UBUNTU-CVE-2019-19920: High severity ubuntu/sa-exim vulnerability

Q: What level of access does an attacker need to exploit this issue?

The attacker must have low-level privileges and be able to write a .cf file or a rule used by sa-exim. Systems where untrusted users or processes cannot modify those files are not exposed through this stated attack path.

Q: Does exploitation require a victim to take any action?

No. The vulnerability is rated UI:N, indicating that user interaction is not required once the attacker has the necessary write access.

Published Dec 22, 2019

Updated

sa-exim 4.2.1 allows attackers to execute arbitrary code if they can write a .cf file or a rule. This occurs because Greylisting.pm relies on eval (rather than direct parsing and/or use of the taint feature). This issue is similar to CVE-2018-11805.

Affected Software

2 affected componentsFixes available

ubuntu/sa-exim<4.2.1-14+deb8u1build0.16.04.1

4.2.1-14+deb8u1build0.16.04.1

ubuntu/sa-exim<4.2.1-16ubuntu0.1~esm1

4.2.1-16ubuntu0.1~esm1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/sa-exim to a version that resolves this vulnerability.
Fixed in 4.2.1-14+deb8u1build0.16.04.1
Upgrade
Upgrade ubuntu/sa-exim to a version that resolves this vulnerability.
Fixed in 4.2.1-16ubuntu0.1~esm1

Event History

Dec 22, 2019

CVE Published

via OSV·06:15 PM

Data Sourced

via OSV·06:15 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The attacker must have low-level privileges and be able to write a .cf file or a rule used by sa-exim. Systems where untrusted users or processes cannot modify those files are not exposed through this stated attack path.

Does exploitation require a victim to take any action?