CVE-2020-28010

Exim 4 before 4.94.2 allows Out-of-bounds Write because the main function, while setuid root, copies the current working directory pathname into a buffer that is too small (on some common platforms).

CVSS v3 7.8 HIGH
CVSS v2.0 7.2 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.2^/10

CVSS v2.0 : HIGH

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://www.openwall.com/lists/oss-security/2021/07/22/7	Mailing List Third Party Advisory
https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28010-SLCWD.txt	Vendor Advisory
http://www.openwall.com/lists/oss-security/2021/07/22/7	Mailing List Third Party Advisory
https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28010-SLCWD.txt	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:exim:exim:*:*:*:*:*:*:*:*

History

21 Nov 2024, 05:22

Type	Values Removed	Values Added
References	~~() http://www.openwall.com/lists/oss-security/2021/07/22/7 - Mailing List, Third Party Advisory~~	() http://www.openwall.com/lists/oss-security/2021/07/22/7 - Mailing List, Third Party Advisory
References	~~() https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28010-SLCWD.txt - Vendor Advisory~~	() https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28010-SLCWD.txt - Vendor Advisory

Information

Published : 2021-05-06 13:15

Updated : 2024-11-21 05:22

NVD link : CVE-2020-28010

Mitre link : CVE-2020-28010

CVE.ORG link : CVE-2020-28010

JSON object : View

Products Affected

exim

exim

CWE

CWE-787

Out-of-bounds Write

{"id": "CVE-2020-28010", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2021-05-06T13:15:09.340", "references": [{"url": "http://www.openwall.com/lists/oss-security/2021/07/22/7", "tags": ["Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28010-SLCWD.txt", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.openwall.com/lists/oss-security/2021/07/22/7", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.exim.org/static/doc/security/CVE-2020-qualys/CVE-2020-28010-SLCWD.txt", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "Exim 4 before 4.94.2 allows Out-of-bounds Write because the main function, while setuid root, copies the current working directory pathname into a buffer that is too small (on some common platforms)."}, {"lang": "es", "value": "Exim 4 versiones anteriores a 4.94.2 permite una Escritura Fuera de L\u00edmites porque la funci\u00f3n principal, mientras que setuid root, copia el nombre de ruta del directorio de trabajo actual en un b\u00fafer que es demasiado peque\u00f1o (en algunas plataformas comunes)"}], "lastModified": "2024-11-21T05:22:11.680", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:exim:exim:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E0B1EAB0-1202-4BB9-94AF-CC07299D0256", "versionEndExcluding": "4.94.2", "versionStartIncluding": "4.00"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}