Exim Mail Server Vulnerabilities Expose Systems to Local Attacks
Critical flaws in Exim mail server allow local attackers to access restricted files and escalate privileges. Ubuntu releases security patch USN-8590-1.
TL;DR
- Two critical vulnerabilities found in Exim mail server software
- Local attackers can bypass file access restrictions and read outside spool areas
- String expansion flaw in .local files enables privilege escalation
- Ubuntu security notice USN-8590-1 provides patches for affected systems
- Organizations should update Exim installations immediately
Security researchers have uncovered two significant vulnerabilities in the widely-used Exim mail transfer agent that could allow local attackers to compromise system security. These flaws affect how Exim handles command line options and processes string expansions in configuration files.
The vulnerabilities pose particular risk to organizations running Exim on multi-user systems, where local attackers could exploit these issues to gain unauthorized access to sensitive files or escalate their privileges within the system. Ubuntu has released security notice USN-8590-1 with patches addressing both critical issues.
File Access Bypass Vulnerability
- Exim incorrectly processes certain command line options, allowing local users to access files outside the designated spool directory
- Attackers can potentially read sensitive system files that should be restricted from the Exim service account
- This vulnerability affects the core file handling mechanism used by Exim during message processing
Privilege Escalation Flaw
- Improper handling of string expansion in .local configuration files creates a pathway for privilege escalation
- Local attackers can manipulate the expansion process to execute commands with elevated privileges
- This issue specifically targets the configuration parsing functionality that processes user-controlled input
Remediation Steps
- Apply the security updates provided in Ubuntu USN-8590-1 immediately
- Review Exim configuration files for any unauthorized modifications to .local files
- Monitor system logs for suspicious file access patterns or privilege escalation attempts
- Consider implementing additional access controls and monitoring for Exim service accounts
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.