Test ID:	1.3.6.1.4.1.25623.1.0.703517
Category:	Debian Local Security Checks
Title:	Debian Security Advisory DSA 3517-1 (exim4 - security update)
Summary:	A local root privilege escalation;vulnerability was found in Exim, Debian's default mail transfer agent, in;configurations using the perl_startup option (Only Exim via;exim4-daemon-heavy enables Perl support).;;To address the vulnerability, updated Exim versions clean the complete;execution environment by default, affecting Exim and subprocesses such;as transports calling other programs, and thus may break existing;installations. New configuration options (keep_environment,;add_environment) were introduced to adjust this behavior.
Description:	Summary: A local root privilege escalation vulnerability was found in Exim, Debian's default mail transfer agent, in configurations using the perl_startup option (Only Exim via exim4-daemon-heavy enables Perl support). To address the vulnerability, updated Exim versions clean the complete execution environment by default, affecting Exim and subprocesses such as transports calling other programs, and thus may break existing installations. New configuration options (keep_environment, add_environment) were introduced to adjust this behavior. Affected Software/OS: exim4 on Debian Linux Solution: For the oldstable distribution (wheezy), this problem has been fixed in version 4.80-7+deb7u2. For the stable distribution (jessie), this problem has been fixed in version 4.84.2-1. For the testing distribution (stretch), this problem has been fixed in version 4.86.2-1. For the unstable distribution (sid), this problem has been fixed in version 4.86.2-1. We recommend that you upgrade your exim4 packages. CVSS Score: 6.9 CVSS Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2016-1531 Debian Security Information: DSA-3517 (Google Search) http://www.debian.org/security/2016/dsa-3517 https://www.exploit-db.com/exploits/39535/ https://www.exploit-db.com/exploits/39549/ https://www.exploit-db.com/exploits/39702/ http://packetstormsecurity.com/files/136124/Exim-4.84-3-Local-Root-Privilege-Escalation.html http://www.rapid7.com/db/modules/exploit/unix/local/exim_perl_startup http://www.securitytracker.com/id/1035512 SuSE Security Announcement: openSUSE-SU-2016:0721 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00026.html http://www.ubuntu.com/usn/USN-2933-1
Copyright	Copyright (C) 2016 Greenbone Networks GmbH

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.