CVE:CVE-2011-0017
CNNVD:CNNVD-201102-021
Exim 是一个开放源代码的免费邮件传送软件，可以在Unix下提供邮件传输代理功能(MTA)，由剑桥大学发布和维护。
Exim 4.72及之前版本中的log.c程序中的open_log函数没有检查(1)setuid或者(2)setgid系统调用的返回值。本地用户可以借助符号链接攻击向任意文件追加日志数据。
solution:Upgrade exim exim to a higher version than 4.72,2.10,2.11,2.12,3.00,3.01,3.02,3.03,3.10,3.11,3.12,3.13,3.14,3.15,3.16,3.20,3.21,3.22,3.30,3.31,3.32,3.33,3.34,3.35,3.36,4.00,4.01,4.02,4.03,4.04,4.05,4.10,4.11,4.12,4.14,4.20,4.21,4.22,4.23,4.24,4.30,4.31,4.32,4.33,4.34,4.40,4.41,4.42,4.43,4.44,4.50,4.51,4.52,4.53,4.54,4.60,4.61,4.62,4.63,4.64,4.65,4.66,4.67,4.68,4.69,4.70,4.71,and avoid the version (,4.72],2.10,2.11,2.12,3.00,3.01,3.02,3.03,3.10,3.11,3.12,3.13,3.14,3.15,3.16,3.20,3.21,3.22,3.30,3.31,3.32,3.33,3.34,3.35,3.36,4.00,4.01,4.02,4.03,4.04,4.05,4.10,4.11,4.12,4.14,4.20,4.21,4.22,4.23,4.24,4.30,4.31,4.32,4.33,4.34,4.40,4.41,4.42,4.43,4.44,4.50,4.51,4.52,4.53,4.54,4.60,4.61,4.62,4.63,4.64,4.65,4.66,4.67,4.68,4.69,4.70,4.71