Exim 4 before 4.94.2 has Execution with Unnecessary Privileges. By leveraging a delete_pid_file race condition, a local user can delete arbitrary files as root. This involves the -oP and -oPX options.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters, relevant in non-default
    configurations that enable Delivery Status Notification (DSN). Certain uses of ORCPT= can place a newline
    into a spool header file, and indirectly allow unauthenticated remote attackers to execute arbitrary
    commands as root. (CVE-2020-28026)

  - Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. Because Exim operates as root in the
    log directory (owned by a non-root user), a symlink or hard link attack allows overwriting critical root-
    owned files anywhere on the filesystem. (CVE-2020-28007)

  - Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. Because Exim operates as root in the
    spool directory (owned by a non-root user), an attacker can write to a /var/spool/exim4/input spool header
    file, in which a crafted recipient address can indirectly lead to command execution. (CVE-2020-28008)

  - Exim 4 before 4.94.2 allows Integer Overflow to Buffer Overflow because get_stdinput allows unbounded
    reads that are accompanied by unbounded increases in a certain size variable. NOTE: exploitation may be
    impractical because of the execution time needed to overflow (multiple days). (CVE-2020-28009)

  - Exim 4 before 4.94.2 allows Out-of-bounds Write because the main function, while setuid root, copies the
    current working directory pathname into a buffer that is too small (on some common platforms).
    (CVE-2020-28010)

The version of exim installed on the remote host is prior to 4.92-1.33. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2022-1622 advisory.

    Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. Because Exim operates as root in the     log directory (owned by a non-root user), a symlink or hard link attack allows overwriting critical root-     owned files anywhere on the filesystem. (CVE-2020-28007)

    Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. Because Exim operates as root in the     spool directory (owned by a non-root user), an attacker can write to a /var/spool/exim4/input spool header     file, in which a crafted recipient address can indirectly lead to command execution. (CVE-2020-28008)

    Exim 4 before 4.94.2 allows Integer Overflow to Buffer Overflow because get_stdinput allows unbounded     reads that are accompanied by unbounded increases in a certain size variable. NOTE: exploitation may be     impractical because of the execution time needed to overflow (multiple days). (CVE-2020-28009)

    Exim 4 before 4.94.2 allows Out-of-bounds Write because the main function, while setuid root, copies the     current working directory pathname into a buffer that is too small (on some common platforms).
    (CVE-2020-28010)

    Exim 4 before 4.94.2 allows Heap-based Buffer Overflow in queue_run via two sender options: -R and -S.
    This may cause privilege escalation from exim to root. (CVE-2020-28011)

    Exim 4 before 4.94.2 allows Exposure of File Descriptor to Unintended Control Sphere because rda_interpret     uses a privileged pipe that lacks a close-on-exec flag. (CVE-2020-28012)

    Exim 4 before 4.94.2 allows Heap-based Buffer Overflow because it mishandles -F '.(' on the command     line, and thus may allow privilege escalation from any user to root. This occurs because of the     interpretation of negative sizes in strncpy. (CVE-2020-28013)

    Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. The -oP option is available to the exim     user, and allows a denial of service because root-owned files can be overwritten. (CVE-2020-28014)

    Exim 4 before 4.94.2 has Improper Initialization that can lead to recursion-based stack consumption or     other consequences. This occurs because use of certain getc functions is mishandled when a client uses     BDAT instead of DATA. (CVE-2020-28019)

    Exim 4 before 4.94.2 has Improper Restriction of Write Operations within the Bounds of a Memory Buffer.
    This occurs when processing name=value pairs within MAIL FROM and RCPT TO commands. (CVE-2020-28022)

    Exim 4 before 4.94.2 allows Out-of-bounds Read. smtp_setup_msg may disclose sensitive information from     process memory to an unauthenticated SMTP client. (CVE-2020-28023)

    Exim 4 before 4.94.2 allows Buffer Underwrite that may result in unauthenticated remote attackers     executing arbitrary commands, because smtp_ungetc was only intended to push back characters, but can     actually push back non-character error codes such as EOF. (CVE-2020-28024)

    Exim 4 before 4.94.2 allows Out-of-bounds Read because pdkim_finish_bodyhash does not validate the     relationship between sig->bodyhash.len and b->bh.len; thus, a crafted DKIM-Signature header might lead to     a leak of sensitive information from process memory. (CVE-2020-28025)

    Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters, relevant in non-default     configurations that enable Delivery Status Notification (DSN). Certain uses of ORCPT= can place a newline     into a spool header file, and indirectly allow unauthenticated remote attackers to execute arbitrary     commands as root. (CVE-2020-28026)

    Exim 4 before 4.94.2 has Execution with Unnecessary Privileges. By leveraging a delete_pid_file race     condition, a local user can delete arbitrary files as root. This involves the -oP and -oPX options.
    (CVE-2021-27216)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4934-2 advisory.

    USN-4934-1 fixed several vulnerabilities in Exim. This update provides the corresponding update for Ubuntu     14.04 ESM and Ubuntu 16.04 ESM. CVE-2020-28026 only affected Ubuntu 16.04 ESM.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202105-01 (Exim: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Exim. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker, by connecting to the SMTP listener daemon, could       possibly execute arbitrary code with the privileges of the process or       cause a Denial of Service condition. Furthermore, a local attacker could       perform symlink attacks to overwrite arbitrary files with the privileges       of the user running the application or escalate privileges.
  Workaround :

    There is no known workaround at this time.

According to its banner, the version of Exim running on the remote host is prior to 4.94.2. It is, therefore, potentially affected by multiple vulnerabilities that can lead to remote code execution.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4934-1 advisory.

    It was discovered that Exim contained multiple security issues. An attacker could use these issues to     cause a denial of service, execute arbitrary code remotely, obtain sensitive information, or escalate     local privileges.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
404249	Alpine: multiple exim packages: security update to 4.94.2-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
404249	Alpine: multiple exim packages: security update to 4.94.2-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
163870	Amazon Linux AMI : exim (ALAS-2022-1622)	Nessus	Amazon Linux Local Security Checks	critical
149323	Ubuntu 16.04 ESM : Exim vulnerabilities (USN-4934-2)	Nessus	Ubuntu Local Security Checks	critical
149277	GLSA-202105-01 : Exim: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
149260	Exim < 4.94.2 Multiple Vulnerabilities (21Nails)	Nessus	SMTP problems	critical
149253	Ubuntu 18.04 LTS / 20.04 LTS : Exim vulnerabilities (USN-4934-1)	Nessus	Ubuntu Local Security Checks	critical

Detections

Analytics

CVE-2021-27216

medium

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical