Exim Local Privilege Escalation (CVE‑2010‑4345) Threatens Mail‑Server Trust

Exim Local Privilege Escalation (CVE‑2010‑4345) Threatens Mail‑Server Trust

What It Is

A flaw in the Exim mail transfer agent allows any local, unprivileged user to specify an alternate configuration file. That file can contain directives that execute arbitrary commands as the privileged exim system account, effectively granting the attacker full root‑level control of the host.

Exploitability

The vulnerability has been publicly disclosed since 2010 and proof‑of‑concept code exists. Exploitation requires only local access (e.g., a compromised user account or a container breakout). While no large‑scale active campaigns are currently reported, the ease of exploitation makes it a high‑severity risk for any unpatched system.

Affected Products

• Vendor: Exim
• Product: Exim MTA (all versions prior to the fix released in Exim 4.84)

Why It Matters for Compliance & Audit Readiness

• Vendor‑Management Controls: Demonstrating that third‑party software is kept current is a core element of control‑based assurance frameworks (e.g., NIST CM‑7, ISO 27001 A.12.1).
• Access Controls & Least Privilege (AC‑6): The flaw subverts the principle of least privilege by allowing a low‑privilege user to execute as the privileged exim account. Evidence of hardened file‑system permissions and restricted configuration‑file access is required for a defensible audit trail.
• Continuous Monitoring: Detecting unexpected configuration changes or anomalous command execution aligns with continuous control monitoring requirements (e.g., NIST CA‑7). Maintaining logs that prove the Exim version and patch status supports due‑diligence evidence during assessments.

Recommended Actions

• Inventory & Version Check: Identify every server running Exim and record the exact version.
• Patch/Upgrade: Upgrade to Exim 4.84 or later, or apply the vendor‑provided back‑port patches for supported distributions.
• Restrict Configuration Access: Ensure only the root or a dedicated admin account can write to Exim’s configuration directories (/etc/exim/, /etc/exim4/).
• Validate File Permissions: Verify that the exim user cannot read/write arbitrary files; enforce chmod 640 or tighter where appropriate.
• Monitor & Log: Enable audit logging for configuration file changes and command execution by the exim user; integrate alerts into your SIEM.
• Document Controls: Capture evidence of the above steps (patch records, permission screenshots, log excerpts) to satisfy audit requirements for vendor‑management and access‑control controls.

Source: https://nvd.nist.gov/vuln/detail/CVE-2010-4345