BID:45341

Exim ALT_CONFIG_ROOT_ONLY 'exim' User Local Privilege Escalation Vulnerability

Info

Exim ALT_CONFIG_ROOT_ONLY 'exim' User Local Privilege Escalation Vulnerability

Bugtraq ID:	45341
Class:	Unknown
CVE:	CVE-2010-4345
Remote:	No
Local:	Yes
Published:	Dec 07 2010 12:00AM
Updated:	Jan 28 2014 02:44PM
Credit:	Sergey Kononenko
Vulnerable:	University of Cambridge Exim 4.60 University of Cambridge Exim 4.52 University of Cambridge Exim 4.43 University of Cambridge Exim 4.42 University of Cambridge Exim 4.41 University of Cambridge Exim 4.40 University of Cambridge Exim 4.34 + Ubuntu Ubuntu Linux 4.1 ppc + Ubuntu Ubuntu Linux 4.1 ia64 + Ubuntu Ubuntu Linux 4.1 ia32 University of Cambridge Exim 4.33 University of Cambridge Exim 4.32 University of Cambridge Exim 4.21 University of Cambridge Exim 4.20 University of Cambridge Exim 4.10 University of Cambridge Exim 3.952 University of Cambridge Exim 3.36 University of Cambridge Exim 3.35 + Debian Linux 3.0 sparc + Debian Linux 3.0 s/390 + Debian Linux 3.0 ppc + Debian Linux 3.0 mipsel + Debian Linux 3.0 mips + Debian Linux 3.0 m68k + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 hppa + Debian Linux 3.0 arm + Debian Linux 3.0 alpha + Debian Linux 3.0 University of Cambridge Exim 3.34 University of Cambridge Exim 3.33 University of Cambridge Exim 3.32 University of Cambridge Exim 3.31 University of Cambridge Exim 3.30 University of Cambridge Exim 3.22 - RedHat PowerTools 7.1 University of Cambridge Exim 3.21 University of Cambridge Exim 3.20 University of Cambridge Exim 3.19 University of Cambridge Exim 3.18 University of Cambridge Exim 3.17 University of Cambridge Exim 3.16 University of Cambridge Exim 3.15 University of Cambridge Exim 3.14 University of Cambridge Exim 3.13 University of Cambridge Exim 3.12 University of Cambridge Exim 3.11 University of Cambridge Exim 3.3 2 University of Cambridge Exim 3.3 1 University of Cambridge Exim 3.3 University of Cambridge Exim 3.0 x University of Cambridge Exim 3.0 University of Cambridge Exim 2.0 x University of Cambridge Exim 1.6.51 University of Cambridge Exim 1.6.2 University of Cambridge Exim 4.72 RC2 University of Cambridge Exim 4.72 University of Cambridge Exim 4.71 University of Cambridge Exim 4.70 University of Cambridge Exim 4.69 University of Cambridge Exim 4.66 Ubuntu Ubuntu Linux 9.10 sparc Ubuntu Ubuntu Linux 9.10 powerpc Ubuntu Ubuntu Linux 9.10 lpia Ubuntu Ubuntu Linux 9.10 i386 Ubuntu Ubuntu Linux 9.10 ARM Ubuntu Ubuntu Linux 9.10 amd64 Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 Ubuntu Ubuntu Linux 6.06 LTS sparc Ubuntu Ubuntu Linux 6.06 LTS powerpc Ubuntu Ubuntu Linux 6.06 LTS i386 Ubuntu Ubuntu Linux 6.06 LTS amd64 Ubuntu Ubuntu Linux 10.10 powerpc Ubuntu Ubuntu Linux 10.10 i386 Ubuntu Ubuntu Linux 10.10 ARM Ubuntu Ubuntu Linux 10.10 amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 ARM Ubuntu Ubuntu Linux 10.04 amd64 SuSE openSUSE 11.3 S.u.S.E. openSUSE 11.2 S.u.S.E. openSUSE 11.1 RedHat Enterprise Linux WS 4 RedHat Enterprise Linux ES 4 RedHat Enterprise Linux Desktop version 4 Red Hat Enterprise Linux Desktop 5 client Red Hat Enterprise Linux AS 4 Red Hat Enterprise Linux 5 Server Gentoo Linux Exim Exim 4.72 Exim Exim 4.71 Exim Exim 4.70 Exim Exim 4.69 Exim Exim 4.68 Exim Exim 4.67 Exim Exim 4.66 Exim Exim 4.65 Exim Exim 4.64 Exim Exim 4.63 Exim Exim 4.62 Exim Exim 4.61 Exim Exim 4.60 Exim Exim 4.54 Exim Exim 4.53 Exim Exim 4.52 Exim Exim 4.51 Exim Exim 4.50 Exim Exim 4.44 Exim Exim 4.43 Exim Exim 4.42 Exim Exim 4.41 Exim Exim 4.40 Exim Exim 4.34 Exim Exim 4.33 Exim Exim 4.32 Exim Exim 4.31 Exim Exim 4.30 Exim Exim 4.24 Exim Exim 4.23 Exim Exim 4.22 Exim Exim 4.21 Exim Exim 4.20 Exim Exim 4.14 Exim Exim 4.12 Exim Exim 4.11 Exim Exim 4.10 Exim Exim 4.05 Exim Exim 4.04 Exim Exim 4.03 Exim Exim 4.02 Exim Exim 4.01 Exim Exim 4.00 Exim Exim 3.36 Exim Exim 3.35 Exim Exim 3.34 Exim Exim 3.33 Exim Exim 3.32 Exim Exim 3.31 Exim Exim 3.30 Exim Exim 3.22 Exim Exim 3.21 Exim Exim 3.20 Exim Exim 3.16 Exim Exim 3.15 Exim Exim 3.14 Exim Exim 3.13 Exim Exim 3.12 Exim Exim 3.11 Exim Exim 3.10 Exim Exim 3.03 Exim Exim 3.02 Exim Exim 3.01 Exim Exim 3.00 Exim Exim 2.12 Exim Exim 2.11 Exim Exim 2.10 cPanel cPanel 0 Avaya Aura System Manager 6.1

Not Vulnerable:	University of Cambridge Exim 4.69-26 University of Cambridge Exim 4.63-4

Discussion

Exim ALT_CONFIG_ROOT_ONLY 'exim' User Local Privilege Escalation Vulnerability

Exim is prone to a local privilege-escalation vulnerability.

Attackers can exploit this issue to gain superuser privileges on affected computers. Successful attacks will completely compromise an affected computer.

Exim 4.72 is vulnerable; other versions may also be affected.

Exploit / POC

Exim ALT_CONFIG_ROOT_ONLY 'exim' User Local Privilege Escalation Vulnerability

An attacker uses readily available tools to exploit the issue.

This issue is being actively exploited in conjunction with the vulnerability documented in BID 45308 (Exim Crafted Header Remote Code Execution Vulnerability).

The following exploit is available:

/data/vulnerabilities/exploits/45341_1.rb
/data/vulnerabilities/exploits/45341.pl

Solution / Fix

Exim ALT_CONFIG_ROOT_ONLY 'exim' User Local Privilege Escalation Vulnerability

Solution:
Updates are available. Please see the references for more information.

Ubuntu Ubuntu Linux 9.10 powerpc