{"id":794,"date":"2021-07-23T12:38:20","date_gmt":"2021-07-23T12:38:20","guid":{"rendered":"https:\/\/ssdsunucum.com\/blog\/cve-2019-10149-exim\/"},"modified":"2021-07-23T12:38:20","modified_gmt":"2021-07-23T12:38:20","slug":"cve-2019-10149-exim","status":"publish","type":"post","link":"https:\/\/ssdsunucum.com\/blog\/cve-2019-10149-exim\/","title":{"rendered":"CVE-2019-10149 Exim"},"content":{"rendered":"<\/p>\n
\n
<\/div>\n
\n

Background Information<\/h2>\n

On Tuesday, June 4, 2019, Exim maintainers announced that they received a report of a potential remote exploit in Exim from version 4.87 to version 4.91.<\/p>\n

On Wednesday, June 5, 2019, the Exim maintainers released a patch for these vulnerabilities .<\/p>\n

Impact<\/h2>\n

According to Exim development: \u201cWe received a report of a possible remote exploit. Currently there is no evidence of an active use of this exploit. The severity depends on your configuration. It depends on how close to the standard configuration your Exim runtime configuration is. Exim 4.92 is not vulnerable.\u201d<\/p>\n

Releases<\/h2>\n

The following versions of cPanel & WHM were patched to have the correct version of Exim. All previous versions of cPanel & WHM below the stated versions are potentially vulnerable to a root RCE.<\/p>\n

    \n
  • 70 \u2014 70.0.69<\/li>\n
  • 76 \u2014 76.0.22<\/li>\n
  • 78 \u2014 78.0.27<\/li>\n
  • 80 \u2014 Already on Exim version 4.92 which is not vulnerable<\/li>\n
  • EDGE \u2014 Currently on version 80 which is not vulnerable<\/li>\n
  • CURRENT \u2014 Currently on version 80 which is not vulnerable<\/li>\n
  • RELEASE \u2014 Currently on version 80 which is not vulnerable<\/li>\n
  • STABLE \u2014 78.0.27<\/li>\n<\/ul>\n

    How to determine if your server is up to date<\/h2>\n

    The updated RPMs provided by cPanel should be at least<\/strong> 4.91-4 on versions 70 and 76 and at least 4.92 on versions 78 and above. <\/p>\n

    \n
    rpm -<\/span>q exim<\/code><\/pre>\n<\/div>\n
    The output should resemble below:<\/p>\n
      \n
    • \n
      Versions 70 and 76 \u2014 exim-4.91-4.cp1170.x86_64<\/code><\/p>\n<\/li>\n
    • \n
      Version 78 \u2014 exim-4.92-1.cp1178.x86_64<\/code><\/p>\n<\/li>\n
    • \n
      Version 80 \u2014 exim-4.92-1.cp1180.x86_64<\/code><\/p>\n<\/li>\n<\/ul>\n
      What to do if you are not up to date.<\/h2>\n
      If your server is not<\/strong> running one of the above versions, update immediately<\/strong>.<\/p>\n
      To upgrade your server, use WHM\u2019s Upgrade to Latest Version<\/em> interface (WHM >> Home >> cPanel >> Upgrade to Latest Version<\/em>).<\/p>\n
      Alternatively, you can run the commands below to upgrade your server from the command line: <\/p>\n
      \n
      \n\n\n
      \n
      1\n<\/span>2\n<\/span><\/code><\/pre>\n<\/td>\n
      		\n
      \/<\/span>scripts<\/span>\/<\/span>upcp<\/span>\n\/<\/span>scripts<\/span>\/<\/span>check_cpanel_rpms<\/span> --<\/span>fix<\/span> --<\/span>long<\/span>-<\/span>list<\/span><\/code><\/pre>\n<\/td>\n<\/tr>\n<\/table>\n<\/div>\n<\/div>\n
      If you are on version 76 you will need to update your \/etc\/cpupdate.conf<\/code> to look like the following: <\/p>\n
      \n
      \n\n\n
      \n
      1\n<\/span>2\n<\/span>3\n<\/span>4\n<\/span>5\n<\/span><\/code><\/pre>\n<\/td>\n
      		\n
      CPANEL<\/span>=11.76<\/span>\nRPMUP<\/span>=daily<\/span>\nSARULESUP<\/span>=daily<\/span>\nSTAGING_DIR<\/span>=\/<\/span>usr<\/span>\/<\/span>local<\/span>\/<\/span>cpanel<\/span>\nUPDATES<\/span>=daily<\/span><\/code><\/pre>\n<\/td>\n<\/tr>\n<\/table>\n<\/div>\n<\/div>\n
      After you complete this update (\/usr\/local\/cpanel\/scripts\/upcp<\/code>) set \/etc\/cpupdate.conf<\/code>:<\/p>\n
      If you were on STABLE previously, set the following: <\/p>\n
      \n
      \n\n\n
      \n
      1\n<\/span>2\n<\/span>3\n<\/span>4\n<\/span>5\n<\/span><\/code><\/pre>\n<\/td>\n
      		\n
      CPANEL<\/span>=stable<\/span>\nRPMUP<\/span>=daily<\/span>\nSARULESUP<\/span>=daily<\/span>\nSTAGING_DIR<\/span>=\/<\/span>usr<\/span>\/<\/span>local<\/span>\/<\/span>cpanel<\/span>\nUPDATES<\/span>=daily<\/span><\/code><\/pre>\n<\/td>\n<\/tr>\n<\/table>\n<\/div>\n<\/div>\n
      If you were on RELEASE previously, set the following: <\/p>\n
      \n
      \n\n\n
      \n
      1\n<\/span>2\n<\/span>3\n<\/span>4\n<\/span>5\n<\/span><\/code><\/pre>\n<\/td>\n
      		\n
      CPANEL<\/span>=release<\/span>\nRPMUP<\/span>=daily<\/span>\nSARULESUP<\/span>=daily<\/span>\nSTAGING_DIR<\/span>=\/<\/span>usr<\/span>\/<\/span>local<\/span>\/<\/span>cpanel<\/span>\nUPDATES<\/span>=daily<\/span><\/code><\/pre>\n<\/td>\n<\/tr>\n<\/table>\n<\/div>\n<\/div>\n
      This will allow you to upgrade to newer versions of cPanel & WHM once you have migrated to EasyApache 4.<\/p>\n
      Verify the new Exim RPM was installed<\/h3>\n
      In version 78 run the following: <\/p>\n
      \n
      rpm -<\/span>q exim<\/code><\/pre>\n<\/div>\n
      The output should resemble below: <\/p>\n
      \n
      exim-<\/span>4.92<\/span>-<\/span>1<\/span>.<\/span>cp1178.<\/span>x86_64<\/code><\/pre>\n<\/div>\n
      In versions 70 and 76 run the following: <\/p>\n
      \n
      rpm -<\/span>q --changelog <\/span>exim |<\/span> grep CVE-<\/span>2019<\/span>-<\/span>10149<\/span><\/code><\/pre>\n<\/div>\n
      The output should resemble below: <\/p>\n
      \n
      -<\/span> Patch for<\/span> CVE-<\/span>2019<\/span>-<\/span>10149<\/span><\/code><\/pre>\n<\/div>\n
      If you are still experiencing issues or need additional help,  contact cPanel support.<\/p>\n
      Additional documentation<\/h2>\n
      More detailed information can be found at the following websites:<\/p>\n
        \n
      • https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2019-10149<\/li>\n
      • https:\/\/seclists.org\/oss-sec\/2019\/q2\/152<\/li>\n<\/ul><\/div>\n","protected":false},"excerpt":{"rendered":"
        Background Information On Tuesday, June 4, 2019, Exim maintainers announced that they received a report of a potential remote exploit in Exim from version 4.87 to version 4.91. On Wednesday, June 5, 2019, the Exim maintainers released a patch for these vulnerabilities . Impact According to Exim development: \u201cWe received a report of a possible …<\/p>\n","protected":false},"author":1,"featured_media":795,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[1],"tags":[],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/posts\/794"}],"collection":[{"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/comments?post=794"}],"version-history":[{"count":0,"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/posts\/794\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/media\/795"}],"wp:attachment":[{"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/media?parent=794"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/categories?post=794"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/tags?post=794"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}