Vulnerability-Lookup

CERTFR-2021-ALE-008

Vulnerability from certfr_alerte - Published: 2021-05-05 - Updated: 2021-06-10

Le 5 mai 2021, Qualys a publié un bulletin de sécurité contenant 21 vulnérabilités affectant le serveur mail Exim. Quatre de ces vulnérabilités permettent une élévation de privilège et trois une exécution de code arbitraire. Ces vulnérabilités affectent toutes les versions de Exim antérieures à 4.94 et permettent in fine à un attaquant non authentifié de prendre le contrôle du serveur mail avec les privilèges du compte root.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

	Vendor	Product	Description
	Exim	N/A	Exim versions antérieures à 4.94

References

Title

Publication Time

Tags

Bulletin de sécurité Exim du 5 mai 2021	None	vendor-advisory
BlogPost de Qualys concernant les vulnérabilités	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Exim versions ant\u00e9rieures \u00e0 4.94",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Exim",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "closed_at": "2021-06-10",
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2021-27216",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-27216"
    },
    {
      "name": "CVE-2020-28013",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-28013"
    },
    {
      "name": "CVE-2020-28026",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-28026"
    },
    {
      "name": "CVE-2020-28009",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-28009"
    },
    {
      "name": "CVE-2020-28023",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-28023"
    },
    {
      "name": "CVE-2020-28011",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-28011"
    },
    {
      "name": "CVE-2020-28022",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-28022"
    },
    {
      "name": "CVE-2020-28008",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-28008"
    },
    {
      "name": "CVE-2020-28021",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-28021"
    },
    {
      "name": "CVE-2020-28024",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-28024"
    },
    {
      "name": "CVE-2020-28018",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-28018"
    },
    {
      "name": "CVE-2020-28010",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-28010"
    },
    {
      "name": "CVE-2020-28017",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-28017"
    },
    {
      "name": "CVE-2020-28012",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-28012"
    },
    {
      "name": "CVE-2020-28007",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-28007"
    },
    {
      "name": "CVE-2020-28020",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-28020"
    },
    {
      "name": "CVE-2020-28015",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-28015"
    },
    {
      "name": "CVE-2020-28016",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-28016"
    },
    {
      "name": "CVE-2020-28025",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-28025"
    },
    {
      "name": "CVE-2020-28014",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-28014"
    },
    {
      "name": "CVE-2020-28019",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-28019"
    }
  ],
  "initial_release_date": "2021-05-05T00:00:00",
  "last_revision_date": "2021-06-10T00:00:00",
  "links": [
    {
      "title": "BlogPost de Qualys concernant les vuln\u00e9rabilit\u00e9s",
      "url": "https://blog.qualys.com/vulnerabilities-research/2021/05/04/21nails-multiple-vulnerabilities-in-exim-mail-server"
    }
  ],
  "reference": "CERTFR-2021-ALE-008",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2021-05-05T00:00:00.000000"
    },
    {
      "description": "Cl\u00f4ture de l\u0027alerte. Cela ne signifie pas la fin d\u0027une menace. Seule l\u0027application de la mise \u00e0 jour permet de vous pr\u00e9munir contre l\u0027exploitation de la vuln\u00e9rabilit\u00e9 correspondante.",
      "revision_date": "2021-06-10T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    }
  ],
  "summary": "Le 5 mai 2021, Qualys a publi\u00e9 un bulletin de s\u00e9curit\u00e9 contenant 21\nvuln\u00e9rabilit\u00e9s affectant le serveur mail Exim. Quatre de ces\nvuln\u00e9rabilit\u00e9s permettent une \u00e9l\u00e9vation de privil\u00e8ge et trois une\nex\u00e9cution de code arbitraire. Ces vuln\u00e9rabilit\u00e9s affectent toutes les\nversions de Exim ant\u00e9rieures \u00e0 4.94 et permettent *in fine*\u003cspan\nclass=\"mx_MTextBody mx_EventTile_content\"\u003e\u003cspan\nclass=\"mx_EventTile_body markdown-body\" dir=\"auto\"\u003e \u00e0 un attaquant non\nauthentifi\u00e9 de prendre le contr\u00f4le du serveur mail \u003cspan\nclass=\"mx_EventTile_body\" dir=\"auto\"\u003eavec les privil\u00e8ges du compte\n*root*.\u003c/span\u003e  \n\u003c/span\u003e\u003c/span\u003e\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Exim",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Exim du 5 mai 2021",
      "url": null
    }
  ]
}

CVE-2021-27216 (GCVE-0-2021-27216)

Vulnerability from cvelistv5 – Published: 2021-05-06 04:44 – Updated: 2024-08-03 20:40

Summary

Exim 4 before 4.94.2 has Execution with Unnecessary Privileges. By leveraging a delete_pid_file race condition, a local user can delete arbitrary files as root. This involves the -oP and -oPX options.

Severity

No CVSS data available.

CWE

Assigner

mitre

References

1 reference

URL	Tags
https://www.exim.org/static/doc/security/CVE-2020…	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T20:40:47.403Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28007-LFDIR.txt"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Exim 4 before 4.94.2 has Execution with Unnecessary Privileges. By leveraging a delete_pid_file race condition, a local user can delete arbitrary files as root. This involves the -oP and -oPX options."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-05-06T04:44:50.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28007-LFDIR.txt"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2021-27216",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Exim 4 before 4.94.2 has Execution with Unnecessary Privileges. By leveraging a delete_pid_file race condition, a local user can delete arbitrary files as root. This involves the -oP and -oPX options."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28007-LFDIR.txt",
              "refsource": "MISC",
              "url": "https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28007-LFDIR.txt"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2021-27216",
    "datePublished": "2021-05-06T04:44:50.000Z",
    "dateReserved": "2021-02-15T00:00:00.000Z",
    "dateUpdated": "2024-08-03T20:40:47.403Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted