Executive Summary

Name CVE-2011-0017 First vendor Publication 2011-02-01
Vendor Cve Last vendor Modification 2017-08-17

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:L/AC:M/Au:N/C:C/I:C/A:C)
Cvss Base Score 6.9 Attack Range Local
Cvss Impact Score 10 Attack Complexity Medium
Cvss Expoit Score 3.4 Authentication None Required
Calculate full CVSS 2.0 Vectors scores


The open_log function in log.c in Exim 4.72 and earlier does not check the return value from (1) setuid or (2) setgid system calls, which allows local users to append log data to arbitrary files via a symlink attack.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0017

CWE : Common Weakness Enumeration

% Id Name
50 % CWE-59 Improper Link Resolution Before File Access ('Link Following')
50 % CWE-20 Improper Input Validation

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:12692
Oval ID: oval:org.mitre.oval:def:12692
Title: DSA-2154-2 exim4 -- privilege escalation / regression
Description: The updated packages from DSA-2154-1 introduced a regression which prevented unprivileged users from using "exim4 -bf" to test filter configurations. This update fixes this problem. Please also read the information provided in DSA-2154-1 if you have not done so already.
Family: unix Class: patch
Reference(s): DSA-2154-2
Version: 5
Platform(s): Debian GNU/Linux 5.0
Product(s): exim4
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:12931
Oval ID: oval:org.mitre.oval:def:12931
Title: DSA-2154-1 exim4 -- privilege escalation
Description: A design flaw in exim4 allowed the loal Debian-exim user to obtain root privileges by specifying an alternate configuration file using the -C option or by using the macro override facility. Unfortunately, fixing this vulnerability is not possible without some changes in exim4's behvaviour. If you use the -C or -D options or use the system filter facility, you should evaluate the changes carefully and adjust your configuration accordingly. The Debian default configuration is not affected by the changes. The detailed list of changes is described in the NEWS. Debian file in the packages. The relevant sections are also reproduced below. In addition to that, missing error handling for the setuid/setgid system calls allowed the Debian-exim user to cause root to append log data to arbitrary files.
Family: unix Class: patch
Reference(s): DSA-2154-1
Version: 5
Platform(s): Debian GNU/Linux 5.0
Product(s): exim4
Definition Synopsis:

CPE : Common Platform Enumeration

Application 68

OpenVAS Exploits

Date Description
2011-03-05 Name : exim -- local privilege escalation
File : nvt/freebsd_exim2.nasl
2011-02-11 Name : Ubuntu Update for exim4 vulnerabilities USN-1060-1
File : nvt/gb_ubuntu_USN_1060_1.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
70696 Exim log.c open_log() Function Local Privilege Escalation

Exim contains a flaw that may allow an attacker to gain access to unauthorized privileges. The issue is triggered when the 'open_log()' function in 'log.c' fails to properly check the return values of the 'setuid()' and 'setgid()' functions, allowing a local attacker to use symlink attacks to cause root to append log data to arbitrary files, resulting in the attacker gaining root privileges.

Nessus® Vulnerability Scanner

Date Description
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : suse_11_3_exim-110207.nasl - Type : ACT_GATHER_INFO
2014-01-28 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201401-32.nasl - Type : ACT_GATHER_INFO
2011-05-05 Name : The remote openSUSE host is missing a security update.
File : suse_11_2_exim-110207.nasl - Type : ACT_GATHER_INFO
2011-02-14 Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_44ccfab0356411e08e810022190034c0.nasl - Type : ACT_GATHER_INFO
2011-02-11 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-1060-1.nasl - Type : ACT_GATHER_INFO
2011-02-03 Name : The remote mail server is potentially affected by a local privilege escalatio...
File : exim_4_74.nasl - Type : ACT_GATHER_INFO
2011-01-31 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2154.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

Source Url
BID http://www.securityfocus.com/bid/46065
CONFIRM ftp://ftp.exim.org/pub/exim/ChangeLogs/ChangeLog-4.74
DEBIAN http://www.debian.org/security/2011/dsa-2154
MLIST http://lists.exim.org/lurker/message/20110126.034702.4d69c278.en.html
OSVDB http://osvdb.org/70696
SECUNIA http://secunia.com/advisories/43101
SUSE http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00004.html
UBUNTU http://www.ubuntu.com/usn/USN-1060-1
VUPEN http://www.vupen.com/english/advisories/2011/0224
XF https://exchange.xforce.ibmcloud.com/vulnerabilities/65028

Alert History

If you want to see full details history, please login or register.
Date Informations
2020-05-23 01:43:35
  • Multiple Updates
2020-05-23 00:27:29
  • Multiple Updates
2017-08-17 09:23:13
  • Multiple Updates
2016-06-28 18:28:42
  • Multiple Updates
2016-04-26 20:26:52
  • Multiple Updates
2014-06-14 13:29:59
  • Multiple Updates
2014-02-17 10:59:15
  • Multiple Updates
2013-05-10 22:51:43
  • Multiple Updates