Executive Summary
| Informations | |||
|---|---|---|---|
| Name | CVE-2011-0017 | First vendor Publication | 2011-02-01 |
| Vendor | Cve | Last vendor Modification | 2024-11-21 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:L/AC:M/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 6.9 | Attack Range | Local |
| Cvss Impact Score | 10 | Attack Complexity | Medium |
| Cvss Expoit Score | 3.4 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| The open_log function in log.c in Exim 4.72 and earlier does not check the return value from (1) setuid or (2) setgid system calls, which allows local users to append log data to arbitrary files via a symlink attack. |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0017 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 50 % | CWE-59 | Improper Link Resolution Before File Access ('Link Following') |
| 50 % | CWE-20 | Improper Input Validation |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:12692 | |||
| Oval ID: | oval:org.mitre.oval:def:12692 | ||
| Title: | DSA-2154-2 exim4 -- privilege escalation / regression | ||
| Description: | The updated packages from DSA-2154-1 introduced a regression which prevented unprivileged users from using "exim4 -bf" to test filter configurations. This update fixes this problem. Please also read the information provided in DSA-2154-1 if you have not done so already. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-2154-2 CVE-2010-4345 CVE-2011-0017 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 5.0 | Product(s): | exim4 |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:12931 | |||
| Oval ID: | oval:org.mitre.oval:def:12931 | ||
| Title: | DSA-2154-1 exim4 -- privilege escalation | ||
| Description: | A design flaw in exim4 allowed the loal Debian-exim user to obtain root privileges by specifying an alternate configuration file using the -C option or by using the macro override facility. Unfortunately, fixing this vulnerability is not possible without some changes in exim4's behvaviour. If you use the -C or -D options or use the system filter facility, you should evaluate the changes carefully and adjust your configuration accordingly. The Debian default configuration is not affected by the changes. The detailed list of changes is described in the NEWS. Debian file in the packages. The relevant sections are also reproduced below. In addition to that, missing error handling for the setuid/setgid system calls allowed the Debian-exim user to cause root to append log data to arbitrary files. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-2154-1 CVE-2010-4345 CVE-2011-0017 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 5.0 | Product(s): | exim4 |
| Definition Synopsis: | |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2011-03-05 | Name : exim -- local privilege escalation File : nvt/freebsd_exim2.nasl |
| 2011-02-11 | Name : Ubuntu Update for exim4 vulnerabilities USN-1060-1 File : nvt/gb_ubuntu_USN_1060_1.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 70696 | Exim log.c open_log() Function Local Privilege Escalation Exim contains a flaw that may allow an attacker to gain access to unauthorized privileges. The issue is triggered when the 'open_log()' function in 'log.c' fails to properly check the return values of the 'setuid()' and 'setgid()' functions, allowing a local attacker to use symlink attacks to cause root to append log data to arbitrary files, resulting in the attacker gaining root privileges. |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2014-06-13 | Name : The remote openSUSE host is missing a security update. File : suse_11_3_exim-110207.nasl - Type : ACT_GATHER_INFO |
| 2014-01-28 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201401-32.nasl - Type : ACT_GATHER_INFO |
| 2011-05-05 | Name : The remote openSUSE host is missing a security update. File : suse_11_2_exim-110207.nasl - Type : ACT_GATHER_INFO |
| 2011-02-14 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_44ccfab0356411e08e810022190034c0.nasl - Type : ACT_GATHER_INFO |
| 2011-02-11 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-1060-1.nasl - Type : ACT_GATHER_INFO |
| 2011-02-03 | Name : The remote mail server is potentially affected by a local privilege escalatio... File : exim_4_74.nasl - Type : ACT_GATHER_INFO |
| 2011-01-31 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2154.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2024-11-28 23:06:14 |
|
| 2024-11-28 12:24:17 |
|
| 2022-10-21 01:11:25 |
|
| 2021-05-04 12:13:44 |
|
| 2021-04-22 01:14:52 |
|
| 2020-05-23 01:43:35 |
|
| 2020-05-23 00:27:29 |
|
| 2017-08-17 09:23:13 |
|
| 2016-06-28 18:28:42 |
|
| 2016-04-26 20:26:52 |
|
| 2014-06-14 13:29:59 |
|
| 2014-02-17 10:59:15 |
|
| 2013-05-10 22:51:43 |
|
