Published: 02/02/2011 Updated: 17/08/2017

CVSS v2 Base Score: 6.9 | Impact Score: 10 | Exploitability Score: 3.4

VMScore: 614

Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C

The open_log function in log.c in Exim 4.72 and previous versions does not check the return value from (1) setuid or (2) setgid system calls, which allows local users to append log data to arbitrary files via a symlink attack.

Vulnerable Product	Search on Vulmon	Subscribe to Product
exim exim 4.43
exim exim 4.34
exim exim 4.61
exim exim 4.60
exim exim 4.42
exim exim 4.65
exim exim 4.32
exim exim 4.20
exim exim 4.02
exim exim 4.01
exim exim 3.30
exim exim 3.22
exim exim 3.12
exim exim 3.11
exim exim 2.11
exim exim 2.10
exim exim 4.69
exim exim 4.50
exim exim 4.44
exim exim 4.63
exim exim 4.62
exim exim 4.21
exim exim 4.22
exim exim 4.41
exim exim 4.40
exim exim 4.04
exim exim 4.03
exim exim 3.32
exim exim 3.31
exim exim 3.14
exim exim 3.13
exim exim 3.00
exim exim 2.12
exim exim 4.51
exim exim 4.30
exim exim 4.64
exim exim 4.23
exim exim 4.24
exim exim 4.68
exim exim 4.10
exim exim 4.14
exim exim 4.05
exim exim 3.34
exim exim 3.33
exim exim 3.16
exim exim 3.15
exim exim 3.02
exim exim 3.01
exim exim
exim exim 4.33
exim exim 4.31
exim exim 4.54
exim exim 4.53
exim exim 4.52
exim exim 4.66
exim exim 4.67
exim exim 4.11
exim exim 4.12
exim exim 4.00
exim exim 3.36
exim exim 3.35
exim exim 3.21
exim exim 3.20
exim exim 3.10
exim exim 3.03
exim exim 4.70
exim exim 4.71

It was discovered that Exim contained a design flaw in the way it processed alternate configuration files An attacker that obtained privileges of the “Debian-exim” user could use an alternate configuration file to obtain root privileges (CVE-2010-4345) ...

A design flaw (CVE-2010-4345) in exim4 allowed the local Debian-exim user to obtain root privileges by specifying an alternate configuration file using the -C option or by using the macro override facility (-D option) Unfortunately, fixing this vulnerability is not possible without some changes in exim4's behaviour If you use the -C or -D options ...

CWE-20 CWE-59 http://www.vupen.com/english/advisories/2011/0224 http://www.vupen.com/english/advisories/2011/0245 http://www.securityfocus.com/bid/46065 http://secunia.com/advisories/43128 ftp://ftp.exim.org/pub/exim/ChangeLogs/ChangeLog-4.74 http://osvdb.org/70696 http://secunia.com/advisories/43101 http://www.debian.org/security/2011/dsa-2154 http://lists.exim.org/lurker/message/20110126.034702.4d69c278.en.html http://secunia.com/advisories/43243 http://www.vupen.com/english/advisories/2011/0364 http://www.ubuntu.com/usn/USN-1060-1 http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00004.html http://www.vupen.com/english/advisories/2011/0464 https://exchange.xforce.ibmcloud.com/vulnerabilities/65028 https://usn.ubuntu.com/1060-1/https://nvd.nist.gov

CVE-2011-0017

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect