PT-2010-5428 · Exim+1 · Exim+1

Mark J. Cox · Published 2010-12-14 · Updated 2025-03-13 · CVE-2010-4345

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Exim versions 4.72 and earlier

Description The issue allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with a directive that contains arbitrary commands, as demonstrated by the spool directory directive.

Recommendations For Exim versions 4.72 and earlier, consider restricting the ability of the exim user account to specify alternate configuration files until a patch is available. As a temporary workaround, consider disabling the use of the spool directory directive in configuration files to minimize the risk of exploitation.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2010-4345

DSA-2154-1

OPENSUSE-SU-2024:10017-1

RHSA-2011:0153

RHSA-2011_0153

Affected Products

Exim

Red Hat

References · 53

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/smtp/exim4_string_format.rb · Exploit
• 🔥 https://exploit-db.com/exploits/16925 · Exploit
• http://secunia.com/advisories/42576 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2011-0153.html · Vendor Advisory
• http://debian.org/security/2010/dsa-2131 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2010-4345 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00003.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10017-1 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=662012 · Patch
• http://bugs.exim.org/show_bug.cgi?id=1044 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2010-4345 · Security Note
• http://vupen.com/english/advisories/2010/3171 · Vendor Advisory
• http://ubuntu.com/usn/USN-1060-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-4345 · Vendor Advisory
• http://lists.exim.org/lurker/message/20101209.172233.abcba158.en.html · Patch