Exim SQL Injection Vulnerability in Version 4.98

A remote SQL injection vulnerability has been identified in Exim version 4.98, prior to 4.98.1. This issue arises when the SQLite hints database is used, and the ETRN command serialization is enabled. The vulnerability allows an attacker to manipulate SQL queries, potentially leading to unauthorized data access or modification.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can interfere with the application's database queries. This could lead to unauthorized data access, data manipulation, or in some cases, executing administrative operations on the database.

Reproduction

To reproduce this vulnerability, Exim must be compiled with the SQLite option enabled, which allows the use of SQLite for hints databases. This can be verified by checking the Exim version output for 'Using sqlite3'. Once the vulnerable Exim version is running, the ETRN command can be sent with crafted arguments that exploit the SQL injection vulnerability. This can be done manually or automated with a script.

Remediation

Users can upgrade to Exim version 4.98.1, which addresses this vulnerability. Instructions for downloading the updated version are available on the Exim website.