{"id":782,"date":"2021-07-23T12:38:02","date_gmt":"2021-07-23T12:38:02","guid":{"rendered":"https:\/\/ssdsunucum.com\/blog\/cve-2016-1531-exim\/"},"modified":"2021-07-23T12:38:02","modified_gmt":"2021-07-23T12:38:02","slug":"cve-2016-1531-exim","status":"publish","type":"post","link":"https:\/\/ssdsunucum.com\/blog\/cve-2016-1531-exim\/","title":{"rendered":"CVE-2016-1531 Exim"},"content":{"rendered":"<\/p>\n
\n
<\/div>\n
\n

Background Information<\/h2>\n

On Wednesday, March 2, 2016, Exim announced a vulnerability in all versions of the Exim software.<\/p>\n

Impact<\/h2>\n

According to Exim development:
\n> All installations having Exim set-uid root<\/code> and using perl_startup<\/code> are vulnerable to a local privilege escalation. Any user who can start an instance of Exim (this is normally any<\/em> user) can gain root<\/code> privileges.<\/p>\n

Releases<\/h2>\n

The following versions of cPanel & WHM were patched to have the correct version of Exim. All previous versions of cPanel & WHM, including 11.48.x and below, are vulnerable to a set-uid<\/code> attack on Exim.<\/p>\n

    \n
  • 11.50 \u2014 11.50.5.0<\/li>\n
  • 11.52 \u2014 11.52.4.0<\/li>\n
  • 11.54 \u2014 11.54.0.18<\/li>\n
  • EDGE \u2014 11.55.9999.106<\/li>\n
  • CURRENT \u2014 11.54.0.18<\/li>\n
  • RELEASE \u2014 11.54.0.18<\/li>\n
  • STABLE \u2014 11.54.0.18<\/li>\n<\/ul>\n

    How to determine if your server is up to date<\/h2>\n

    The updated RPMs provided by cPanel will contain a changelog entry with the CVE number. You can check for this changelog entry with the following command: <\/p>\n

    \n
    rpm -<\/span>q --changelog <\/span>exim |<\/span> grep CVE-<\/span>2016<\/span>-<\/span>1531<\/span><\/code><\/pre>\n<\/div>\n
    The output should resemble below: <\/p>\n
    \n
    -<\/span> Fixes CVE-<\/span>2016<\/span>-<\/span>1531<\/span><\/code><\/pre>\n<\/div>\n
    What to do if you are not up to date.<\/h2>\n
    If your server is not running one of the above versions, update immediately<\/strong>.<\/p>\n
    To upgrade your server, use WHM\u2019s Upgrade to Latest Version<\/em> interface (WHM >> Home >> cPanel >> Upgrade to Latest Version<\/em>).<\/p>\n
    Alternatively, you can run the below commands to upgrade your server from the command line:\n<\/p>\n
    \n
    \n\n\n
    \n
    1\n<\/span>2\n<\/span><\/code><\/pre>\n<\/td>\n
    		\n
    \/<\/span>scripts<\/span>\/<\/span>upcp<\/span>\n\/<\/span>scripts<\/span>\/<\/span>check_cpanel_rpms<\/span> --<\/span>fix<\/span> --<\/span>long<\/span>-<\/span>list<\/span><\/code><\/pre>\n<\/td>\n<\/tr>\n<\/table>\n<\/div>\n<\/div>\n
    Verify the new Exim RPM was installed: <\/p>\n
    \n
    rpm -<\/span>q --changelog <\/span>exim |<\/span> grep CVE-<\/span>2016<\/span>-<\/span>1531<\/span><\/code><\/pre>\n<\/div>\n
    The output should resemble below: <\/p>\n
    \n
    -<\/span> Fixes CVE-<\/span>2016<\/span>-<\/span>1531<\/span><\/code><\/pre>\n<\/div>\n
    What has changed?<\/h2>\n
    Exim now provides two configuration options which limit what environment variables are available to Exim and all of its child processes. The variables are keep_environment<\/code> and add_environment<\/code>. For the initial release with this feature, cPanel will be setting the variables as follows in all supported cPanel & WHM systems. These values can be modified in WHM\u2019s Advanced Configuration Editor<\/em> interface if necessary, though we advise caution on adding too many variables to keep_environment<\/code>.<\/p>\n
    The \/etc\/exim.conf<\/code> file:<\/p>\n
    \n
    \n\n\n
    \n
    1\n<\/span>2\n<\/span><\/code><\/pre>\n<\/td>\n
    		\n
    keep_environment<\/span> = X<\/span>-<\/span>SOURCE<\/span> : X<\/span>-<\/span>SOURCE<\/span>-<\/span>ARGS<\/span> : X<\/span>-<\/span>SOURCE<\/span>-<\/span>DIR<\/span>\nadd_environment<\/span> = PATH<\/span>=\/<\/span>usr<\/span>\/<\/span>local<\/span>\/<\/span>sbin<\/span>::\/<\/span>usr<\/span>\/<\/span>local<\/span>\/<\/span>bin<\/span>::\/<\/span>sbin<\/span>::\/<\/span>bin<\/span>::\/<\/span>usr<\/span>\/<\/span>sbin<\/span>::\/<\/span>usr<\/span>\/<\/span>bin<\/span>::\/<\/span>sbin<\/span>::\/<\/span>bin<\/span> <\/code><\/pre>\n<\/td>\n<\/tr>\n<\/table>\n<\/div>\n<\/div>\n
    If you are still experiencing issues or need additional help, please contact cPanel support.<\/p>\n<\/p><\/div>\n","protected":false},"excerpt":{"rendered":"
    Background Information On Wednesday, March 2, 2016, Exim announced a vulnerability in all versions of the Exim software. Impact According to Exim development: > All installations having Exim set-uid root and using perl_startup are vulnerable to a local privilege escalation. Any user who can start an instance of Exim (this is normally any user) can …<\/p>\n","protected":false},"author":1,"featured_media":783,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[1],"tags":[],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/posts\/782"}],"collection":[{"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/comments?post=782"}],"version-history":[{"count":0,"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/posts\/782\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/media\/783"}],"wp:attachment":[{"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/media?parent=782"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/categories?post=782"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ssdsunucum.com\/blog\/wp-json\/wp\/v2\/tags?post=782"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}