Debian update for exim4

Published: 2015-09-26

Risk	Low
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2010-4345 CVE-2011-0017
CWE-ID	CWE-78
Exploitation vector	Local
Public exploit	Vulnerability #1 is being exploited in the wild. Public exploit code for vulnerability #2 is available.
Vulnerable software Subscribe	Debian Linux Operating systems & Components / Operating system
Vendor	Debian

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Privilege escalation

EUVDB-ID: #VU341

Risk: Low

CVSSv3.1: 6 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:H/RL:O/RC:C]

CVE-ID: CVE-2010-4345

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Exploit availability: Yes

Description

The vulnerability allows a local user to escalate privileges on vulnerable system.

The vulnerability exists due to design error in Exim, when allowing local users to load arbitrary configuration file via the "spool_directory" directive. A local user can specify an alternate configuration file with a directive that contains arbitrary commands and execute arbitrary commands on the system with root privileges.

Successful exploitation of this vulnerability will allow a local user to gain root privileges on the system.

Mitigation

Update the affected package to version: 4.69-9+lenny3, 4.72-4

Vulnerable software versions

Debian Linux: All versions

External links

http://github.com/Exim/exim/wiki/EximSecurity

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

2) Privilege escalation

EUVDB-ID: #VU342