Exim Use-After-Free Vulnerability in GnuTLS Configurations Allowing Remote Code Execution

A use-after-free vulnerability has been identified in Exim versions prior to 4.99.3, specifically in certain GnuTLS configurations. This vulnerability is remotely exploitable and occurs in the BDAT body parsing process. It is triggered when a client sends a TLS close_notify signal mid-transfer during a CHUNKING operation, followed by a cleartext byte on the same TCP connection. This sequence can lead to heap corruption, allowing an unauthenticated network attacker to execute arbitrary code.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected Exim server.

Reproduction

The vulnerability can be reproduced by sending a TLS close_notify signal during a CHUNKING transfer, followed by a cleartext byte. This can be done using a custom SMTP client that supports TLS and GnuTLS.

Remediation

Users are advised to upgrade to Exim version 4.99.3 or later.