CVE-2010-4345

Published: Dec 14, 2010Modified: Apr 21, 2026CISA KEV

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

Exim 4.72 and earlier allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with a directive that contains arbitrary commands, as demonstrated by the spool_directory directive.

Affected (10)

Products: Exim: Exim · Opensuse: Opensuse · Debian: Debian Linux · +1 more

Show all products

Exim: Exim · Opensuse: Opensuse · Debian: Debian Linux · Canonical: Ubuntu Linux

1 product

1 product

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Exim Exim	Up to 4.72

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Opensuse Opensuse	Version 11.1
Opensuse Opensuse	Version 11.2
Opensuse Opensuse	Version 11.3

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 5.0

Configuration D

5 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 10.04
Canonical Ubuntu Linux	Version 10.10
Canonical Ubuntu Linux	Version 6.06
Canonical Ubuntu Linux	Version 8.04
Canonical Ubuntu Linux	Version 9.10

Related CWEs

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

References (57)

http://bugs.exim.org/show_bug.cgi?id=1044

Source: secalert@redhat.com

Issue TrackingPatch

http://lists.exim.org/lurker/message/20101209.172233.abcba158.en.html

Source: secalert@redhat.com

Mailing ListPatch

http://lists.exim.org/lurker/message/20101210.164935.385e04d0.en.html

Source: secalert@redhat.com

Mailing List

http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00003.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://openwall.com/lists/oss-security/2010/12/10/1

Source: secalert@redhat.com

Mailing List

http://secunia.com/advisories/42576

Source: secalert@redhat.com

Broken LinkVendor Advisory

http://secunia.com/advisories/42930

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/43128

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/43243

Source: secalert@redhat.com

Broken Link

http://www.cpanel.net/2010/12/critical-exim-security-update.html

Source: secalert@redhat.com

Broken Link

http://www.debian.org/security/2010/dsa-2131

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://www.debian.org/security/2011/dsa-2154

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://www.exim.org/lurker/message/20101207.215955.bb32d4f2.en.html

Source: secalert@redhat.com

Mailing ListVendor Advisory

http://www.kb.cert.org/vuls/id/758489

Source: secalert@redhat.com

Third Party AdvisoryUS Government Resource

http://www.metasploit.com/modules/exploit/unix/smtp/exim4_string_format

Source: secalert@redhat.com

Third Party Advisory

http://www.openwall.com/lists/oss-security/2021/05/04/7

Source: secalert@redhat.com

Mailing List

http://www.redhat.com/support/errata/RHSA-2011-0153.html

Source: secalert@redhat.com

Broken Link

http://www.securityfocus.com/archive/1/515172/100/0/threaded

Source: secalert@redhat.com

Broken LinkThird Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/45341

Source: secalert@redhat.com

Broken LinkThird Party AdvisoryVDB Entry

http://www.securitytracker.com/id?1024859

Source: secalert@redhat.com

Broken LinkThird Party AdvisoryVDB Entry

http://www.theregister.co.uk/2010/12/11/exim_code_execution_peril/

Source: secalert@redhat.com

Press/Media CoverageThird Party Advisory

http://www.ubuntu.com/usn/USN-1060-1

Source: secalert@redhat.com

Third Party Advisory

http://www.vupen.com/english/advisories/2010/3171

Source: secalert@redhat.com

Broken LinkVendor Advisory

http://www.vupen.com/english/advisories/2010/3204

Source: secalert@redhat.com

Broken LinkVendor Advisory

http://www.vupen.com/english/advisories/2011/0135

Source: secalert@redhat.com

Broken Link

http://www.vupen.com/english/advisories/2011/0245

Source: secalert@redhat.com

Broken Link

http://www.vupen.com/english/advisories/2011/0364

Source: secalert@redhat.com

Broken Link

https://bugzilla.redhat.com/show_bug.cgi?id=662012

Source: secalert@redhat.com

Issue TrackingPatch

http://bugs.exim.org/show_bug.cgi?id=1044