Debian DSA-4912-1 : exim4 - security update

critical Nessus Plugin ID 149275

Synopsis

The remote Debian host is missing a security-related update.

Description

The Qualys Research Labs reported several vulnerabilities in Exim, a mail transport agent, which could result in local privilege escalation and remote code execution.

Details can be found in the Qualys advisory at https://www.qualys.com/2021/05/04/21nails/21nails.txt

Solution

Upgrade the exim4 packages.

For the stable distribution (buster), these problems have been fixed in version 4.92-8+deb10u6.

See Also

https://www.qualys.com/2021/05/04/21nails/21nails.txt

https://security-tracker.debian.org/tracker/source-package/exim4

https://packages.debian.org/source/buster/exim4

https://www.debian.org/security/2021/dsa-4912

Plugin Details

Severity: Critical

ID: 149275

File Name: debian_DSA-4912.nasl

Version: 1.5

Type: local

Agent: unix

Published: 5/5/2021

Updated: 5/12/2021

Supported Sensors: Frictionless Assessment Agent, Nessus Agent

Risk Information

CVSS Score Source: CVE-2020-28026

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: High

Base Score: 9.3

Temporal Score: 6.9

Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C

Temporal Vector: E:U/RL:OF/RC:C

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:exim4, cpe:/o:debian:debian_linux:10.0

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Ease: No known exploits are available

Patch Publication Date: 5/4/2021

Vulnerability Publication Date: 5/6/2021

Reference Information

CVE: CVE-2020-28007, CVE-2020-28008, CVE-2020-28009, CVE-2020-28010, CVE-2020-28011, CVE-2020-28012, CVE-2020-28013, CVE-2020-28014, CVE-2020-28015, CVE-2020-28017, CVE-2020-28019, CVE-2020-28021, CVE-2020-28022, CVE-2020-28023, CVE-2020-28024, CVE-2020-28025, CVE-2020-28026

DSA: 4912

IAVA: 2021-A-0216