CVE-2025-67896

Executive Summary

CVE-2025-67896 is a critical heap-based buffer overflow vulnerability in Exim Mail Transfer Agent (MTA) versions prior to 4.99.1. The flaw resides in the handling of rate-limit database records when non-default rate-limit configurations are enabled. An attacker can trigger a remote heap overflow by sending specially crafted data that causes Exim to cast database records directly to internal structures without proper validation. This can lead to denial of service (DoS) or potentially remote code execution (RCE) in certain configurations. The vulnerability has a CVSS score of 7.0 (High) and is currently unpatched in affected versions. No public exploit code or proof-of-concept is available at this time.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Base Score: 7.0 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: High (A:H)

The vulnerability is remotely exploitable without authentication, making it a significant threat to mail server infrastructure. The primary impact is on availability, but in some environments, heap overflows can be leveraged for code execution.

Deep Dive & Mechanics

The vulnerability exists in Exim's rate-limit feature, which is used to control the rate of incoming connections or messages. When rate-limit is enabled with non-default configurations (e.g., using a database backend like DBM or SQLite), Exim stores rate-limit data in database records. The flaw occurs when these records are read back from the database and cast directly to internal C structures without proper size or boundary validation.

Specifically, the code in src/rate.c or similar files reads a binary blob from the database and interprets it as a rate_limit_record structure. If an attacker can influence the data stored in the database (e.g., by sending a crafted message that causes a malformed record to be written), or if the database itself is corrupted, the subsequent read operation can cause a heap buffer overflow. This overflow can corrupt adjacent heap memory, leading to crashes or potentially arbitrary code execution.

The vulnerability is triggered when:

1. Exim is configured with a non-default rate-limit database (e.g., rate_limit_db = /path/to/db).
2. An attacker sends a message or connection that causes Exim to write a malformed rate-limit record.
3. On subsequent reads, the malformed record is cast to the internal structure, causing an overflow.

Vulnerable vs. Patched Code

Vulnerable Code (Exim < 4.99.1):

// Example from rate.c (simplified)
typedef struct {
    int count;
    char data[64]; // Fixed-size buffer
} rate_limit_record;

void read_rate_record(DB *db, char *key) {
    DBT key_dbt, data_dbt;
    memset(&key_dbt, 0, sizeof(key_dbt));
    memset(&data_dbt, 0, sizeof(data_dbt));
    key_dbt.data = key;
    key_dbt.size = strlen(key);
    
    if (db->get(db, &key_dbt, &data_dbt, 0) == 0) {
        // Vulnerable: direct cast without size check
        rate_limit_record *rec = (rate_limit_record *)data_dbt.data;
        // Use rec->count, rec->data...
    }
}

Patched Code (Exim 4.99.1+):

// Patched version with size validation
void read_rate_record(DB *db, char *key) {
    DBT key_dbt, data_dbt;
    memset(&key_dbt, 0, sizeof(key_dbt));
    memset(&data_dbt, 0, sizeof(data_dbt));
    key_dbt.data = key;
    key_dbt.size = strlen(key);
    
    if (db->get(db, &key_dbt, &data_dbt, 0) == 0) {
        // Validate size before casting
        if (data_dbt.size < sizeof(rate_limit_record)) {
            // Log error and reject
            log_write(LOG_MAIN, "Rate limit record too small");
            return;
        }
        rate_limit_record *rec = (rate_limit_record *)data_dbt.data;
        // Use rec->count, rec->data...
    }
}

The patch adds a size check to ensure the database record is at least as large as the expected structure before casting.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Exim version < 4.99.1 with non-default rate-limit configuration.
• Network access to the SMTP port (usually 25).
• Knowledge of the rate-limit database path (e.g., /var/spool/exim/db/rate-limit).

Exploitation Steps:

1. Reconnaissance: Identify Exim version via SMTP banner or EHLO response.
2. Trigger Rate-Limit: Send a series of connections or messages to trigger rate-limit database writes.
3. Craft Malformed Record: Send a specially crafted message that causes Exim to write a malformed rate-limit record with an oversized data field.
4. Trigger Overflow: Send another connection that causes Exim to read the malformed record, triggering the heap overflow.
5. Achieve RCE (if possible): Use heap spraying or other techniques to overwrite function pointers or return addresses.

Example SMTP Session (Conceptual):

# Connect to Exim SMTP
nc target 25
EHLO attacker
MAIL FROM:<attacker@test.com>
RCPT TO:<victim@target.com>
DATA
Subject: Test
From: attacker@test.com
To: victim@target.com

Malicious payload to trigger overflow
.
QUIT

Note: No public exploit code is available. This is a theoretical exploitation path.

Blue Team (Defense & Detection)

Detection:

• Monitor Exim logs for rate-limit errors or crashes.
• Look for unusual SMTP traffic patterns (e.g., rapid connections from a single IP).
• Use the YARA and Sigma rules below to detect exploitation attempts.

Mitigation:

• Immediately upgrade to Exim 4.99.1 or later.
• If upgrade is not possible, disable rate-limit feature or use default configurations.
• Restrict SMTP access to trusted IPs only.
• Enable logging and alerting for Exim crashes.

Indicators of Compromise (IOCs)

• Network Indicators:
  • Unusual SMTP traffic from a single IP (e.g., >100 connections in 1 minute).
  • SMTP sessions with malformed DATA payloads.
• File Indicators:
  • Corrupted rate-limit database files (e.g., /var/spool/exim/db/rate-limit).
  • Exim core dump files (e.g., /var/spool/exim/input/*.core).
• Log Indicators:
  • Exim paniclog entries with "rate limit" or "heap overflow" errors.
  • Syslog entries showing Exim crashes (e.g., exim[PID]: segfault at ...).

Detection Engineering

YARA Rule

rule CVE_2025_67896_Exim_RateLimit_Overflow {
    meta:
        description = "Detects Exim rate-limit heap overflow exploitation attempts"
        author = "Valters IT"
        date = "2025-01-01"
        cve = "CVE-2025-67896"
    strings:
        $s1 = "rate_limit_record" ascii wide nocase
        $s2 = "db->get" ascii wide nocase
        $s3 = "heap overflow" ascii wide nocase
    condition:
        any of them
}

Sigma Rule

title: Exim Rate-Limit Heap Overflow Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential exploitation of CVE-2025-67896 in Exim logs
author: Valters IT
date: 2025-01-01
logsource:
    product: linux
    service: syslog
detection:
    selection:
        - "exim" and "paniclog" and "rate limit"
        - "exim" and "segfault" and "rate"
    condition: selection
falsepositives:
    - Legitimate rate-limit errors under heavy load
level: high

Suricata Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"CVE-2025-67896 Exim Rate-Limit Heap Overflow Attempt"; flow:to_server,established; content:"EHLO"; nocase; content:"MAIL FROM"; nocase; content:"RCPT TO"; nocase; content:"DATA"; nocase; pcre:"/^Subject\s*:\s*.{100,}/mi"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Exim to version 4.99.1 or later.
2. If upgrade is not possible, disable the rate-limit feature by removing or commenting out rate_limit_db in the Exim configuration file.
3. Restrict SMTP access to trusted IPs using firewall rules (e.g., iptables -A INPUT -p tcp --dport 25 -s trusted_network -j ACCEPT).

Long-Term Measures:

• Implement network segmentation for mail servers.
• Enable comprehensive logging and monitoring for Exim.
• Regularly update Exim and other critical software.
• Conduct security audits of mail server configurations.

Workaround Configuration (Disable Rate-Limit):

# In /etc/exim/exim.conf, comment out or remove:
# rate_limit_db = /var/spool/exim/db/rate-limit
# Then restart Exim:
systemctl restart exim

Valters IT