Default set-uid root for perl_startup script - CVE-2016-1531
Published: June 28, 2016 / Updated: September 14, 2018
Vulnerability identifier: #VU34
CSH Severity: Low
CVSS v4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-1531
CWE-ID: CWE-676
Exploitation vector: Local access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a local user to obtain elevated privileges.
The vulnerability exists due to improper default permission for "perl_startup" startup script, which has set-uid root bit. A local user can obtain root privileges on the system.
Successful exploitation of this vulnerability will allow the local attacker to obtain elevated privileges and execute arbitrary commands as root.
Affected software
Arch Linux
Debian Linux
Fedora
Opensuse
exim (Alpine package)
exim
Debian Linux
Fedora
Opensuse
exim (Alpine package)
exim
How to mitigate CVE-2016-1531
Install the latest version Exim 4.84.2, 4.85.2 or 4.86.2.
exim (Alpine package) - update to 4.86.2-r0
exim - addressed in versions 4.84.2-1.el6, 4.84.2-1.el7, 4.85.2-1.fc22, 4.86.2-1.fc23
exim - addressed in versions 4.84.2-1.el6, 4.84.2-1.el7, 4.85.2-1.fc22, 4.86.2-1.fc23
Links to Public Exploits and PoC-codes
External References
Related Security Bulletins
- Privilege escalation vulnerability in Exim MTA
- openSUSE update for exim
- Arch Linux update for exim
- Debian update for exim4
- OpenSUSE Linux update for exim
- Default set-uid root for perl_startup script in exim (Alpine package)
- Fedora 23 update for exim
- Fedora 22 update for exim
- Fedora EPEL 7 update for exim
- Fedora EPEL 6 update for exim