Vulnerability   
Search   
    Search 219043 CVE descriptions
and 99761 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.703517
Category:Debian Local Security Checks
Title:Debian Security Advisory DSA 3517-1 (exim4 - security update)
Summary:A local root privilege escalation;vulnerability was found in Exim, Debian's default mail transfer agent, in;configurations using the perl_startup option (Only Exim via;exim4-daemon-heavy enables Perl support).;;To address the vulnerability, updated Exim versions clean the complete;execution environment by default, affecting Exim and subprocesses such;as transports calling other programs, and thus may break existing;installations. New configuration options (keep_environment,;add_environment) were introduced to adjust this behavior.
Description:Summary:
A local root privilege escalation
vulnerability was found in Exim, Debian's default mail transfer agent, in
configurations using the perl_startup option (Only Exim via
exim4-daemon-heavy enables Perl support).

To address the vulnerability, updated Exim versions clean the complete
execution environment by default, affecting Exim and subprocesses such
as transports calling other programs, and thus may break existing
installations. New configuration options (keep_environment,
add_environment) were introduced to adjust this behavior.

Affected Software/OS:
exim4 on Debian Linux

Solution:
For the oldstable distribution
(wheezy), this problem has been fixed in version 4.80-7+deb7u2.

For the stable distribution (jessie), this problem has been fixed in
version 4.84.2-1.

For the testing distribution (stretch), this problem has been fixed
in version 4.86.2-1.

For the unstable distribution (sid), this problem has been fixed in
version 4.86.2-1.

We recommend that you upgrade your exim4 packages.

CVSS Score:
6.9

CVSS Vector:
AV:L/AC:M/Au:N/C:C/I:C/A:C

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2016-1531
Debian Security Information: DSA-3517 (Google Search)
http://www.debian.org/security/2016/dsa-3517
https://www.exploit-db.com/exploits/39535/
https://www.exploit-db.com/exploits/39549/
https://www.exploit-db.com/exploits/39702/
http://packetstormsecurity.com/files/136124/Exim-4.84-3-Local-Root-Privilege-Escalation.html
http://www.rapid7.com/db/modules/exploit/unix/local/exim_perl_startup
http://www.securitytracker.com/id/1035512
SuSE Security Announcement: openSUSE-SU-2016:0721 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00026.html
http://www.ubuntu.com/usn/USN-2933-1
CopyrightCopyright (C) 2016 Greenbone Networks GmbH

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2022 E-Soft Inc. All rights reserved.