Exim security issues with 4.89 instead of 4.93

[Ayia Napa George]

I just read some German computer news site Heise.de who warn about attacs to exim4 lower than 4.93.

Might affect all Debian 3CX installs, not just mine.....

Checking my 3CX installs on Debian stretch (exim --version), I see, that there's still exim 4.89 installed, (Exim version 4.89 #2 built 13-May-2020 16:18:26)
The machine and 3CX are on latest patch level using apt.

System: Linux 4.9.0-12-amd64 #1 SMP Debian 4.9.210-1 (2020-01-20) x86_64

• I am well aware, that this is not a 3CX problem, but 3CX does not install on newer Debian....
• Does anybody know, how to get secure / latest exim 4.93 to Debian Stretch?
• Cannot block mail ports in firewall....

sources.list:
deb http://deb.debian.org/debian stretch main contrib non-free
deb http://security.debian.org/ stretch/updates main contrib non-free
deb http://deb.debian.org/debian stretch-updates main contrib non-free

 

[fxbastler]

Still vulnerable if exim only listen at 127.0.0.1:25?

 

[florink]

This vulnerability is from last year. You are running an updated version of 4.89 which should not be vulnerable. Also, the vulnerability assumes that your server receives emails. Maybe you should better seek help on debian or exim forums.