The open_log function in log.c in Exim 4.72 and earlier does not check the return value from (1) setuid or (2) setgid system calls, which allows local users to append log data to arbitrary files via a symlink attack.
2011-02-02T01:00:06.203
2025-04-11T00:51:21.963
Deferred
CVSSv2: 6.9 (MEDIUM)
AV:L/AC:M/Au:N/C:C/I:C/A:C
3.4
10.0
| Type | Vendor | Product | Version/Range | Vulnerable? |
|---|---|---|---|---|
| Application | exim | exim | ≤ 4.72 | Yes |
| Application | exim | exim | 2.10 | Yes |
| Application | exim | exim | 2.11 | Yes |
| Application | exim | exim | 2.12 | Yes |
| Application | exim | exim | 3.00 | Yes |
| Application | exim | exim | 3.01 | Yes |
| Application | exim | exim | 3.02 | Yes |
| Application | exim | exim | 3.03 | Yes |
| Application | exim | exim | 3.10 | Yes |
| Application | exim | exim | 3.11 | Yes |
| Application | exim | exim | 3.12 | Yes |
| Application | exim | exim | 3.13 | Yes |
| Application | exim | exim | 3.14 | Yes |
| Application | exim | exim | 3.15 | Yes |
| Application | exim | exim | 3.16 | Yes |
| Application | exim | exim | 3.20 | Yes |
| Application | exim | exim | 3.21 | Yes |
| Application | exim | exim | 3.22 | Yes |
| Application | exim | exim | 3.30 | Yes |
| Application | exim | exim | 3.31 | Yes |
| Application | exim | exim | 3.32 | Yes |
| Application | exim | exim | 3.33 | Yes |
| Application | exim | exim | 3.34 | Yes |
| Application | exim | exim | 3.35 | Yes |
| Application | exim | exim | 3.36 | Yes |
| Application | exim | exim | 4.00 | Yes |
| Application | exim | exim | 4.01 | Yes |
| Application | exim | exim | 4.02 | Yes |
| Application | exim | exim | 4.03 | Yes |
| Application | exim | exim | 4.04 | Yes |
| Application | exim | exim | 4.05 | Yes |
| Application | exim | exim | 4.10 | Yes |
| Application | exim | exim | 4.11 | Yes |
| Application | exim | exim | 4.12 | Yes |
| Application | exim | exim | 4.14 | Yes |
| Application | exim | exim | 4.20 | Yes |
| Application | exim | exim | 4.21 | Yes |
| Application | exim | exim | 4.22 | Yes |
| Application | exim | exim | 4.23 | Yes |
| Application | exim | exim | 4.24 | Yes |
| Application | exim | exim | 4.30 | Yes |
| Application | exim | exim | 4.31 | Yes |
| Application | exim | exim | 4.32 | Yes |
| Application | exim | exim | 4.33 | Yes |
| Application | exim | exim | 4.34 | Yes |
| Application | exim | exim | 4.40 | Yes |
| Application | exim | exim | 4.41 | Yes |
| Application | exim | exim | 4.42 | Yes |
| Application | exim | exim | 4.43 | Yes |
| Application | exim | exim | 4.44 | Yes |
| Application | exim | exim | 4.50 | Yes |
| Application | exim | exim | 4.51 | Yes |
| Application | exim | exim | 4.52 | Yes |
| Application | exim | exim | 4.53 | Yes |
| Application | exim | exim | 4.54 | Yes |
| Application | exim | exim | 4.60 | Yes |
| Application | exim | exim | 4.61 | Yes |
| Application | exim | exim | 4.62 | Yes |
| Application | exim | exim | 4.63 | Yes |
| Application | exim | exim | 4.64 | Yes |
| Application | exim | exim | 4.65 | Yes |
| Application | exim | exim | 4.66 | Yes |
| Application | exim | exim | 4.67 | Yes |
| Application | exim | exim | 4.68 | Yes |
| Application | exim | exim | 4.69 | Yes |
| Application | exim | exim | 4.70 | Yes |
| Application | exim | exim | 4.71 | Yes |