A lot of people believe that Exim is a, let's say, 2nd generation MTA, like qmail and Postfix, both of which were written with security in mind as a reaction to the Sendmail security debacle --- Sendmail holding the title for many years in the 1990s as the most popular and important vector for remote code execution on the Internet.
But Exim is much more closely related to Sendmail (I believe it's technically a fork of Smail, which was a Sendmail competitor) than to Postfix or qmail. It parses haphazardly and, as, you can see, it isn't meaningfully privilege-separated. It rides atop all the quirks of the circa-1999 standard C library.
Nobody should be running Exim in 2021.
In reality, the world is moving on past even the 2nd generation MTAs, which, though their track records are pretty strong, are still built in memory-unsafe languages. Serverside software written in Java, Go, and Rust handle workloads far more difficult than even an ambitious Postfix deployment deals with. Still: it's baffling how we've ended up in a place where Exim --- whose security has been a running joke since the 1990s --- is one of the most popular Unix MTAs. Nobody would have called this outcome in 1999!
The funniest part of this advisory starts at "Exim's memory allocator"; just read on for a special Exim bug class.
This is great work, and a great writeup.
But Exim is much more closely related to Sendmail (I believe it's technically a fork of Smail, which was a Sendmail competitor) than to Postfix or qmail. It parses haphazardly and, as, you can see, it isn't meaningfully privilege-separated. It rides atop all the quirks of the circa-1999 standard C library.
Nobody should be running Exim in 2021.
In reality, the world is moving on past even the 2nd generation MTAs, which, though their track records are pretty strong, are still built in memory-unsafe languages. Serverside software written in Java, Go, and Rust handle workloads far more difficult than even an ambitious Postfix deployment deals with. Still: it's baffling how we've ended up in a place where Exim --- whose security has been a running joke since the 1990s --- is one of the most popular Unix MTAs. Nobody would have called this outcome in 1999!
The funniest part of this advisory starts at "Exim's memory allocator"; just read on for a special Exim bug class.
This is great work, and a great writeup.