CVE-2010-4345

Name of the Vulnerable Software and Affected Versions Exim versions 4.72 and earlier

Description The issue allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with a directive that contains arbitrary commands, as demonstrated by the spool directory directive.

Recommendations For Exim versions 4.72 and earlier, consider restricting the ability of the exim user account to specify alternate configuration files until a patch is available. As a temporary workaround, consider disabling the use of the spool directory directive in configuration files to minimize the risk of exploitation.