PT-2016-4852 · Exim+3 · Exim+3

Dawid Golunski · Published 2016-03-02 · Updated 2024-06-15 · CVE-2016-1531

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Exim versions prior to 4.86.2

Description The issue allows local users to gain privileges through the perl startup argument when Exim is installed setuid root.

Recommendations For versions prior to 4.86.2, update to version 4.86.2 or later to resolve the issue. As a temporary workaround, consider disabling the setuid root installation of Exim until a patch is available. Restrict access to the perl startup argument to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

ALT-PU-2018-1409

CVE-2016-1531

DSA-3517-1

OPENSUSE-SU-2016_0721-1

OPENSUSE-SU-2017_2289-1

OPENSUSE-SU-2024:10017-1

USN-2933-1

Affected Products

Alt Linux

Exim

Suse

Ubuntu

References · 49

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/local/exim_perl_startup.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/exim4_deliver_message_priv_esc.rb · Exploit
• 🔥 https://github.com/qazbnm456/awesome-cve-poc/blob/master/Stack-Clash.md · Exploit
• 🔥 https://github.com/synacktiv/Exim-CVE-2019-15846 · Exploit
• 🔥 https://github.com/LetUsFsck/PoC-Exploit-Mirror/tree/master/CVE-2017-16944 · Exploit
• 🔥 https://github.com/Diefunction/CVE-2019-10149 · Exploit
• 🔥 https://github.com/cowbe0x004/eximrce-CVE-2019-10149 · Exploit
• 🔥 https://github.com/MNEMO-CERT/PoC--CVE-2019-10149_Exim · Exploit
• 🔥 https://github.com/martinclauss/exim-rce-cve-2018-6789 · Exploit
• 🔥 https://github.com/synacktiv/Exim-CVE-2018-6789 · Exploit
• 🔥 https://github.com/AzizMea/CVE-2019-10149-privilege-escalation · Exploit
• 🔥 https://github.com/darsigovrustam/CVE-2019-10149 · Exploit
• 🔥 https://github.com/dorkerdevil/CVE-2020-28018 · Exploit
• 🔥 https://github.com/cloudflare/exim-cve-2019-10149-data · Exploit
• 🔥 https://exploit-db.com/exploits/39702 · Exploit