Exim 4.72 and earlier allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with a directive that contains arbitrary commands, as demonstrated by the spool_directory directive.

remote attackers could trick exim into running arbitrary code (CVE-2010-4344). A privilege escalation flaw allowed attackers to gain root access (CVE-2010-4345).

The remote host is affected by the vulnerability described in GLSA-201401-32 (Exim: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Exim. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with root       privileges, or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2011-0153 advisory.

    [4.63-5.el5_6.2]
    - fix privilege escalation (CVE-2010-4345, #662012)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A privilege escalation flaw was discovered in Exim. If an attacker were able to gain access to the 'exim' user, they could cause Exim to execute arbitrary commands as the root user. (CVE-2010-4345)

This update adds a new configuration file, '/etc/exim/trusted-configs'. To prevent Exim from running arbitrary commands as root, Exim will now drop privileges when run with a configuration file not listed as trusted. This could break backwards compatibility with some Exim configurations, as the trusted-configs file only trusts '/etc/exim/exim.conf' and '/etc/exim/exim4.conf' by default. If you are using a configuration file not listed in the new trusted-configs file, you will need to add it manually.

Additionally, Exim will no longer allow a user to execute exim as root with the -D command line option to override macro definitions. All macro definitions that require root permissions must now reside in a trusted configuration file.

After installing this update, the exim daemon will be restarted automatically.

It was discovered that Exim contained a design flaw in the way it processed alternate configuration files. An attacker that obtained privileges of the 'Debian-exim' user could use an alternate configuration file to obtain root privileges. (CVE-2010-4345)

It was discovered that Exim incorrectly handled certain return values when handling logging. An attacker that obtained privileges of the 'Debian-exim' user could use this flaw to obtain root privileges.
(CVE-2011-0017)

Dan Rosenberg discovered that Exim incorrectly handled writable sticky-bit mail directories. If Exim were configured in this manner, a local user could use this flaw to cause a denial of service or possibly gain privileges. This issue only applied to Ubuntu 6.06 LTS, 8.04 LTS, 9.10, and 10.04 LTS. (CVE-2010-2023)

Dan Rosenberg discovered that Exim incorrectly handled MBX locking. If Exim were configured in this manner, a local user could use this flaw to cause a denial of service or possibly gain privileges. This issue only applied to Ubuntu 6.06 LTS, 8.04 LTS, 9.10, and 10.04 LTS.
(CVE-2010-2024).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A design flaw (CVE-2010-4345 ) in exim4 allowed the local Debian-exim user to obtain root privileges by specifying an alternate configuration file using the -C option or by using the macro override facility (-D option). Unfortunately, fixing this vulnerability is not possible without some changes in exim4's behaviour. If you use the -C or -D options or use the system filter facility, you should evaluate the changes carefully and adjust your configuration accordingly. The Debian default configuration is not affected by the changes.

The detailed list of changes is described in the NEWS.Debian file in the packages. The relevant sections are also reproduced below.

In addition to that, missing error handling for the setuid/setgid system calls allowed the Debian-exim user to cause root to append log data to arbitrary files (CVE-2011-0017 ).

Updated exim packages that fix one security issue are now available for Red Hat Enterprise Linux 4 and 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Exim is a mail transport agent (MTA) developed at the University of Cambridge for use on UNIX systems connected to the Internet.

A privilege escalation flaw was discovered in Exim. If an attacker were able to gain access to the 'exim' user, they could cause Exim to execute arbitrary commands as the root user. (CVE-2010-4345)

This update adds a new configuration file, '/etc/exim/trusted-configs'. To prevent Exim from running arbitrary commands as root, Exim will now drop privileges when run with a configuration file not listed as trusted. This could break backwards compatibility with some Exim configurations, as the trusted-configs file only trusts '/etc/exim/exim.conf' and '/etc/exim/exim4.conf' by default. If you are using a configuration file not listed in the new trusted-configs file, you will need to add it manually.

Additionally, Exim will no longer allow a user to execute exim as root with the -D command line option to override macro definitions. All macro definitions that require root permissions must now reside in a trusted configuration file.

Users of Exim are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing this update, the exim daemon will be restarted automatically.

The remote Redhat Enterprise Linux 4 / 5 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2011:0153 advisory.

    Exim is a mail transport agent (MTA) developed at the University of     Cambridge for use on UNIX systems connected to the Internet.

    A privilege escalation flaw was discovered in Exim. If an attacker were     able to gain access to the exim user, they could cause Exim to execute     arbitrary commands as the root user. (CVE-2010-4345)

    This update adds a new configuration file, /etc/exim/trusted-configs. To     prevent Exim from running arbitrary commands as root, Exim will now drop     privileges when run with a configuration file not listed as trusted. This     could break backwards compatibility with some Exim configurations, as the     trusted-configs file only trusts /etc/exim/exim.conf and     /etc/exim/exim4.conf by default. If you are using a configuration file     not listed in the new trusted-configs file, you will need to add it     manually.

    Additionally, Exim will no longer allow a user to execute exim as root with     the -D command line option to override macro definitions. All macro     definitions that require root permissions must now reside in a trusted     configuration file.

    Users of Exim are advised to upgrade to these updated packages, which     contain a backported patch to correct this issue. After installing this     update, the exim daemon will be restarted automatically.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

David Woodhouse reports :

Secondly a privilege escalation where the trusted 'exim' user is able to tell Exim to use arbitrary config files, in which further ${run ...} commands will be invoked as root.

ID	Name	Product	Family	Severity
75481	openSUSE Security Update : exim (openSUSE-SU-2010:1052-1)	Nessus	SuSE Local Security Checks	high
72159	GLSA-201401-32 : Exim: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
68180	Oracle Linux 5 : exim (ELSA-2011-0153)	Nessus	Oracle Linux Local Security Checks	high
60936	Scientific Linux Security Update : exim on SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
53715	openSUSE Security Update : exim (openSUSE-SU-2010:1052-1)	Nessus	SuSE Local Security Checks	high
53657	openSUSE Security Update : exim (openSUSE-SU-2010:1052-1)	Nessus	SuSE Local Security Checks	high
51954	Ubuntu 6.06 LTS / 8.04 LTS / 9.10 / 10.04 LTS / 10.10 : exim4 vulnerabilities (USN-1060-1)	Nessus	Ubuntu Local Security Checks	medium
51819	Debian DSA-2154-1 : exim4 - privilege escalation	Nessus	Debian Local Security Checks	medium
51785	CentOS 4 / 5 : exim (CESA-2011:0153)	Nessus	CentOS Local Security Checks	medium
51562	RHEL 4 / 5 : exim (RHSA-2011:0153)	Nessus	Red Hat Local Security Checks	high
51446	FreeBSD : exim -- local privilege escalation (e4fcf020-0447-11e0-becc-0022156e8794)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2010-4345

high

Tenable Plugins

high

high

high

medium

high

high

medium

medium

medium

high

medium