Description
transports/appendfile.c in Exim before 4.72, when MBX locking is enabled, allows local users to change permissions of arbitrary files or create arbitrary files, and cause a denial of service or possibly gain privileges, via a symlink attack on a lockfile in /tmp/.
References (18)
Core 18
Core References
Third Party Advisory mailing-list
x_refsource_fulldisc
http://archives.neohapsis.com/archives/fulldisclosure/2010-06/0079.html
Issue Tracking x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=600097
Third Party Advisory vdb-entry
x_refsource_vupen
http://www.vupen.com/english/advisories/2010/1402
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/40454
Third Party Advisory vdb-entry
x_refsource_vupen
http://www.vupen.com/english/advisories/2011/0364
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/43243
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/59042
Patch x_refsource_confirm
http://vcs.exim.org/viewvc/exim/exim-src/src/transports/appendfile.c?r1=1.25&r2=1.26
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/40019
Various Sources mailing-list
x_refsource_mlist
http://lists.exim.org/lurker/message/20100524.175925.9a69f755.en.html
Various Sources x_refsource_confirm
http://vcs.exim.org/viewvc/exim/exim-doc/doc-txt/ChangeLog?view=markup&pathrev=exim-4_72_RC2
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/40123
Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/511653/100/0/threaded
Mailing List, Third Party Advisory vendor-advisory
x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2010-June/042613.html
Mailing List vendor-advisory
x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html
Vendor Advisory vendor-advisory
x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-1060-1
Patch x_refsource_confirm
http://bugs.exim.org/show_bug.cgi?id=989
Mailing List, Third Party Advisory vendor-advisory
x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2010-June/042587.html
Scores
EPSS
0.0028
EPSS Percentile
19.7%
Details
CWE
CWE-362
Status
published
Products (33)
exim/exim
4.10
exim/exim
4.20
exim/exim
4.21
exim/exim
4.22
exim/exim
4.23
exim/exim
4.24
exim/exim
4.30
exim/exim
4.31
exim/exim
4.32
exim/exim
4.33
... and 23 more
Published
Jun 07, 2010
Tracked Since
Feb 18, 2026