Exim Math Comparison Functions Local Command Execution Vulnerability

Exim is a message transfer agent (MTA) developed at the University of Cambridge for use on Unix systems connected to the Internet. There is a great deal of flexibility in the way mail can be routed, and there are extensive facilities for checking incoming mail. Exim can be installed in place of Sendmail, although the configuration of Exim is quite different.

WHMCS Complete Billing and Support

Vulnerability Description:

Exim contains a flaw in the expansion of arguments to math comparison functions, which can result in the values being doubled.

The end result is that an attacker can perform a local command execution if they are able to perform a look-up using Exim against files that they can edit. In some cases, such as Exim being bundled with cPanel, the local command execution can actually lead to a root compromise as the Exim look-up is being done by the root user.

Impact:

This vulnerability was rated as HIGH due to the fact that a user can perform local commands under certain circumstances.

Vulnerable Version:

This vulnerability was tested against Exim 4.82 and is believed to exist in all previous versions.

Fixed Version:

This vulnerability was patched in Exim 4.83.

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.