Executive Summary
| Informations | |||
|---|---|---|---|
| Name | CVE-2010-2024 | First vendor Publication | 2010-06-07 |
| Vendor | Cve | Last vendor Modification | 2024-11-21 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:L/AC:M/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 4.4 | Attack Range | Local |
| Cvss Impact Score | 6.4 | Attack Complexity | Medium |
| Cvss Expoit Score | 3.4 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| transports/appendfile.c in Exim before 4.72, when MBX locking is enabled, allows local users to change permissions of arbitrary files or create arbitrary files, and cause a denial of service or possibly gain privileges, via a symlink attack on a lockfile in /tmp/. |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2024 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-362 | Race Condition |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:13736 | |||
| Oval ID: | oval:org.mitre.oval:def:13736 | ||
| Title: | USN-1060-1 -- exim4 vulnerabilities | ||
| Description: | It was discovered that Exim contained a design flaw in the way it processed alternate configuration files. An attacker that obtained privileges of the "Debian-exim" user could use an alternate configuration file to obtain root privileges. It was discovered that Exim incorrectly handled certain return values when handling logging. A local attacker could use this flaw to obtain root privileges. Dan Rosenberg discovered that Exim incorrectly handled writable sticky-bit mail directories. If Exim were configured in this manner, a local user could use this flaw to cause a denial of service or possibly gain privileges. This issue only applied to Ubuntu 6.06 LTS, 8.04 LTS, 9.10, and 10.04 LTS. Dan Rosenberg discovered that Exim incorrectly handled MBX locking. If Exim were configured in this manner, a local user could use this flaw to cause a denial of service or possibly gain privileges. This issue only applied to Ubuntu 6.06 LTS, 8.04 LTS, 9.10, and 10.04 LTS | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-1060-1 CVE-2010-4345 CVE-2011-0017 CVE-2010-2023 CVE-2010-2024 | Version: | 5 |
| Platform(s): | Ubuntu 8.04 Ubuntu 10.10 Ubuntu 10.04 Ubuntu 9.10 Ubuntu 6.06 | Product(s): | exim4 |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2011-05-23 | Name : Fedora Update for exim FEDORA-2011-7059 File : nvt/gb_fedora_2011_7059_exim_fc13.nasl |
| 2011-04-19 | Name : Fedora Update for exim FEDORA-2010-12375 File : nvt/gb_fedora_2010_12375_exim_fc14.nasl |
| 2011-02-11 | Name : Ubuntu Update for exim4 vulnerabilities USN-1060-1 File : nvt/gb_ubuntu_USN_1060_1.nasl |
| 2010-06-11 | Name : Fedora Update for exim FEDORA-2010-9506 File : nvt/gb_fedora_2010_9506_exim_fc12.nasl |
| 2010-06-11 | Name : Fedora Update for exim FEDORA-2010-9524 File : nvt/gb_fedora_2010_9524_exim_fc13.nasl |
| 2010-06-03 | Name : Exim < 4.72 RC2 Multiple Vulnerabilities File : nvt/gb_exim_4_72.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 65159 | Exim transports/appendfile.c MBX Locking Race Condition Permission Modification |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2014-06-13 | Name : The remote openSUSE host is missing a security update. File : suse_11_3_exim-100720.nasl - Type : ACT_GATHER_INFO |
| 2014-01-28 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201401-32.nasl - Type : ACT_GATHER_INFO |
| 2011-04-13 | Name : The remote Fedora host is missing a security update. File : fedora_2010-12375.nasl - Type : ACT_GATHER_INFO |
| 2011-02-11 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-1060-1.nasl - Type : ACT_GATHER_INFO |
| 2010-07-23 | Name : The remote openSUSE host is missing a security update. File : suse_11_1_exim-100720.nasl - Type : ACT_GATHER_INFO |
| 2010-07-23 | Name : The remote openSUSE host is missing a security update. File : suse_11_2_exim-100720.nasl - Type : ACT_GATHER_INFO |
| 2010-07-01 | Name : The remote Fedora host is missing a security update. File : fedora_2010-9506.nasl - Type : ACT_GATHER_INFO |
| 2010-07-01 | Name : The remote Fedora host is missing a security update. File : fedora_2010-9524.nasl - Type : ACT_GATHER_INFO |
| 2010-06-02 | Name : The remote mail server is potentially affected by multiple vulnerabilities. File : exim_4_72.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2024-11-28 23:08:27 |
|
| 2024-11-28 12:22:02 |
|
| 2022-10-21 01:10:12 |
|
| 2021-05-04 12:11:39 |
|
| 2021-04-22 01:12:14 |
|
| 2020-05-23 01:42:08 |
|
| 2020-05-23 00:25:52 |
|
| 2018-10-11 00:19:52 |
|
| 2017-08-17 09:23:01 |
|
| 2016-04-26 19:50:51 |
|
| 2014-06-14 13:28:48 |
|
| 2014-02-17 10:55:38 |
|
| 2013-05-10 23:25:56 |
|
