CVE-2010-2024: Race Condition
Dan Rosenberg reported that when MBX locking is enabled in exim, local users could exploit a race condition to change permissions of other non-root users' files. This could lead to a denial of service, to create new files owned by other users in unauthorized locations, or to possibly escalate privileges.
Further information is available from the upstream bug report [1] and this has been fixed upstream in exim 4.72 [2].
[1] http://bugs.exim.org/showbug.cgi?id=989 [2] http://vcs.exim.org/viewvc/exim/exim-src/src/transports/appendfile.c?r1=1.25&r2=1.26
While exim is built to support the MBX format, it is not the default for local mail delivery (Unix mailbox support is the default). This will only affect users that use the "mbxformat" option in the appendfile transport.
Other sources
transports/appendfile.c in Exim before 4.72, when MBX locking is enabled, allows local users to change permissions of arbitrary files or create arbitrary files, and cause a denial of service or possibly gain privileges, via a symlink attack on a lockfile in /tmp/.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-2024?
CVE-2010-2024 is considered a high severity vulnerability due to its potential for privilege escalation and denial of service.
How do I fix CVE-2010-2024?
To fix CVE-2010-2024, upgrade Exim to a version that is newer than 4.71, which contains the patch for this vulnerability.
What systems are affected by CVE-2010-2024?
CVE-2010-2024 affects multiple versions of Exim, including 4.10 through 4.71.
What types of attacks can be executed using CVE-2010-2024?
CVE-2010-2024 can be exploited to change permissions of files owned by other users, create files in unauthorized locations, and potentially escalate privileges.
Who reported CVE-2010-2024?
CVE-2010-2024 was reported by researcher Dan Rosenberg.