Exim4 Local Root Privilege Escalation Vulnerability
Summary
DSA-3517-1: exim4 - security update. Affects exim4 versions < 4.80-7+deb7u2. Fixed in 4.80-7+deb7u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Exim4 is the default mail transfer agent in Debian. It is responsible for routing and delivering email messages. Exim4 supports Perl via the exim4-daemon-heavy package. This vulnerability affects configurations that use the perl_startup option.
Vulnerability Detail
A local root privilege escalation vulnerability has been discovered in Exim4. This vulnerability allows an attacker with local access to the system to escalate their privileges and gain root access. The vulnerability is triggered when Exim4 is configured to use the perl_startup option. By exploiting this vulnerability, an attacker can execute arbitrary code with root privileges.
How To Fix
Minimum fixed version
4.80-7+deb7u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade exim4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability.
Conclusion
The Exim4 local root privilege escalation vulnerability can be fixed by upgrading the exim4 package to the recommended versions. It is important to apply these fixes to prevent potential privilege escalation attacks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for exim4 →
FAQ
Exim4 is a mail transfer agent (MTA) used in Debian to route and deliver email messages.
This vulnerability allows an attacker with local access to the system to escalate their privileges and gain root access.
The vulnerability affects Exim4 versions in the Debian 7 (wheezy) and Debian 8 (jessie) distributions.
No, there are no known workarounds for this vulnerability.
To fix this vulnerability, you should upgrade the exim4 package to the fixed versions mentioned in the 'how_to_fix' section.
Related vulnerabilities
Recent vulnerabilities recorded for exim4.
