high CVSS 7.5 Actively exploited EPSS 18% Public exploit available

CVE-2010-4345·Exim vulnerability

Exim 4.72 and earlier allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with a directive that contains arbitrary commands, as demonstrated by the spool_directory directive.

Severity
high
Software
Exim
Fixed in
4.72-3
Published

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 18% — in the top 3% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Affected versions

Until: 4.72-3

Fixed in: 4.72-3

How to fix this CVE

Upgrade Exim to version 4.72-3 or later to close a local privilege escalation flaw that allows the exim user to execute arbitrary commands through malicious configuration file directives. This vulnerability requires local system access but can result in full system compromise. Apply the security update immediately on all affected mail servers.

sudo dnf update exim

Defensia detects this vulnerability

How to check if you are affected

  1. Run `exim -v` or `exim -bV` to check the installed Exim version and verify if it is 4.72-3 or earlier
  2. Execute `ls -la /etc/exim4/` to check if non-standard configuration files exist that could be exploited for privilege escalation
  3. Search mail logs with `grep -r 'spool_directory' /etc/exim4/` to identify if alternate spool directories have been configured outside the default location
  4. Verify the patch was applied by confirming the installed version matches or exceeds 4.72-3 using `dpkg -l | grep exim4` (Debian/Ubuntu) or `rpm -qa exim` (RHEL/CentOS)

FAQ

What is CVE-2010-4345?

CVE-2010-4345 is a local privilege escalation vulnerability in Exim that allows users with local system access to execute arbitrary commands by crafting a configuration file with malicious directives like spool_directory, enabling them to elevate privileges to the exim user level or higher.

Is CVE-2010-4345 being actively exploited?

Yes, CVE-2010-4345 is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog and public exploits are available, making it a target for active exploitation in real-world attacks against unpatched systems.

What versions of Exim are affected by CVE-2010-4345?

Exim versions up to and including 4.72-2 are vulnerable; the fix is available in version 4.72-3 and all subsequent releases.

How do I check if my server is vulnerable to CVE-2010-4345?

Run `exim -bV | grep 'Exim version'` and compare the version number; if it is 4.72-2 or earlier, the system is vulnerable and requires immediate patching.

Does Defensia detect CVE-2010-4345?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If Exim is installed on a monitored server, CVE-2010-4345 will appear in your dashboard with remediation steps.

Related Exim CVEs

CVE-2019-16928CVSS 10Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. There is a heap-based buffer overflow in string_vformat in string.c involving a long EHLO command.
CVE-2019-10149CVSS 10A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.
CVE-2018-6789CVSS 10An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. By sending a handcrafted message, a buffer overflow may happen. This can be used to execute code remotely.
CVE-2010-4344CVSS 10Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session that includes two MAIL commands in conjunction with a large message containing crafted headers, leading to improper rejection logging.
CVE-2026-45185CVSS 9.8Exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in the BDAT body parsing path. It is triggered when a client sends a TLS close_notify mid-body during a CHUNKING transfer, followed by a final cleartext byte on the same TCP connection. This can lead to heap corruption. An unauthenticated network attacker exploiting this vulnerability could execute arbitrary code.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2010-4345. Free for 1 server.

Get started free