Debian have a patched update https://www.debian.org/security/2019/dsa-4517 On Fri, 6 Sep 2019 at 17:39, Adam Spiers <bitfolk(a)adamspiers.org> wrote:

Hi John, On Wed, Sep 11, 2019 at 11:28:27AM +0100, John Winters wrote: Are there setups where Exim doesn't run as root? Normally it runs as root in order to do local delivery as the required user. If you have no local delivery then my understanding is that you aren't vulnerable to this bug, because it relies on writing bad data into a file that a later delivery agent processes. Cheers, Andy -- https://bitfolk.com/ -- No-nonsense VPS hosting

Hello, On Wed, Sep 11, 2019 at 12:25:52PM +0100, Conrad Wood wrote: Yes, the part that accepts data from the Internet drops privileges to Debian-exim as soon as it's opened the port. But this exploit doesn't make that process do anything that it's not expected to do. It writes bad data into a spool file which is later processed by code that is running as root: https://github.com/Exim/exim/blob/master/doc/doc-txt/cve-2019-15846/qualys.… The Exim queue runner process runs as root the whole time it is running, but that is only periodically. The Exim local delivery process starts as root but once it's determined which user it needs to deliver as it does fork a sub-process that drops privilege. See "2. Root privilege" https://www.exim.org/exim-html-current/doc/html/spec_html/ch-security_consi… As far as I am aware every Exim ever released that is configured to do TLS and deliver locally is vulnerable to remote root compromise by this bug. Cheers, Andy -- https://bitfolk.com/ -- No-nonsense VPS hosting

On Wed, 2019-09-11 at 12:54 +0100, John Winters wrote: +1 - as always, Andy is totally on top of things. Thank you for sharing these details! I'll look into deliver_drop_privilege option. Conrad