BID:46065

Exim 'log.c' Local Privilege Escalation Vulnerability

Info

Exim 'log.c' Local Privilege Escalation Vulnerability

Bugtraq ID:	46065
Class:	Design Error
CVE:	CVE-2011-0017
Remote:	No
Local:	Yes
Published:	Jan 31 2011 12:00AM
Updated:	Jan 28 2014 02:44PM
Credit:	This issue was disclosed by the vendor.
Vulnerable:	University of Cambridge Exim 4.60 University of Cambridge Exim 4.52 University of Cambridge Exim 4.43 University of Cambridge Exim 4.42 University of Cambridge Exim 4.41 University of Cambridge Exim 4.40 University of Cambridge Exim 4.34 + Ubuntu Ubuntu Linux 4.1 ppc + Ubuntu Ubuntu Linux 4.1 ia64 + Ubuntu Ubuntu Linux 4.1 ia32 University of Cambridge Exim 4.33 University of Cambridge Exim 4.32 University of Cambridge Exim 4.21 University of Cambridge Exim 4.20 University of Cambridge Exim 4.10 University of Cambridge Exim 3.952 University of Cambridge Exim 3.36 University of Cambridge Exim 3.35 + Debian Linux 3.0 sparc + Debian Linux 3.0 s/390 + Debian Linux 3.0 ppc + Debian Linux 3.0 mipsel + Debian Linux 3.0 mips + Debian Linux 3.0 m68k + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 hppa + Debian Linux 3.0 arm + Debian Linux 3.0 alpha + Debian Linux 3.0 University of Cambridge Exim 3.34 University of Cambridge Exim 3.33 University of Cambridge Exim 3.32 University of Cambridge Exim 3.31 University of Cambridge Exim 3.30 University of Cambridge Exim 3.22 - RedHat PowerTools 7.1 University of Cambridge Exim 3.21 University of Cambridge Exim 3.20 University of Cambridge Exim 3.19 University of Cambridge Exim 3.18 University of Cambridge Exim 3.17 University of Cambridge Exim 3.16 University of Cambridge Exim 3.15 University of Cambridge Exim 3.14 University of Cambridge Exim 3.13 University of Cambridge Exim 3.12 University of Cambridge Exim 3.11 University of Cambridge Exim 3.3 2 University of Cambridge Exim 3.3 1 University of Cambridge Exim 3.3 University of Cambridge Exim 3.0 x University of Cambridge Exim 3.0 University of Cambridge Exim 2.0 x University of Cambridge Exim 1.6.51 University of Cambridge Exim 1.6.2 University of Cambridge Exim 4.73 University of Cambridge Exim 4.72 RC2 University of Cambridge Exim 4.72 University of Cambridge Exim 4.71 University of Cambridge Exim 4.70 University of Cambridge Exim 4.69-26 University of Cambridge Exim 4.69 University of Cambridge Exim 4.66 University of Cambridge Exim 4.63-5 University of Cambridge Exim 4.63-4 Ubuntu Ubuntu Linux 9.10 sparc Ubuntu Ubuntu Linux 9.10 powerpc Ubuntu Ubuntu Linux 9.10 lpia Ubuntu Ubuntu Linux 9.10 i386 Ubuntu Ubuntu Linux 9.10 ARM Ubuntu Ubuntu Linux 9.10 amd64 Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 Ubuntu Ubuntu Linux 6.06 LTS sparc Ubuntu Ubuntu Linux 6.06 LTS powerpc Ubuntu Ubuntu Linux 6.06 LTS i386 Ubuntu Ubuntu Linux 6.06 LTS amd64 Ubuntu Ubuntu Linux 10.10 powerpc Ubuntu Ubuntu Linux 10.10 i386 Ubuntu Ubuntu Linux 10.10 ARM Ubuntu Ubuntu Linux 10.10 amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 ARM Ubuntu Ubuntu Linux 10.04 amd64 SuSE openSUSE 11.3 S.u.S.E. openSUSE 11.2 Gentoo Linux Exim Exim 4.73 Exim Exim 4.72 Exim Exim 4.71 Exim Exim 4.70 Exim Exim 4.69 Exim Exim 4.68 Exim Exim 4.67 Exim Exim 4.66 Exim Exim 4.65 Exim Exim 4.64 Exim Exim 4.63 Exim Exim 4.62 Exim Exim 4.61 Exim Exim 4.60 Exim Exim 4.54 Exim Exim 4.53 Exim Exim 4.52 Exim Exim 4.51 Exim Exim 4.50 Exim Exim 4.44 Exim Exim 4.43 Exim Exim 4.42 Exim Exim 4.41 Exim Exim 4.40 Exim Exim 4.34 Exim Exim 4.33 Exim Exim 4.32 Exim Exim 4.31 Exim Exim 4.30 Exim Exim 4.24 Exim Exim 4.23 Exim Exim 4.22 Exim Exim 4.21 Exim Exim 4.20 Exim Exim 4.14 Exim Exim 4.12 Exim Exim 4.11 Exim Exim 4.10 Exim Exim 4.05 Exim Exim 4.04 Exim Exim 4.03 Exim Exim 4.02 Exim Exim 4.01 Exim Exim 4.00 Exim Exim 3.36 Exim Exim 3.35 Exim Exim 3.34 Exim Exim 3.33 Exim Exim 3.32 Exim Exim 3.31 Exim Exim 3.30 Exim Exim 3.22 Exim Exim 3.21 Exim Exim 3.20 Exim Exim 3.16 Exim Exim 3.15 Exim Exim 3.14 Exim Exim 3.13 Exim Exim 3.12 Exim Exim 3.11 Exim Exim 3.10 Exim Exim 3.03 Exim Exim 3.02 Exim Exim 3.01 Exim Exim 3.00 Exim Exim 2.12 Exim Exim 2.11 Exim Exim 2.10 Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0

Not Vulnerable:	University of Cambridge Exim 4.74 Exim Exim 4.74

Discussion

Exim 'log.c' Local Privilege Escalation Vulnerability

Exim is prone to a local privilege-escalation vulnerability because it fails to properly validate the return values of the 'setuid()' and 'setgid()' function calls.

Attackers can exploit this issue to append arbitrary data to files through symbolic link attacks. Successfully exploiting this issue allows local attackers with 'exim' run-time user privileges to perform certain actions with superuser privileges, leading to a complete compromise of an affected computer.

Versions prior to Exim 4.74 are vulnerable.

Exploit / POC

Exim 'log.c' Local Privilege Escalation Vulnerability

An attacker uses readily available tools to exploit the issue.

Solution / Fix

Exim 'log.c' Local Privilege Escalation Vulnerability

Solution:
Updates are available. Please see the references for more information.

Ubuntu Ubuntu Linux 9.10 powerpc