Bug 662012 (CVE-2010-4345)
| Summary: | CVE-2010-4345 exim: privilege escalation | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Mark J. Cox <mjc> | ||||||||
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> | ||||||||
| Status: | CLOSED ERRATA | QA Contact: | |||||||||
| Severity: | medium | Docs Contact: | |||||||||
| Priority: | medium | ||||||||||
| Version: | unspecified | CC: | ade.rixon, bressers, dwmw2, jlieskov, jrusnack, levon, mlichvar, nixon, rcvalle | ||||||||
| Target Milestone: | --- | Keywords: | Security | ||||||||
| Target Release: | --- | ||||||||||
| Hardware: | All | ||||||||||
| OS: | Linux | ||||||||||
| Whiteboard: | |||||||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||||||
| Doc Text: | Story Points: | --- | |||||||||
| Clone Of: | Environment: | ||||||||||
| Last Closed: | 2012-06-20 17:14:35 UTC | Type: | --- | ||||||||
| Regression: | --- | Mount Type: | --- | ||||||||
| Documentation: | --- | CRM: | |||||||||
| Verified Versions: | Category: | --- | |||||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||||
| Embargoed: | |||||||||||
| Bug Depends On: | 662020, 662024, 668077, 668078, 668079, 668080, 668081, 668082 | ||||||||||
| Bug Blocks: | |||||||||||
| Attachments: |
|
||||||||||
|
Description
Mark J. Cox
2010-12-10 10:39:39 UTC
http://lists.exim.org/lurker/message/20101212.031058.0a4ca7c2.en.html I've just pushed a set of patches to http://git.exim.org/users/dwmw2/exim.git git://git.exim.org/users/dwmw2/exim.git They do the following: - Add Valgrind hooks to the store pools to aid debugging. - Don't use config files as root if they're writeable by non-root users/groups. Including the Exim user/group. - Kill ALT_CONFIG_ROOT_ONLY as discussed, so only root can specify arbitrary files on the command line with the -C option. If the Exim user uses -C, or uses the -D option to set macros, then root privs will be dropped. - Add a TRUSTED_CONFIG_PREFIX_FILE option. If set, it gives a filename for a file that contains prefix strings, like the ALT_CONFIG_PREFIX. Each line in that file specifies a prefix for config files which are to be trusted, and executed with root privilege if seen in the -C option, regardless of which user Exim is invoked by. As long as the config file is not writeable by anyone but root, of course. - Set FD_CLOEXEC on SMTP sockets after forking to handle the connection. The TRUSTED_CONFIG_PREFIX_FILE one wants a little more attention; I haven't properly tested it yet. But it's 3am so not right now... Here are the upstream patches for this one: Allow only absolute paths in TRUSTED_CONFIG_PREFIX_LIST... http://git.exim.org/exim.git/commit/1e83d68b72d24d6255d2e78facbe01656515ab4f Set FD_CLOEXEC on SMTP sockets after forking to handle... http://git.exim.org/exim.git/commit/fa32850be0d9e605da1b33305c122f7a59a24650 Add TRUSTED_CONFIG_PREFIX_FILE option http://git.exim.org/exim.git/commit/261dc43e32f6039781ca92535e56f5caaa68b809 Remove ALT_CONFIG_ROOT_ONLY build option, effectively... http://git.exim.org/exim.git/commit/cd25e41d2d044556e024f0292a17c5ec3cc7987b Check configure file permissions even for non-default... http://git.exim.org/exim.git/commit/e2f5dc151e2e79058e93924e6d35510557f0535d Don't allow a configure file which is writeable by... http://git.exim.org/exim.git/commit/c1d94452b1b7f3620ee3cc9aa197ad98821de79f Created attachment 468682 [details]
Patch for above commits
I've been informed that the above commits are still not complete for this issue. I'll update the patch when upstream is finished. Created attachment 472064 [details]
backport for exim-4.43
Created attachment 472066 [details]
backport for exim-4.63
Created exim tracking bugs for this issue Affects: fedora-all [bug 668078] Affects: fedora-all [bug 668078] I'm lowering the severity of this to moderate. Without another flaw that lets you gain access to the exim user, this flaw has no value. This issue has been addressed in following products: Red Hat Enterprise Linux 4 Red Hat Enterprise Linux 5 Via RHSA-2011:0153 https://rhn.redhat.com/errata/RHSA-2011-0153.html |