CVE-2010-4345
Exim Privilege Escalation Vulnerability
Description
CVE-2010-4345 is a high-severity command injection vulnerability affecting Exim Exim (versions <= 4.72). Exim allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with a directive that contains arbitrary commands. CISA has added CVE-2010-4345 to the Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. With an EPSS score of 4.02% (88.3rd percentile), this vulnerability has a notable probability of being exploited.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| exim | exim | <= 4.72 |
| opensuse | opensuse | 11.1; 11.2; 11.3 |
| debian | debian linux | 5.0 |
| canonical | ubuntu linux | 6.06; 8.04; 9.10; 10.04; 10.10 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://bugs.exim.org/show_bug.cgi?id=1044(Issue Tracking, Patch)
- http://lists.exim.org/lurker/message/20101209.172233.abcba158.en.html(Mailing List, Patch)
- http://lists.exim.org/lurker/message/20101210.164935.385e04d0.en.html(Mailing List)
- http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00003.html(Mailing List, Third Party Advisory)
- http://openwall.com/lists/oss-security/2010/12/10/1(Mailing List)
- http://secunia.com/advisories/42576(Broken Link, Vendor Advisory)
- http://secunia.com/advisories/42930(Broken Link)
- http://secunia.com/advisories/43128(Broken Link)
- http://secunia.com/advisories/43243(Broken Link)
- http://www.cpanel.net/2010/12/critical-exim-security-update.html(Broken Link)
- http://www.debian.org/security/2010/dsa-2131(Mailing List, Third Party Advisory)
- http://www.debian.org/security/2011/dsa-2154(Mailing List, Third Party Advisory)
- http://www.exim.org/lurker/message/20101207.215955.bb32d4f2.en.html(Mailing List, Vendor Advisory)
- http://www.kb.cert.org/vuls/id/758489(Third Party Advisory, US Government Resource)
- http://www.metasploit.com/modules/exploit/unix/smtp/exim4_string_format(Third Party Advisory)
- http://www.openwall.com/lists/oss-security/2021/05/04/7(Mailing List)
- http://www.redhat.com/support/errata/RHSA-2011-0153.html(Broken Link)
- http://www.securityfocus.com/archive/1/515172/100/0/threaded(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securityfocus.com/bid/45341(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id?1024859(Broken Link, Third Party Advisory, VDB Entry)
- http://www.theregister.co.uk/2010/12/11/exim_code_execution_peril/(Press/Media Coverage, Third Party Advisory)
- http://www.ubuntu.com/usn/USN-1060-1(Third Party Advisory)
- http://www.vupen.com/english/advisories/2010/3171(Broken Link, Vendor Advisory)
- http://www.vupen.com/english/advisories/2010/3204(Broken Link, Vendor Advisory)
- http://www.vupen.com/english/advisories/2011/0135(Broken Link)
- http://www.vupen.com/english/advisories/2011/0245(Broken Link)
- http://www.vupen.com/english/advisories/2011/0364(Broken Link)
- https://bugzilla.redhat.com/show_bug.cgi?id=662012(Issue Tracking, Patch)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-4345(US Government Resource)
Weakness Type
CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
Command Injection is a critical vulnerability that occurs when software constructs all or part of a command using externally-influenced input from an upstream component, but fails to neutralize or incorrectly neutralizes special elements that could modify the intended command when executed. This allows attackers to inject malicious commands that are executed by the underlying system with the same privileges as the vulnerable application. In the case of CVE-2010-4345, this weakness manifests in Exim Exim where exim allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with a directive that contains arbitrary commands.
Learn more: CWE-77 — Improper Neutralization of Special Elements used in a Command ('Command Injection')
Impact Analysis
CVE-2010-4345 represents a significant threat to organizations using Exim Exim, carrying a CVSS score of 7.8. Successful exploitation can fully compromise the confidentiality, integrity, and availability of affected systems. Attackers can access sensitive data, modify system configurations or data, and disrupt service availability. While the local attack vector requires the attacker to have initial access to the system, privilege escalation vulnerabilities are frequently chained with other exploits for full system compromise.
Exploit Maturity
CVE-2010-4345 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming real-world exploitation. The EPSS score of 4.02% (88.3rd percentile) reflects a notable exploitation probability relative to other vulnerabilities. Despite being over 16 years old, this vulnerability continues to be relevant due to the persistence of unpatched legacy systems in production environments.
Remediation
- Apply vendor patches immediately as required by CISA KEV: Apply updates per vendor instructions. Upgrade Exim Exim from affected versions (<= 4.72) to the latest patched release.
- Until the patch is applied, enforce the principle of least privilege by limiting local user access to only those who require it, and restrict the ability to execute untrusted applications on affected systems.
- Monitor affected systems for signs of compromise by reviewing security logs for anomalous activity, unauthorized access attempts, and unexpected system changes related to Exim.
- Evaluate whether affected Exim Exim deployments are still within vendor support. End-of-life systems should be prioritized for migration to supported alternatives.
- Review and update your organization's vulnerability management process to ensure CISA KEV entries with a remediation deadline of 2022-04-15 are addressed within the required timeframe.
Technical Details
CVE-2010-4345 is classified under CWE-77 (Improper Neutralization of Special Elements used in a Command ('Command Injection')) affecting Exim Exim in versions <= 4.72. Exim allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with a directive that contains arbitrary commands. The vulnerability is exploitable with local access to the target system, with low attack complexity, requiring low-level privileges. The CVSS 3.1 base score of 7.8 (HIGH) reflects high confidentiality impact, high integrity impact, and high availability impact.
Frequently Asked Questions
Is CVE-2010-4345 being actively exploited?
Yes. CVE-2010-4345 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 4.02% (88.3rd percentile) indicates a notable probability of exploitation.
What products are affected by CVE-2010-4345?
CVE-2010-4345 primarily affects Exim Exim, as well as Opensuse Opensuse, Debian Debian Linux, Canonical Ubuntu Linux. The affected versions include <= 4.72. Organizations should check whether any instances of the affected software are running in their environment.
How do I fix CVE-2010-4345?
Apply updates per vendor instructions. Specifically, upgrade from the affected versions (<= 4.72) to the latest patched release from Exim. Until the update is applied, limit local access privileges and monitor for suspicious activity on affected systems.
How severe is CVE-2010-4345?
CVE-2010-4345 has a CVSS 3.1 score of 7.8, rated HIGH. This high severity rating indicates significant potential impact on affected systems. The inclusion in the CISA KEV catalog means organizations are required to remediate this vulnerability within the specified deadline.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.