جزئیات آسیب‌پذیری

خلاصه‌ی فارسی برای این آسیب‌پذیری هنوز تهیه نشده است.

Exim 4.72 and earlier allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with a directive that contains arbitrary commands, as demonstrated by the spool_directory directive.

• http://secunia.com/advisories/43128 third-party-advisoryx_refsource_SECUNIA
• http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00003.html vendor-advisoryx_refsource_SUSE
• http://lists.exim.org/lurker/message/20101209.172233.abcba158.en.html mailing-listx_refsource_MLIST
• http://www.kb.cert.org/vuls/id/758489 third-party-advisoryx_refsource_CERT-VN
• http://www.exim.org/lurker/message/20101207.215955.bb32d4f2.en.html mailing-listx_refsource_MLIST
• https://bugzilla.redhat.com/show_bug.cgi?id=662012 x_refsource_CONFIRM
• http://www.vupen.com/english/advisories/2011/0364 vdb-entryx_refsource_VUPEN
• http://www.metasploit.com/modules/exploit/unix/smtp/exim4_string_format x_refsource_MISC
• http://www.redhat.com/support/errata/RHSA-2011-0153.html vendor-advisoryx_refsource_REDHAT
• http://www.securityfocus.com/bid/45341 vdb-entryx_refsource_BID
• http://secunia.com/advisories/42930 third-party-advisoryx_refsource_SECUNIA
• http://secunia.com/advisories/42576 third-party-advisoryx_refsource_SECUNIA
• http://secunia.com/advisories/43243 third-party-advisoryx_refsource_SECUNIA
• http://www.securitytracker.com/id?1024859 vdb-entryx_refsource_SECTRACK
• http://lists.exim.org/lurker/message/20101210.164935.385e04d0.en.html mailing-listx_refsource_MLIST
• http://www.debian.org/security/2011/dsa-2154 vendor-advisoryx_refsource_DEBIAN
• http://www.securityfocus.com/archive/1/515172/100/0/threaded mailing-listx_refsource_BUGTRAQ
• http://www.theregister.co.uk/2010/12/11/exim_code_execution_peril/ x_refsource_MISC
• http://www.vupen.com/english/advisories/2011/0245 vdb-entryx_refsource_VUPEN
• http://www.vupen.com/english/advisories/2011/0135 vdb-entryx_refsource_VUPEN
• http://www.ubuntu.com/usn/USN-1060-1 vendor-advisoryx_refsource_UBUNTU
• http://www.vupen.com/english/advisories/2010/3204 vdb-entryx_refsource_VUPEN
• http://bugs.exim.org/show_bug.cgi?id=1044 x_refsource_CONFIRM
• http://www.debian.org/security/2010/dsa-2131 vendor-advisoryx_refsource_DEBIAN
• http://www.vupen.com/english/advisories/2010/3171 vdb-entryx_refsource_VUPEN
• http://www.cpanel.net/2010/12/critical-exim-security-update.html x_refsource_CONFIRM
• http://openwall.com/lists/oss-security/2010/12/10/1 mailing-listx_refsource_MLIST
• http://www.openwall.com/lists/oss-security/2021/05/04/7 mailing-listx_refsource_MLIST
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-4345 government-resource