Executive brief
A security vulnerability in the Exim mail server allows a local user to take complete control of the underlying server. By placing a specially crafted file in their own directory, a user can trigger a system error that grants them administrative (root) privileges. This could lead to a total compromise of the system's data and operations by any individual with basic access to the machine.
Technical details
A buffer overflow vulnerability exists in the Exim mail transfer agent (MTA) during the processing of user-defined .forward files. The flaw is triggered when the software handles an excessively long string within the ':include:' option of the file. Because Exim often runs with high privileges to handle mail delivery, a local attacker can exploit this memory corruption to execute arbitrary code with root authority. This is a local privilege escalation vulnerability requiring the attacker to have shell access or the ability to create files on the local filesystem.
Affected products
- Exim Exim
Timeline
- 1997-07-22: disclosed