CVE-2002-1381
Exim 3.x-3.36 and 4.x-4.10 - Authenticated Remote Code Execution via pid_file_path Format String
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2002-1381. PoCs published by Thomas Wana.
AI-analyzed exploit summary This exploit leverages a format string vulnerability in Exim's daemon_go() function to achieve local privilege escalation. It calculates stack pops and overwrites the GOT entry for fopen() to redirect execution to shellcode.
Description
Format string vulnerability in daemon.c for Exim 4.x through 4.10, and 3.x through 3.36, allows exim administrative users to execute arbitrary code by modifying the pid_file_path value.
Exploits (1)
This exploit leverages a format string vulnerability in Exim's daemon_go() function to achieve local privilege escalation. It calculates stack pops and overwrites the GOT entry for fopen() to redirect execution to shellcode.