NVD

Id
7156  
Name
CVE-2011-0017  
Description
The open_log function in log.c in Exim 4.72 and earlier does not check the return value from (1) setuid or (2) setgid system calls, which allows local users to append log data to arbitrary files via a symlink attack.  
Reject
 
CVSS Version
2  
CVSS Score
6.9  
Severity
Medium  
CVSS Base Score
6.9  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
3.4  
CVSS Vector
(AV:L/AC:M/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-07  
Published
2011-02-01  
Modified Date
2011-03-01  
Seq
2011-0017  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
40097 7156 CVE-2011-0017 ftp://ftp.exim.org/pub/exim/ChangeLogs/ChangeLog-4.74  View
40098 7156 CVE-2011-0017 [exim-announce] 20110125 Exim 4.74 Release  View
40099 7156 CVE-2011-0017 SUSE-SR:2011:004  View
40100 7156 CVE-2011-0017 DSA-2154  View
40101 7156 CVE-2011-0017 46065  View
40102 7156 CVE-2011-0017 USN-1060-1  View
40103 7156 CVE-2011-0017 ADV-2011-0224  View
40104 7156 CVE-2011-0017 ADV-2011-0245  View
40105 7156 CVE-2011-0017 ADV-2011-0364  View
40106 7156 CVE-2011-0017 ADV-2011-0464  View
40107 7156 CVE-2011-0017 exim-openlog-privilege-escalation(65028)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
37809 JVNDB-2010-003594 Exim の open_log 機能における任意のファイルにログデータをアペンドさせる脆弱性 Exim の log.c の open_log 機能は、(1) setuid または (2) setgid システムコールの戻り値をチェックしないため、任意のファイルへログデータをアペンドさせる脆弱性が存在します。 CVE-2011-0017 47924 CVE-2011-0017 7156 6.9 http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-003594.html 2010-06-12 2012-03-27 View