Executive Summary

Summary
Titleexim security update
Informations
NameRHSA-2011:0153First vendor Publication2011-01-17
VendorRedHatLast vendor Modification2011-01-17
Severity (Vendor) ModerateRevision01

Security-Database Scoring CVSS v2

Cvss vector : (AV:L/AC:M/Au:N/C:C/I:C/A:C)
Cvss Base Score6.9Attack RangeLocal
Cvss Impact Score10Attack ComplexityMedium
Cvss Expoit Score3.4AuthenticationNone Required
Calculate full CVSS 2.0 Vectors scores

Detail

Problem Description:

Updated exim packages that fix one security issue are now available for Red
Hat Enterprise Linux 4 and 5.

The Red Hat Security Response Team has rated this update as having moderate
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64
Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64

3. Description:

Exim is a mail transport agent (MTA) developed at the University of
Cambridge for use on UNIX systems connected to the Internet.

A privilege escalation flaw was discovered in Exim. If an attacker were
able to gain access to the "exim" user, they could cause Exim to execute
arbitrary commands as the root user. (CVE-2010-4345)

This update adds a new configuration file, "/etc/exim/trusted-configs". To
prevent Exim from running arbitrary commands as root, Exim will now drop
privileges when run with a configuration file not listed as trusted. This
could break backwards compatibility with some Exim configurations, as the
trusted-configs file only trusts "/etc/exim/exim.conf" and
"/etc/exim/exim4.conf" by default. If you are using a configuration file
not listed in the new trusted-configs file, you will need to add it
manually.

Additionally, Exim will no longer allow a user to execute exim as root with
the -D command line option to override macro definitions. All macro
definitions that require root permissions must now reside in a trusted
configuration file.

Users of Exim are advised to upgrade to these updated packages, which
contain a backported patch to correct this issue. After installing this
update, the exim daemon will be restarted automatically.

4. Solution:

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

5. Bugs fixed (http://bugzilla.redhat.com/):

662012 - CVE-2010-4345 exim privilege escalation

Original Source

Url : https://rhn.redhat.com/errata/RHSA-2011-0153.html

CWE : Common Weakness Enumeration

idName
CWE-264Permissions, Privileges, and Access Controls

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:21735
 
Oval ID: oval:org.mitre.oval:def:21735
Title: RHSA-2011:0153: exim security update (Moderate)
Description: Exim 4.72 and earlier allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with a directive that contains arbitrary commands, as demonstrated by the spool_directory directive.
Family: unix Class: patch
Reference(s): RHSA-2011:0153-01
CESA-2011:0153
CVE-2010-4345
Version: 4
Platform(s): Red Hat Enterprise Linux 5
CentOS Linux 5
Product(s): exim
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:22839
 
Oval ID: oval:org.mitre.oval:def:22839
Title: ELSA-2011:0153: exim security update (Moderate)
Description: Exim 4.72 and earlier allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with a directive that contains arbitrary commands, as demonstrated by the spool_directory directive.
Family: unix Class: patch
Reference(s): ELSA-2011:0153-01
CVE-2010-4345
Version: 3
Platform(s): Oracle Linux 4
Oracle Linux 5
Product(s):
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application67

ExploitDB Exploits

idDescription
2010-12-16Exim4 <= 4.69 string_format Function Heap Buffer Overflow

OpenVAS Exploits

DateDescription
2012-07-30Name : CentOS Update for exim CESA-2011:0153 centos4 x86_64
File : nvt/gb_CESA-2011_0153_exim_centos4_x86_64.nasl
2012-07-30Name : CentOS Update for exim CESA-2011:0153 centos5 x86_64
File : nvt/gb_CESA-2011_0153_exim_centos5_x86_64.nasl
2011-08-09Name : CentOS Update for exim CESA-2011:0153 centos5 i386
File : nvt/gb_CESA-2011_0153_exim_centos5_i386.nasl
2011-02-11Name : Ubuntu Update for exim4 vulnerabilities USN-1060-1
File : nvt/gb_ubuntu_USN_1060_1.nasl
2011-01-31Name : CentOS Update for exim CESA-2011:0153 centos4 i386
File : nvt/gb_CESA-2011_0153_exim_centos4_i386.nasl
2011-01-24Name : FreeBSD Ports: exim
File : nvt/freebsd_exim1.nasl
2011-01-21Name : RedHat Update for exim RHSA-2011:0153-01
File : nvt/gb_RHSA-2011_0153-01_exim.nasl
2011-01-04Name : SuSE Update for exim SUSE-SA:2010:059
File : nvt/gb_suse_2010_059.nasl

Open Source Vulnerability Database (OSVDB)

idDescription
69860Exim exim User Account Configuration File Directive Local Privilege Escalation

Metasploit Database

idDescription
2010-12-07 Exim4 string_format Function Heap Buffer Overflow

Nessus® Vulnerability Scanner

DateDescription
2014-01-28Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201401-32.nasl - Type : ACT_GATHER_INFO
2013-07-12Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2011-0153.nasl - Type : ACT_GATHER_INFO
2012-08-01Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20110117_exim_on_SL4_x.nasl - Type : ACT_GATHER_INFO
2011-05-05Name : The remote SuSE system is missing a security patch for exim
File : suse_11_1_exim-101211.nasl - Type : ACT_GATHER_INFO
2011-05-05Name : The remote SuSE system is missing a security patch for exim
File : suse_11_2_exim-101211.nasl - Type : ACT_GATHER_INFO
2011-02-11Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-1060-1.nasl - Type : ACT_GATHER_INFO
2011-01-31Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2154.nasl - Type : ACT_GATHER_INFO
2011-01-28Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2011-0153.nasl - Type : ACT_GATHER_INFO
2011-01-18Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2011-0153.nasl - Type : ACT_GATHER_INFO
2011-01-10Name : The remote FreeBSD host is missing a security-related update.
File : freebsd_pkg_e4fcf020044711e0becc0022156e8794.nasl - Type : ACT_GATHER_INFO
2010-12-15Name : The remote service has a buffer overflow.
File : exim_string_vformat.nasl - Type : ACT_ATTACK
2010-12-12Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2131.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
DateInformations
2014-02-17 11:54:15
  • Multiple Updates