the $mime_filename extension-blocking protection mechanism, enabling them to smuggle potentially harmful executable attachments into users' mailboxes.

Affected versions are Exim versions up to and including 4.97.1

As of July 10, 2024, Censys search reports 1,554,249 publicly exposed Exim servers running a potentially vulnerable version (4.97.1 or earlier), mostly in the United States, Russia, and Canada

A bug fix has been included in Release Candidate 3 of Exim version 4.98. Users of Exim are strongly advised to update their mailer to this or a newer version, or at least to update to 4.98 when it becomes generally available.

In September 2023, Exim had another critical vulnerability (CVE-2023-42115, CVSS 9.8), which allowed attackers to inject and execute malicious code.