Executive Summary
| Summary | |
|---|---|
| Title | Exim vulnerabilities |
| Informations | |||
|---|---|---|---|
| Name | USN-1060-1 | First vendor Publication | 2011-02-10 |
| Vendor | Ubuntu | Last vendor Modification | 2011-02-10 |
| Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:L/AC:M/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 6.9 | Attack Range | Local |
| Cvss Impact Score | 10 | Attack Complexity | Medium |
| Cvss Expoit Score | 3.4 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| A security issue affects the following Ubuntu releases: Ubuntu 6.06 LTS Ubuntu 8.04 LTS Ubuntu 9.10 Ubuntu 10.04 LTS Ubuntu 10.10 This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu. The problem can be corrected by upgrading your system to the following package versions: Ubuntu 6.06 LTS: Ubuntu 8.04 LTS: Ubuntu 9.10: Ubuntu 10.04 LTS: Ubuntu 10.10: In general, a standard system update will make all the necessary changes. ATTENTION: This security update brings changes to Exim's behaviour. Please review the following information carefully, as your Exim configuration may need to be adjusted after applying this update. Exim no longer runs alternate configuration files specified with the -C option as root. The new /etc/exim4/trusted_configs file can be used to override this new behaviour. Files listed in trusted_configs and owned by root will be run with root privileges when using the -C option. In addition, Exim no longer runs as root when the -D option is used. Macro definitions that require root privileges should now be placed in trusted configuration files. Please see the /usr/share/doc/exim4-*/NEWS.Debian file for detailed information. Details follow: It was discovered that Exim contained a design flaw in the way it processed alternate configuration files. An attacker that obtained privileges of the "Debian-exim" user could use an alternate configuration file to obtain root privileges. (CVE-2010-4345) It was discovered that Exim incorrectly handled certain return values when handling logging. A local attacker could use this flaw to obtain root privileges. (CVE-2011-0017) Dan Rosenberg discovered that Exim incorrectly handled writable sticky-bit mail directories. If Exim were configured in this manner, a local user could use this flaw to cause a denial of service or possibly gain privileges. This issue only applied to Ubuntu 6.06 LTS, 8.04 LTS, 9.10, and 10.04 LTS. (CVE-2010-2023) Dan Rosenberg discovered that Exim incorrectly handled MBX locking. If Exim were configured in this manner, a local user could use this flaw to cause a denial of service or possibly gain privileges. This issue only applied to Ubuntu 6.06 LTS, 8.04 LTS, 9.10, and 10.04 LTS. (CVE-2010-2024) |
Original Source
| Url : http://www.ubuntu.com/usn/USN-1060-1 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 50 % | CWE-362 | Race Condition |
| 25 % | CWE-59 | Improper Link Resolution Before File Access ('Link Following') |
| 25 % | CWE-20 | Improper Input Validation |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:12692 | |||
| Oval ID: | oval:org.mitre.oval:def:12692 | ||
| Title: | DSA-2154-2 exim4 -- privilege escalation / regression | ||
| Description: | The updated packages from DSA-2154-1 introduced a regression which prevented unprivileged users from using "exim4 -bf" to test filter configurations. This update fixes this problem. Please also read the information provided in DSA-2154-1 if you have not done so already. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-2154-2 CVE-2010-4345 CVE-2011-0017 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 5.0 | Product(s): | exim4 |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:12720 | |||
| Oval ID: | oval:org.mitre.oval:def:12720 | ||
| Title: | DSA-2131-1 exim4 -- arbitrary code execution | ||
| Description: | Several vulnerabilities have been found in exim4 that allow a remote attacker to execute arbitrary code as root user. Exploits for these issues have been seen in the wild. This update fixes a memory corruption issue that allows a remote attacker to execute arbitrary code as the Debian-exim user. A fix for an additional issue that allows the Debian-exim user to obtain root privileges is currently being checked for compatibility issues. It is not yet included in this upgrade but will released soon in an update to this advisory. For the stable distribution, this problem has been fixed in version 4.69-9+lenny1. This advisory only contains the packages for the alpha, amd64, hppa, i386, ia64, powerpc, and s390 architectures. The packages for the arm, armel, mips, mipsel, and sparc architectures will be released as soon as they are built. For the testing distribution and the unstable distribution, this problem has been fixed in version 4.70-1. We strongly recommend that you upgrade your exim4 packages. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-2131-1 CVE-2010-4344 CVE-2010-4345 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 5.0 | Product(s): | exim4 |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:12931 | |||
| Oval ID: | oval:org.mitre.oval:def:12931 | ||
| Title: | DSA-2154-1 exim4 -- privilege escalation | ||
| Description: | A design flaw in exim4 allowed the loal Debian-exim user to obtain root privileges by specifying an alternate configuration file using the -C option or by using the macro override facility. Unfortunately, fixing this vulnerability is not possible without some changes in exim4's behvaviour. If you use the -C or -D options or use the system filter facility, you should evaluate the changes carefully and adjust your configuration accordingly. The Debian default configuration is not affected by the changes. The detailed list of changes is described in the NEWS. Debian file in the packages. The relevant sections are also reproduced below. In addition to that, missing error handling for the setuid/setgid system calls allowed the Debian-exim user to cause root to append log data to arbitrary files. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-2154-1 CVE-2010-4345 CVE-2011-0017 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 5.0 | Product(s): | exim4 |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:13736 | |||
| Oval ID: | oval:org.mitre.oval:def:13736 | ||
| Title: | USN-1060-1 -- exim4 vulnerabilities | ||
| Description: | It was discovered that Exim contained a design flaw in the way it processed alternate configuration files. An attacker that obtained privileges of the "Debian-exim" user could use an alternate configuration file to obtain root privileges. It was discovered that Exim incorrectly handled certain return values when handling logging. A local attacker could use this flaw to obtain root privileges. Dan Rosenberg discovered that Exim incorrectly handled writable sticky-bit mail directories. If Exim were configured in this manner, a local user could use this flaw to cause a denial of service or possibly gain privileges. This issue only applied to Ubuntu 6.06 LTS, 8.04 LTS, 9.10, and 10.04 LTS. Dan Rosenberg discovered that Exim incorrectly handled MBX locking. If Exim were configured in this manner, a local user could use this flaw to cause a denial of service or possibly gain privileges. This issue only applied to Ubuntu 6.06 LTS, 8.04 LTS, 9.10, and 10.04 LTS | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-1060-1 CVE-2010-4345 CVE-2011-0017 CVE-2010-2023 CVE-2010-2024 | Version: | 5 |
| Platform(s): | Ubuntu 8.04 Ubuntu 10.10 Ubuntu 10.04 Ubuntu 9.10 Ubuntu 6.06 | Product(s): | exim4 |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:21735 | |||
| Oval ID: | oval:org.mitre.oval:def:21735 | ||
| Title: | RHSA-2011:0153: exim security update (Moderate) | ||
| Description: | Exim 4.72 and earlier allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with a directive that contains arbitrary commands, as demonstrated by the spool_directory directive. | ||
| Family: | unix | Class: | patch |
| Reference(s): | RHSA-2011:0153-01 CESA-2011:0153 CVE-2010-4345 | Version: | 4 |
| Platform(s): | Red Hat Enterprise Linux 5 CentOS Linux 5 | Product(s): | exim |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:22839 | |||
| Oval ID: | oval:org.mitre.oval:def:22839 | ||
| Title: | ELSA-2011:0153: exim security update (Moderate) | ||
| Description: | Exim 4.72 and earlier allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with a directive that contains arbitrary commands, as demonstrated by the spool_directory directive. | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2011:0153-01 CVE-2010-4345 | Version: | 6 |
| Platform(s): | Oracle Linux 5 | Product(s): | exim |
| Definition Synopsis: | |||
CPE : Common Platform Enumeration
ExploitDB Exploits
| id | Description |
|---|---|
| 2010-12-16 | Exim4 <= 4.69 string_format Function Heap Buffer Overflow |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2012-07-30 | Name : CentOS Update for exim CESA-2011:0153 centos4 x86_64 File : nvt/gb_CESA-2011_0153_exim_centos4_x86_64.nasl |
| 2012-07-30 | Name : CentOS Update for exim CESA-2011:0153 centos5 x86_64 File : nvt/gb_CESA-2011_0153_exim_centos5_x86_64.nasl |
| 2011-08-09 | Name : CentOS Update for exim CESA-2011:0153 centos5 i386 File : nvt/gb_CESA-2011_0153_exim_centos5_i386.nasl |
| 2011-05-23 | Name : Fedora Update for exim FEDORA-2011-7047 File : nvt/gb_fedora_2011_7047_exim_fc14.nasl |
| 2011-05-23 | Name : Fedora Update for exim FEDORA-2011-7059 File : nvt/gb_fedora_2011_7059_exim_fc13.nasl |
| 2011-04-19 | Name : Fedora Update for exim FEDORA-2010-12375 File : nvt/gb_fedora_2010_12375_exim_fc14.nasl |
| 2011-03-05 | Name : exim -- local privilege escalation File : nvt/freebsd_exim2.nasl |
| 2011-02-11 | Name : Ubuntu Update for exim4 vulnerabilities USN-1060-1 File : nvt/gb_ubuntu_USN_1060_1.nasl |
| 2011-01-31 | Name : CentOS Update for exim CESA-2011:0153 centos4 i386 File : nvt/gb_CESA-2011_0153_exim_centos4_i386.nasl |
| 2011-01-24 | Name : FreeBSD Ports: exim File : nvt/freebsd_exim1.nasl |
| 2011-01-21 | Name : RedHat Update for exim RHSA-2011:0153-01 File : nvt/gb_RHSA-2011_0153-01_exim.nasl |
| 2011-01-04 | Name : SuSE Update for exim SUSE-SA:2010:059 File : nvt/gb_suse_2010_059.nasl |
| 2010-06-11 | Name : Fedora Update for exim FEDORA-2010-9506 File : nvt/gb_fedora_2010_9506_exim_fc12.nasl |
| 2010-06-11 | Name : Fedora Update for exim FEDORA-2010-9524 File : nvt/gb_fedora_2010_9524_exim_fc13.nasl |
| 2010-06-03 | Name : Exim < 4.72 RC2 Multiple Vulnerabilities File : nvt/gb_exim_4_72.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 70696 | Exim log.c open_log() Function Local Privilege Escalation Exim contains a flaw that may allow an attacker to gain access to unauthorized privileges. The issue is triggered when the 'open_log()' function in 'log.c' fails to properly check the return values of the 'setuid()' and 'setgid()' functions, allowing a local attacker to use symlink attacks to cause root to append log data to arbitrary files, resulting in the attacker gaining root privileges. |
| 69860 | Exim exim User Account Configuration File Directive Local Privilege Escalation Exim contains a flaw that may allow an attacker to gain access to unauthorized privileges. The issue is triggered when an attacker leverages the ability of an exim user account to specify an alternate configuration file with a directive that contains arbitrary commands, allowing a local attacker to gain root privileges. |
| 65159 | Exim transports/appendfile.c MBX Locking Race Condition Permission Modification |
| 65158 | Exim transports/appendfile.c Hardlink Handling Arbitrary File Overwrite |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2014-06-13 | Name : The remote openSUSE host is missing a security update. File : suse_11_3_exim-110207.nasl - Type : ACT_GATHER_INFO |
| 2014-06-13 | Name : The remote openSUSE host is missing a security update. File : suse_11_3_exim-101211.nasl - Type : ACT_GATHER_INFO |
| 2014-06-13 | Name : The remote openSUSE host is missing a security update. File : suse_11_3_exim-100720.nasl - Type : ACT_GATHER_INFO |
| 2014-01-28 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201401-32.nasl - Type : ACT_GATHER_INFO |
| 2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2011-0153.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20110117_exim_on_SL4_x.nasl - Type : ACT_GATHER_INFO |
| 2011-05-05 | Name : The remote openSUSE host is missing a security update. File : suse_11_2_exim-110207.nasl - Type : ACT_GATHER_INFO |
| 2011-05-05 | Name : The remote openSUSE host is missing a security update. File : suse_11_2_exim-101211.nasl - Type : ACT_GATHER_INFO |
| 2011-05-05 | Name : The remote openSUSE host is missing a security update. File : suse_11_1_exim-101211.nasl - Type : ACT_GATHER_INFO |
| 2011-04-13 | Name : The remote Fedora host is missing a security update. File : fedora_2010-12375.nasl - Type : ACT_GATHER_INFO |
| 2011-02-14 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_44ccfab0356411e08e810022190034c0.nasl - Type : ACT_GATHER_INFO |
| 2011-02-11 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-1060-1.nasl - Type : ACT_GATHER_INFO |
| 2011-02-03 | Name : The remote mail server is potentially affected by a local privilege escalatio... File : exim_4_74.nasl - Type : ACT_GATHER_INFO |
| 2011-01-31 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2154.nasl - Type : ACT_GATHER_INFO |
| 2011-01-28 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2011-0153.nasl - Type : ACT_GATHER_INFO |
| 2011-01-18 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2011-0153.nasl - Type : ACT_GATHER_INFO |
| 2011-01-10 | Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_e4fcf020044711e0becc0022156e8794.nasl - Type : ACT_GATHER_INFO |
| 2010-12-15 | Name : The remote service has a buffer overflow. File : exim_string_vformat.nasl - Type : ACT_ATTACK |
| 2010-12-12 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2131.nasl - Type : ACT_GATHER_INFO |
| 2010-07-23 | Name : The remote openSUSE host is missing a security update. File : suse_11_1_exim-100720.nasl - Type : ACT_GATHER_INFO |
| 2010-07-23 | Name : The remote openSUSE host is missing a security update. File : suse_11_2_exim-100720.nasl - Type : ACT_GATHER_INFO |
| 2010-07-01 | Name : The remote Fedora host is missing a security update. File : fedora_2010-9524.nasl - Type : ACT_GATHER_INFO |
| 2010-07-01 | Name : The remote Fedora host is missing a security update. File : fedora_2010-9506.nasl - Type : ACT_GATHER_INFO |
| 2010-06-02 | Name : The remote mail server is potentially affected by multiple vulnerabilities. File : exim_4_72.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:58:16 |
|
