CVE-2010-2023: Race Condition
Dan Rosenberg reported that when exim is used with a world-writable mail directory, with the sticky-bit set, local users could create hard-links to other non-root users' files in the mailbox storage directory, causing files to be overwritten upon mail delivery. This could be used to create a denial of service condition or potentially escalate privileges to those of targeted users.
Further information is available from the upstream bug report [1] and this has been fixed upstream in exim 4.72 [2].
[1] http://bugs.exim.org/showbug.cgi?id=988 [2] http://vcs.exim.org/viewvc/exim/exim-src/src/transports/appendfile.c?r1=1.24&r2=1.25
The /var/spool/mail directory on Red Hat Enterprise Linux and Fedora is mode 0755 and owned root:mail. As a result, this is not exploitable by default.
Other sources
transports/appendfile.c in Exim before 4.72, when a world-writable sticky-bit mail directory is used, does not verify the stnlink field of mailbox files, which allows local users to cause a denial of service or possibly gain privileges by creating a hard link to another user's file.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2010-2023?
CVE-2010-2023 has a moderate severity rating as it can lead to denial of service due to file overwriting.
How do I fix CVE-2010-2023?
To fix CVE-2010-2023, ensure that the mail directory is not world-writable and does not have the sticky bit set.
Which versions of Exim are affected by CVE-2010-2023?
CVE-2010-2023 affects Exim versions up to and including 4.71.
Can CVE-2010-2023 be exploited remotely?
CVE-2010-2023 is primarily a local privilege escalation vulnerability, requiring local user access to exploit.
What impact does CVE-2010-2023 have on users?
CVE-2010-2023 can allow local users to overwrite files in other users' mailboxes, potentially leading to data loss.