CVE-2010-2024

Publication date 7 June 2010

Last updated 24 July 2024

Description

transports/appendfile.c in Exim before 4.72, when MBX locking is enabled, allows local users to change permissions of arbitrary files or create arbitrary files, and cause a denial of service or possibly gain privileges, via a symlink attack on a lockfile in /tmp/.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
exim4	10.10 maverick	Fixed 4.72-1ubuntu1
	10.04 LTS lucid	Fixed 4.71-3ubuntu1.1
	9.10 karmic	Fixed 4.69-11ubuntu4.2
	9.04 jaunty	Ignored end of life
	8.04 LTS hardy	Fixed 4.69-2ubuntu0.3
	6.06 LTS dapper	Fixed 4.60-3ubuntu3.3

Notes

mdeslaur

not default configuration

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
exim4	Upstream: http://vcs.exim.org/viewvc/exim/exim-src/src/transports/appendfile.c?r1=1.25&r2=1.26 Upstream: bf83d8d

References

Related Ubuntu Security Notices (USN)

USN-1060-1
Exim vulnerabilities
10 February 2011