CVE-2010-4345: Exim Privilege Escalation Vulnerability

CVE-2010-4345 · Severity: critical · CVSS 7.8 · Exploited in the wild · Published 2022-03-25

Exim 4.72 and earlier allows local users to escalate privileges by specifying an alternate configuration file. The vulnerability stems from the ability of the exim user account to use directives, such as spool_directory, that contain arbitrary commands.

Technologies: Exim. Vendors: Exim.

Quick answers

Is CVE-2010-4345 exploited in the wild?
Yes. CVE-2010-4345 is known to be exploited in the wild, first recorded on 25 March 2022. Treat it as urgent.
How severe is CVE-2010-4345?
Critical severity, with a CVSS score of 7.8, published 25 March 2022.
Which products and versions are affected?
Exim Exim 4.72 and earlier.
Is there a fix for CVE-2010-4345?
A patch was published on 2010-12-09: Patch information disclosed in mailing lists. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2010-4345 attacked?
It is attacked with local access.
Am I affected by CVE-2010-4345?
Check whether you run Exim. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Affected products

  • Exim Exim 4.72 and earlier

Timeline

  • 2010-12-07: advisory: Vendor advisory published by Exim.
  • 2010-12-09: patched: Patch information disclosed in mailing lists.
  • 2022-03-25: kev added: Added to CISA Known Exploited Vulnerabilities Catalog.
  • 2022-03-25: disclosed: NVD publication date.

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.