6.9

CVE-2011-0017

The open_log function in log.c in Exim 4.72 and earlier does not check the return value from (1) setuid or (2) setgid system calls, which allows local users to append log data to arbitrary files via a symlink attack.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Exim ≫ Exim Version <= 4.72
Exim ≫ Exim Version2.10
Exim ≫ Exim Version2.11
Exim ≫ Exim Version2.12
Exim ≫ Exim Version3.00
Exim ≫ Exim Version3.01
Exim ≫ Exim Version3.02
Exim ≫ Exim Version3.03
Exim ≫ Exim Version3.10
Exim ≫ Exim Version3.11
Exim ≫ Exim Version3.12
Exim ≫ Exim Version3.13
Exim ≫ Exim Version3.14
Exim ≫ Exim Version3.15
Exim ≫ Exim Version3.16
Exim ≫ Exim Version3.20
Exim ≫ Exim Version3.21
Exim ≫ Exim Version3.22
Exim ≫ Exim Version3.30
Exim ≫ Exim Version3.31
Exim ≫ Exim Version3.32
Exim ≫ Exim Version3.33
Exim ≫ Exim Version3.34
Exim ≫ Exim Version3.35
Exim ≫ Exim Version3.36
Exim ≫ Exim Version4.00
Exim ≫ Exim Version4.01
Exim ≫ Exim Version4.02
Exim ≫ Exim Version4.03
Exim ≫ Exim Version4.04
Exim ≫ Exim Version4.05
Exim ≫ Exim Version4.10
Exim ≫ Exim Version4.11
Exim ≫ Exim Version4.12
Exim ≫ Exim Version4.14
Exim ≫ Exim Version4.20
Exim ≫ Exim Version4.21
Exim ≫ Exim Version4.22
Exim ≫ Exim Version4.23
Exim ≫ Exim Version4.24
Exim ≫ Exim Version4.30
Exim ≫ Exim Version4.31
Exim ≫ Exim Version4.32
Exim ≫ Exim Version4.33
Exim ≫ Exim Version4.34
Exim ≫ Exim Version4.40
Exim ≫ Exim Version4.41
Exim ≫ Exim Version4.42
Exim ≫ Exim Version4.43
Exim ≫ Exim Version4.44
Exim ≫ Exim Version4.50
Exim ≫ Exim Version4.51
Exim ≫ Exim Version4.52
Exim ≫ Exim Version4.53
Exim ≫ Exim Version4.54
Exim ≫ Exim Version4.60
Exim ≫ Exim Version4.61
Exim ≫ Exim Version4.62
Exim ≫ Exim Version4.63
Exim ≫ Exim Version4.64
Exim ≫ Exim Version4.65
Exim ≫ Exim Version4.66
Exim ≫ Exim Version4.67
Exim ≫ Exim Version4.68
Exim ≫ Exim Version4.69
Exim ≫ Exim Version4.70
Exim ≫ Exim Version4.71
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.38% 0.295
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.9 3.4 10
AV:L/AC:M/Au:N/C:C/I:C/A:C
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CWE-59 Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

http://secunia.com/advisories/43243
http://www.ubuntu.com/usn/USN-1060-1
http://www.vupen.com/english/advisories/2011/0364
http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00004.html
http://www.vupen.com/english/advisories/2011/0464
http://secunia.com/advisories/43128
Vendor Advisory
http://www.debian.org/security/2011/dsa-2154
http://www.vupen.com/english/advisories/2011/0245
Vendor Advisory
ftp://ftp.exim.org/pub/exim/ChangeLogs/ChangeLog-4.74
http://lists.exim.org/lurker/message/20110126.034702.4d69c278.en.html
Patch
http://osvdb.org/70696
http://secunia.com/advisories/43101
Vendor Advisory
http://www.securityfocus.com/bid/46065
http://www.vupen.com/english/advisories/2011/0224
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/65028