Exim4 spool directory symlink local root escalation

[halfdog]

Exim4 follows symlinks in various operations in /var/spool/exim4. By placing crafted symlinks, escalation from user "Debian-exim" to "root" is possible.

See http://www.halfdog.net/Security/2016/DebianEximSpoolLocalRoot/EximUpgrade.c for demo. (Keep a copy of "/lib/x86_64-linux-gnu/libpam.so.0.83.1" in case of errors, otherwise you will lock yourself out.)

# pwd
/var/spool/exim4
# /usr/bin/id
uid=106(Debian-exim) gid=112(Debian-exim) groups=112(Debian-exim)
# gcc -fPIC -shared -Xlinker -init=_libInit -Xlinker '--soname=LIBPAM_1.0' -Xlinker --default-symver -o EximUpgrade EximUpgrade.c -Wl,-e_entry
# ./EximUpgrade --Upgrade
Relinked /var/spool/exim4/input/1ayy0X-0000O3-HI-J
Target ready for writing
uid=0(root) gid=0(root) groups=0(root),112(Debian-exim)
# ...

$ lsb_release -rd
Description: Ubuntu 16.04 LTS
Release: 16.04

$ apt-cache policy exim4-daemon-light
exim4-daemon-light:
  Installed: 4.86.2-2ubuntu2
  Candidate: 4.86.2-2ubuntu2
  Version table:
 *** 4.86.2-2ubuntu2 500
        500 http://archive.ubuntu.com/ubuntu xenial/main amd64 Packages
        100 /var/lib/dpkg/status

[Andreas Metzler (k-launchpad-downhill-at-eu-org)]

Exim 4.88 changelog:
JH/27 Fix a possible security hole, wherein a process operating with the Exim
      UID can gain a root shell. Credit to http://www.halfdog.net/ for
      discovery and writeup. Ubuntu bug 1580454; no bug raised against Exim
      itself :(

[Christian Ehrhardt  (paelzer)]

FYI - merge for Zesty in progress and 4.88 contains a fix as listed by Andreas Metzler.
Subscribing Security Team to consider security SRUs

[Launchpad Janitor (janitor)]

This bug was fixed in the package exim4 - 4.88-5ubuntu1

---------------
exim4 (4.88-5ubuntu1) zesty; urgency=medium

  * Merge from Debian unstable.
    Version 4.88 fixes CVE-2016-9963 (LP: #1654750) and symlink
    local root escalation (LP: #1580454)
    Remaining changes:
    + Show Ubuntu distribution in SMTP banner.
    + Build-Depends on lsb-release (needed for the Ubuntu SMTP banner patch)

 -- Christian Ehrhardt <email address hidden> Tue, 24 Jan 2017 10:15:09 +0100