https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28007-LFDIR.txt

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4934-2 advisory.

  - Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. Because Exim operates as root in the     log directory (owned by a non-root user), a symlink or hard link attack allows overwriting critical root-     owned files anywhere on the filesystem. (CVE-2020-28007)

  - Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. Because Exim operates as root in the     spool directory (owned by a non-root user), an attacker can write to a /var/spool/exim4/input spool header     file, in which a crafted recipient address can indirectly lead to command execution. (CVE-2020-28008)

  - Exim 4 before 4.94.2 allows Integer Overflow to Buffer Overflow because get_stdinput allows unbounded     reads that are accompanied by unbounded increases in a certain size variable. NOTE: exploitation may be     impractical because of the execution time needed to overflow (multiple days). (CVE-2020-28009)

  - Exim 4 before 4.94.2 allows Heap-based Buffer Overflow in queue_run via two sender options: -R and -S.
    This may cause privilege escalation from exim to root. (CVE-2020-28011)

  - Exim 4 before 4.94.2 allows Exposure of File Descriptor to Unintended Control Sphere because rda_interpret     uses a privileged pipe that lacks a close-on-exec flag. (CVE-2020-28012)

  - Exim 4 before 4.94.2 allows Heap-based Buffer Overflow because it mishandles -F '.(' on the command     line, and thus may allow privilege escalation from any user to root. This occurs because of the     interpretation of negative sizes in strncpy. (CVE-2020-28013)

  - Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. The -oP option is available to the exim     user, and allows a denial of service because root-owned files can be overwritten. (CVE-2020-28014)

  - Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters. Local users can alter the behavior of     root processes because a recipient address can have a newline character. (CVE-2020-28015)

  - Exim 4 before 4.94.2 allows an off-by-two Out-of-bounds Write because -F '' is mishandled by     parse_fix_phrase. (CVE-2020-28016)

  - Exim 4 before 4.94.2 allows Integer Overflow to Buffer Overflow in receive_add_recipient via an e-mail     message with fifty million recipients. NOTE: remote exploitation may be difficult because of resource     consumption. (CVE-2020-28017)

  - Exim 4 before 4.92 allows Integer Overflow to Buffer Overflow, in which an unauthenticated remote attacker     can execute arbitrary code by leveraging the mishandling of continuation lines during header-length     restriction. (CVE-2020-28020)

  - Exim 4 before 4.94.2 has Improper Restriction of Write Operations within the Bounds of a Memory Buffer.
    This occurs when processing name=value pairs within MAIL FROM and RCPT TO commands. (CVE-2020-28022)

  - Exim 4 before 4.94.2 allows Buffer Underwrite that may result in unauthenticated remote attackers     executing arbitrary commands, because smtp_ungetc was only intended to push back characters, but can     actually push back non-character error codes such as EOF. (CVE-2020-28024)

  - Exim 4 before 4.94.2 allows Out-of-bounds Read because pdkim_finish_bodyhash does not validate the     relationship between sig->bodyhash.len and b->bh.len; thus, a crafted DKIM-Signature header might lead to     a leak of sensitive information from process memory. (CVE-2020-28025)

  - Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters, relevant in non-default     configurations that enable Delivery Status Notification (DSN). Certain uses of ORCPT= can place a newline     into a spool header file, and indirectly allow unauthenticated remote attackers to execute arbitrary     commands as root. (CVE-2020-28026)

  - Exim 4 before 4.94.2 has Execution with Unnecessary Privileges. By leveraging a delete_pid_file race     condition, a local user can delete arbitrary files as root. This involves the -oP and -oPX options.
    (CVE-2021-27216)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202105-01 (Exim: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Exim. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker, by connecting to the SMTP listener daemon, could       possibly execute arbitrary code with the privileges of the process or       cause a Denial of Service condition. Furthermore, a local attacker could       perform symlink attacks to overwrite arbitrary files with the privileges       of the user running the application or escalate privileges.
  Workaround :

    There is no known workaround at this time.

According to its banner, the version of Exim running on the remote host is prior to 4.94.2. It is, therefore, potentially affected by multiple vulnerabilities that can lead to remote code execution.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 20.10 / 21.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4934-1 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
149323	Ubuntu 16.04 LTS : Exim vulnerabilities (USN-4934-2)	Nessus	Ubuntu Local Security Checks	critical
149277	GLSA-202105-01 : Exim: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
149260	Exim < 4.94.2 Multiple Vulnerabilities (21Nails)	Nessus	SMTP problems	critical
149253	Ubuntu 18.04 LTS / 20.04 LTS / 20.10 / 21.04 : Exim vulnerabilities (USN-4934-1)	Nessus	Ubuntu Local Security Checks	critical

CVE-2021-27216

medium

New! CVE Severity Now Using CVSS v3

Description

References

Details

Risk Information

CVSS v2

CVSS v3

Vulnerable Software

Configuration 1

Tenable Plugins

critical

critical

critical

critical