漏洞描述
A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.
影响产品
暂无结构化产品信息。
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
www.openwall.comhttp://www.openwall.com/lists/oss-security/2019/07/25/6↗packetstormsecurity.comhttp://packetstormsecurity.com/files/154198/Exim-4.91-Local-Privilege-Escalation.html↗www.openwall.comhttp://www.openwall.com/lists/oss-security/2019/06/05/4↗www.exim.orghttps://www.exim.org/static/doc/security/CVE-2019-10149.txt↗bugzilla.redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10149↗packetstormsecurity.comhttp://packetstormsecurity.com/files/153312/Exim-4.91-Local-Privilege-Escalation.html↗www.openwall.comhttp://www.openwall.com/lists/oss-security/2019/06/06/1↗www.debian.orghttps://www.debian.org/security/2019/dsa-4456↗lists.opensuse.orghttp://lists.opensuse.org/opensuse-security-announce/2019-06/msg00020.html↗packetstormsecurity.comhttp://packetstormsecurity.com/files/153218/Exim-4.9.1-Remote-Command-Execution.html↗www.openwall.comhttp://www.openwall.com/lists/oss-security/2021/05/04/7↗seclists.orghttp://seclists.org/fulldisclosure/2019/Jun/16↗security.gentoo.orghttps://security.gentoo.org/glsa/201906-01↗www.openwall.comhttp://www.openwall.com/lists/oss-security/2019/06/05/2↗www.openwall.comhttp://www.openwall.com/lists/oss-security/2019/06/05/3↗usn.ubuntu.comhttps://usn.ubuntu.com/4010-1/↗www.securityfocus.comhttp://www.securityfocus.com/bid/108679↗seclists.orghttps://seclists.org/bugtraq/2019/Jun/5↗www.openwall.comhttp://www.openwall.com/lists/oss-security/2019/07/26/4↗www.openwall.comhttp://www.openwall.com/lists/oss-security/2019/07/25/7↗