Exim Exploit Attempt - CVE-2019-15846

Exim is an MTA that runs on Unix and Linux servers. Exim has a vulnerability that causes a buffer overflow, leading to remote code execution (RCE). To exploit this vulnerability, an attacker initiates a TLS handshake to establish a secure connection with the Exim server. During the TLS handshake, the attacker submits malicious data, which includes a Server Name Indication (SNI) that ends with a trailing backslash and a payload. The SNI and payload are written to the memory buffer, but the trailing backslash affects where a vulnerable Exim process begins to read and write data from the payload. As a result, the Exim process performs an out-of-bounds write. This type of buffer overflow enables malicious code within the payload to run on the server with root privileges.