高危
Exim配置文件权限提升漏洞
2010-12-14 00:00:00 公开 ，2026-02-17 20:29:36 更新
- 关键漏洞
- CISA KEV
- APT漏洞
- 本地
- 公开PoC
- 开源组件漏洞
- CWE Top 25 (2023)
- CWE Top 25 (2024)
- SSVC：
- 可利用状态：已被积极利用攻击自动化：否技术影响评估：全部 2025-02-07 21:24:14
风险信息
- CVSS v2 向量
- AV:L/AC:M/Au:N/C:C/I:C/A:C
- CVSS v2 风险值
- 6.9
- CVSS v3.1 向量
- AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS v3.1 风险值
- 7.8
详细信息
- 漏洞类型
- 权限许可和访问控制问题
- 漏洞描述
- Exim是英国剑桥大学开发的一个运行于Unix系统中的开源消息传送代理（MTA），它主要负责邮件的路由、转发和投递。Exim 4.72及之前版本中存在权限许可和访问控制漏洞。本地用户可以通过利用exim用户账户的权限指定交替的配置文件(该文件带有包含任意命令的指令)获取特权。该漏洞已经通过spool_directory指令得到证实。
- 修复建议
- 为该漏洞应用补丁，可从Exim GIT存储库获得： http://git.exim.org/exim.git/commitdiff/24c929a27415c7cfc7126c47e4cad39acf3efa6b
参考链接
- https://bugzilla.redhat.com/show_bug.cgi?id=662012
NVD · x_refsource_CONFIRM
- http://lists.exim.org/lurker/message/20101209.172233.abcba158.en.html
NVD · mailing-list · x_refsource_MLIST
- http://bugs.exim.org/show_bug.cgi?id=1044
NVD · x_refsource_CONFIRM
- http://www.theregister.co.uk/2010/12/11/exim_code_execution_peril/
NVD · x_refsource_MISC
- http://www.metasploit.com/modules/exploit/unix/smtp/exim4_string_format
NVD · x_refsource_MISC
- http://www.exim.org/lurker/message/20101207.215955.bb32d4f2.en.html
NVD · mailing-list · x_refsource_MLIST
- http://openwall.com/lists/oss-security/2010/12/10/1
NVD · mailing-list · x_refsource_MLIST
- http://lists.exim.org/lurker/message/20101210.164935.385e04d0.en.html
NVD · mailing-list · x_refsource_MLIST
- http://www.kb.cert.org/vuls/id/758489
NVD · third-party-advisory · x_refsource_CERT-VN
- http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00003.html
NVD · vendor-advisory · x_refsource_SUSE
- http://www.openwall.com/lists/oss-security/2021/05/04/7
NVD · mailing-list · x_refsource_MLIST
- http://www.debian.org/security/2010/dsa-2131
NVD · vendor-advisory · x_refsource_DEBIAN
- http://www.debian.org/security/2011/dsa-2154
NVD · vendor-advisory · x_refsource_DEBIAN
- http://www.ubuntu.com/usn/USN-1060-1
NVD · vendor-advisory · x_refsource_UBUNTU
- http://www.redhat.com/support/errata/RHSA-2011-0153.html
NVD · vendor-advisory · x_refsource_REDHAT
- http://www.cpanel.net/2010/12/critical-exim-security-update.html
NVD · x_refsource_CONFIRM
- https://osv.dev/vulnerability/DSA-2154-1
OSV
- http://secunia.com/advisories/42576
OSV
- http://secunia.com/advisories/42930
OSV
- http://secunia.com/advisories/43128
OSV
- http://secunia.com/advisories/43243
OSV
- https://security-tracker.debian.org/tracker/CVE-2010-4345
OSV
- https://osv.dev/vulnerability/CVE-2010-4345
OSV
- https://osv.dev/vulnerability/DEBIAN-CVE-2010-4345
OSV
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-4345
NVD · US Government Resource