CVE-2016-1531

Exim before 4.86.2, when installed setuid root, allows local users to gain privileges via the perl_startup argument.

CVSS v3.0 NVD

7.0 HIGHCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

6.9 MEDIUMAV:L/AC:M/Au:N/C:C/I:C/A:C

EPSS

6.27% chance of exploitation in the next 30 days, 94th percentile

Published

2016-04-07

Updated

2024-08-05

Proof-of-concept exploits (7)

• http://www.rapid7.com/db/modules/exploit/unix/local/exim_perl_startup
• Jekyll-Hyde2022/PrivEsc-Linux0★ · 2023-08-15
• NyxByt3/CVE-2016-15310★ · 2023-03-17
• Sp3c73rSh4d0w/CVE-2016-15310★ · 2023-03-17
• c0d3cr4f73r/CVE-2016-15310★ · 2023-03-17
• crypticdante/CVE-2016-15310★ · 2023-03-17
• h3x0v3rl0rd/CVE-2016-15310★ · 2023-03-17

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/unix/local/exim_perl_startup.rb

ExploitDB entries (3)

• https://www.exploit-db.com/exploits/39702
• https://www.exploit-db.com/exploits/39549
• https://www.exploit-db.com/exploits/39535

Security advisories

• http://www.exim.org/static/doc/CVE-2016-1531.txt
• http://www.ubuntu.com/usn/USN-2933-1

References

• CVE Record
• NVD entry

Related

• CVE-2004-2687
• CVE-2007-2447
• CVE-2009-2265
• CVE-2011-1249
• CVE-2014-0160
• CVE-2015-1635