search menu icon-carat-right cmu-wordmark

CERT Coordination Center


Exim alternate configuration privilege escalation vulnerability

Vulnerability Note VU#758489

Original Release Date: 2010-12-13 | Last Revised: 2010-12-13

Overview

A vulnerability in the way that the Exim mail server handles configuration files may allow a local attacker to gain escalated privileges on an affected system.

Description

Exim is a message transfer agent (MTA) developed at the University of Cambridge for use on Unix systems connected to the Internet. If Exim is built without specifying the ALT_CONFIG_ROOT_ONLY configuration option, then the Exim user can invoke Exim with an arbitrary configuration file. The Exim developers note that this option is unspecified by default. Consequently, any ${run...} directives specified in that configuration file will be executed as root.

Note: this vulnerability has been reported being exploited in the wild.

Impact

A local attacker with the ability to execute commands as the Exim user may be able to execute code with root privileges.

Solution

We are currently unaware of a practical solution to this problem.

Ensure that Exim is built with the ALT_CONFIG_ROOT_ONLY option enabled

The Exim developers note that this may result in a loss of functionality in certain cases where more than one configuration is in use. Specifically, the exim user will no longer be permitted to invoke Exim with an alternative configuration file and have it executed with root privileges.

Vendor Information

758489
Expand all

SUSE Linux

Updated:  December 13, 2010

Statement Date:   December 13, 2010

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00003.html

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.


CVSS Metrics

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A

References

Credit

This vulnerability was discovered as a result of its exploitation in the wild. Sergey Kononenko provided confirmation and public analysis.

This document was written by Chad R Dougherty.

Other Information

CVE IDs: CVE-2010-4345
Severity Metric: 13.54
Date Public: 2010-12-07
Date First Published: 2010-12-13
Date Last Updated: 2010-12-13 15:48 UTC
Document Revision: 5

Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.