CVE-2010-4345

Exim Privilege Escalation Vulnerability

Exim

Exim 4.72 and earlier allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with a directive that contains arbitrary commands, as demonstrated by the spool_directory directive.

14. Dez 2010

Ausgewertete Quellen

• Debian
  http://www.debian.org/security/2010/dsa-2131
• Debian
  http://www.debian.org/security/2011/dsa-2154
• Red Hat
  http://www.redhat.com/support/errata/RHSA-2011-0153.html
• Red Hat
  https://bugzilla.redhat.com/show_bug.cgi?id=662012
• Ubuntu
  http://www.ubuntu.com/usn/USN-1060-1
• Hersteller
  http://secunia.com/advisories/42576
• Hersteller
  http://www.exim.org/lurker/message/20101207.215955.bb32d4f2.en.html
• Hersteller
  http://www.vupen.com/english/advisories/2010/3171
• Hersteller
  http://www.vupen.com/english/advisories/2010/3204
• Hinweis
  http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00003.html
• Hinweis
  http://www.kb.cert.org/vuls/id/758489
• Hinweis
  http://www.metasploit.com/modules/exploit/unix/smtp/exim4_string_format
• Hinweis
  http://www.securityfocus.com/archive/1/515172/100/0/threaded
• Hinweis
  http://www.securityfocus.com/bid/45341
• Hinweis
  http://www.securitytracker.com/id?1024859
• Hinweis
  http://www.theregister.co.uk/2010/12/11/exim_code_execution_peril/
• CISA
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-4345
• CISA
  Exim Privilege Escalation Vulnerability
• NVD
  CVE-2010-4345