On this page
Exim 4.100.1, released on September 18, fixes four flaws (the advisory). An SMTP smuggling flaw, rated Medium, affects every Exim up to and including 4.100. Two High-severity Proxy Protocol bugs, a heap over-read that ends in a one-byte write and a leak of stack data, affect 4.83 to 4.100 on a server built and configured for Proxy Protocol behind a buggy or compromised proxy. A Low use-after-free in TLS-on-connect needs a non-default option. The coverage since says how bad the bugs are, and nothing about how many servers have moved.
We counted with SMTP IP, which holds every host that returned an SMTP greeting on the mail submission port, 587, from our internet-wide scans. Between October 2 and 6, two weeks after the release, 2,697,057 hosts greeted there. 1,164,536 of them (43.2%) named Exim, ahead of Postfix with 586,601 (21.7%), Sendmail with 40,971 (1.5%) and Microsoft's server with 31,489 (1.2%).
Who has moved
1,152,649 of the Exim servers announce their version in the greeting:
| Exim servers announcing a version | Servers | On 4.100.1 | On an older version |
|---|---|---|---|
| All of them | 1,152,649 | 866,801 (75.2%) | 285,848 (24.8%) |
| With cPanel's greeting | 936,356 | 849,363 (90.7%) | 86,993 (9.3%) |
| Every other | 216,293 | 17,438 (8.1%) | 198,855 (91.9%) |
| ...with a Debian or Ubuntu banner | 61,542 | 1 | 61,541 |
The cPanel servers are the ones whose greeting ends "We do not authorize the use of this system to transport unsolicited, and/or bulk e-mail.", the line cPanel's Exim configuration writes into its banner (an example on cPanel's forum). cPanel ships Exim inside its own cPanel & WHM builds, and for an Exim fix it asks customers to update cPanel & WHM to a patched build. A server that takes cPanel's updates gets the new Exim with them.
Every other Exim comes from an operating system's package or a build its owner made, and 8.1% of those had moved.
A version string isn't a patch level
Debian and Ubuntu backport security fixes into their own builds and keep the old version number. Debian 13's security update, 4.98.2-1+deb13u5, fixes the 4.100.1 flaws and still announces 4.98.2, while Debian 12's 4.96 was still listed as vulnerable to them on October 9, by Debian's security tracker. So the 61,541 Debian and Ubuntu servers in the last row aren't all exposed, and this post says what servers announce, never which are vulnerable.
On a Debian or Ubuntu server you run, the package's changelog lists the CVEs its build fixes. The banner doesn't.
The long tail
125,283 Exim servers (10.9%) announce a release older than 4.97, and 3,398 one older than 4.83, from before 2014.
Finding Exim in your own ranges
SMTP IP has the greeting each host sent, line breaks collapsed to spaces, so a filter on Exim 4. over the ranges you own or protect, grouped by the version that follows, lists the servers still announcing an old release. The same goes for a customer's ranges, or a supplier's. SSH IP does the same for SSH servers on port 22.
How we counted
We took the SMTP IP hosts seen from October 2 to 6, read Exim's version from each greeting, and counted a greeting as cPanel's when it carried the line above, and as Debian or Ubuntu when it named either. A version is "older" when it's anything before 4.100.1.
SMTP IP is a gzipped CSV download, and its docs list the columns. To license it, see pricing or talk to us.
