REDHAT-BUG-662012: Medium severity sa-exim vulnerability

Published Dec 10, 2010

Updated

See bug #661756 http://www.exim.org/lurker/message/20101207.215955.bb32d4f2.en.html

" Secondly a privilege escalation where the trusted 'exim' user is able to tell Exim to use arbitrary config files, in which further ${run ...} commands will be invoked as root.

The latter should be addressed by the patch at http://lists.exim.org/lurker/message/20101209.172233.abcba158.en.html "

Affected Software

1 affected component

Exim Exim

Event History

Dec 10, 2010

Data Sourced

via Red Hat·10:39 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-662012?

The severity of REDHAT-BUG-662012 is classified as a remote code execution vulnerability.

How do I fix REDHAT-BUG-662012?

To fix REDHAT-BUG-662012, update Exim to the latest patched version provided by your distribution.

What systems are affected by REDHAT-BUG-662012?

REDHAT-BUG-662012 affects Exim versions that do not include the security patches addressing CVE-2010-4344.

Is there a workaround for REDHAT-BUG-662012?

A temporary workaround for REDHAT-BUG-662012 may include disabling certain features of Exim until a patch can be applied.

What is the impact of exploiting REDHAT-BUG-662012?

Exploiting REDHAT-BUG-662012 can allow an attacker to execute arbitrary code on the affected system.