Exim before 4.86.2, when installed setuid root, allows local users to gain privileges via the perl_startup argument.

Exploit prediction (EPSS)

6.24% probability of exploitation in the next 30 days, higher than 94% of all scored CVEs.

Exploits and detections

• Metasploit exploit/unix/local/exim_perl_startup Exim "perl_startup" Privilege Escalation · metasploit exploit, excellent rank · 2016-03-10
• EDB-39702 Exim - 'perl_startup' Local Privilege Escalation (Metasploit) · local · 2016-04-15
• EDB-39549 Exim < 4.86.2 - Local Privilege Escalation · local · 2016-03-10
• EDB-39535 Exim 4.84-3 - Local Privilege Escalation · local · 2016-03-09

CVSS scores

Classification

Weakness

• CWE-264 Permissions, Privileges, and Access Controls

References

• debian.org /security/2016/dsa-3517 · vendor-advisory, x_refsource_DEBIAN, x_transferred
• exploit-db.com /exploits/39535/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
• securitytracker.com /id/1035512 · vdb-entry, x_refsource_SECTRACK, x_transferred
• packetstormsecurity.com /files/136124/Exim-4.84-3-Local-Root-Privilege-Escalation.html · x_refsource_MISC, x_transferred
• lists.opensuse.org /opensuse-security-announce/2016-03/msg00026.html · vendor-advisory, x_refsource_SUSE, x_transferred
• exploit-db.com /exploits/39702/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
• ubuntu.com /usn/USN-2933-1 · vendor-advisory, x_refsource_UBUNTU, x_transferred
• exim.org /static/doc/CVE-2016-1531.txt · x_refsource_CONFIRM, x_transferred
• rapid7.com /db/modules/exploit/unix/local/exim_perl_startup · x_refsource_MISC, x_transferred
• exploit-db.com /exploits/39549/ · exploit, x_refsource_EXPLOIT-DB, x_transferred

Sources

• CVE List: CVE-2016-1531
• NVD: CVE-2016-1531

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.