Security Advisory: DirectAdmin EXIM4 Configuration Injection
A configuration injection flaw in the DirectAdmin-managed Exim4 mail stack is fixed in this security release: crafted values could alter Exim's configuration with mail-server-level consequences. Update DirectAdmin and rebuild Exim through CustomBuild.
प्रभावित संस्करण
DirectAdmin 1.678 and earlier
पैच किया गया संस्करण
DirectAdmin 1.679
डिफ़ॉल्ट अपडेट कमांड
yum update -yसुधार कमांड
AlmaLinux 9 / CloudLinux 9
cd /usr/local/directadmin
echo 'action=update&value=current' >> data/task.queue
directadmin --reloadAlmaLinux 8 / CloudLinux 8
cd /usr/local/directadmin
echo 'action=update&value=current' >> data/task.queue
directadmin --reloadCentOS 7 / CloudLinux 7
cd /usr/local/directadmin
echo 'action=update&value=current' >> data/task.queue
directadmin --reloadUbuntu 22.04 / Debian 12
cd /usr/local/directadmin
echo 'action=update&value=current' >> data/task.queue
directadmin --reloadUbuntu 20.04 / Debian 11
cd /usr/local/directadmin
echo 'action=update&value=current' >> data/task.queue
directadmin --reloadSharedLicense लाइसेंस के तहत इसका अर्थ
Your SharedLicense license itself is not affected — this is a change in AlmaLinux 8, AlmaLinux 9 software, not in licensing. Update the product through its standard update channel. Licenses keep working through updates; nothing needs re-issuing or re-activating.
What happened
DirectAdmin manages the Exim4 mail transfer agent and its configuration on most installations. The flaw allowed configuration injection: input that reached Exim’s configuration could change how the mail server behaves — the delivery rules, the permissions, the routing. A manipulated Exim affects every mailbox and every outgoing message on the machine.
Who is affected
DirectAdmin servers running the Exim4 stack — which is essentially all of them, since Exim is the default MTA there.
How to apply the fix
- Update DirectAdmin itself, then let CustomBuild bring packages current:
cd /usr/local/directadmin/custombuild && ./build update && ./build update_versions - Review
/etc/exim.confmodifications for unexpected additions.
For SharedLicense customers
Your DirectAdmin license is unaffected — this is panel and mail software, not licensing. Licenses keep working through the update.
अक्सर पूछे जाने वाले प्रश्न
What does Exim configuration injection mean?
Which servers are exposed?
How do I update?
संदर्भ
अपने सिस्टम में भेद्यताओं की जाँच करें
अपना उत्पाद और ऑपरेटिंग सिस्टम चुनें ताकि आपके लिए लागू सटीक फिक्स कमांड देख सकें।
अपना सिस्टम जाँचें