==========================================================Ubuntu Security Notice USN-1060-1         February 10, 2011
exim4 vulnerabilities
CVE-2010-2023, CVE-2010-2024, CVE-2010-4345, CVE-2011-0017
==========================================================
A security issue affects the following Ubuntu releases:

Ubuntu 6.06 LTS
Ubuntu 8.04 LTS
Ubuntu 9.10
Ubuntu 10.04 LTS
Ubuntu 10.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 6.06 LTS:
  exim4-daemon-custom             4.60-3ubuntu3.3
  exim4-daemon-heavy              4.60-3ubuntu3.3
  exim4-daemon-light              4.60-3ubuntu3.3

Ubuntu 8.04 LTS:
  exim4-daemon-custom             4.69-2ubuntu0.3
  exim4-daemon-heavy              4.69-2ubuntu0.3
  exim4-daemon-light              4.69-2ubuntu0.3

Ubuntu 9.10:
  exim4-daemon-custom             4.69-11ubuntu4.2
  exim4-daemon-heavy              4.69-11ubuntu4.2
  exim4-daemon-light              4.69-11ubuntu4.2

Ubuntu 10.04 LTS:
  exim4-daemon-custom             4.71-3ubuntu1.1
  exim4-daemon-heavy              4.71-3ubuntu1.1
  exim4-daemon-light              4.71-3ubuntu1.1

Ubuntu 10.10:
  exim4-daemon-custom             4.72-1ubuntu1.1
  exim4-daemon-heavy              4.72-1ubuntu1.1
  exim4-daemon-light              4.72-1ubuntu1.1

In general, a standard system update will make all the necessary changes.

ATTENTION: This security update brings changes to Exim's behaviour. Please
review the following information carefully, as your Exim configuration may
need to be adjusted after applying this update.

Exim no longer runs alternate configuration files specified with the -C
option as root. The new /etc/exim4/trusted_configs file can be used to
override this new behaviour. Files listed in trusted_configs and owned by
root will be run with root privileges when using the -C option.

In addition, Exim no longer runs as root when the -D option is used. Macro
definitions that require root privileges should now be placed in trusted
configuration files.

Please see the /usr/share/doc/exim4-*/NEWS.Debian file for detailed
information.

Details follow:

It was discovered that Exim contained a design flaw in the way it processed
alternate configuration files. An attacker that obtained privileges of the
"Debian-exim" user could use an alternate configuration file to obtain
root privileges. (CVE-2010-4345)

It was discovered that Exim incorrectly handled certain return values when
handling logging. A local attacker could use this flaw to obtain root
privileges. (CVE-2011-0017)

Dan Rosenberg discovered that Exim incorrectly handled writable sticky-bit
mail directories. If Exim were configured in this manner, a local user
could use this flaw to cause a denial of service or possibly gain
privileges. This issue only applied to Ubuntu 6.06 LTS, 8.04 LTS, 9.10,
and 10.04 LTS. (CVE-2010-2023)

Dan Rosenberg discovered that Exim incorrectly handled MBX locking. If
Exim were configured in this manner, a local user could use this flaw to
cause a denial of service or possibly gain privileges. This issue only
applied to Ubuntu 6.06 LTS, 8.04 LTS, 9.10, and 10.04 LTS. (CVE-2010-2024)


Updated packages for Ubuntu 6.06 LTS:

  Source archives:

          Size/MD5:   346884 ecd59d3af2c9db2c15fef1febb99798d
          Size/MD5:     1710 881d571f9f38d7aec13b788888619798
          Size/MD5:  2022260 5f8e5834c648ac9a62bb8ab6ad2a6227

  Architecture independent packages:

          Size/MD5:   260742 e256c04ffcb8a31d70296cfb64c15ae2
          Size/MD5:     1580 09fa48896e5245db79e85ccac3cf998f

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

          Size/MD5:   881218 7780d0cbd71c8d6c5c8716cbb5d7f72e
          Size/MD5:   472702 91a9f584dea36af8d94a869f82253277
          Size/MD5:   417906 f408870290d8a53798fb74e4d1fe9a97
          Size/MD5:    88096 348f9bf5f1d0b7d2656b51eabd09cce4

  i386 architecture (x86 compatible Intel/AMD):

          Size/MD5:   880976 935da8d989fb9d1797acd0182fa091c3
          Size/MD5:   427590 270b7060a80ca7247acecc22428b4486
          Size/MD5:   377820 4bdeacbf7a6a36e90acf01697fea8ab4
          Size/MD5:    83016 73cf7db571d331ad6af91dc504de44c7

  powerpc architecture (Apple Macintosh G3/G4/G5):

          Size/MD5:   886008 2e2882c368e1016552f03c0ecf773d66
          Size/MD5:   473830 3b725b4b4b0463a011f691ec25050c12
          Size/MD5:   419408 34651e930beefac54b4c63ebfef55bba
          Size/MD5:    89228 d8b0d3cde64eef992430b61bbaf133d2

  sparc architecture (Sun SPARC/UltraSPARC):

          Size/MD5:   876424 b1d331f2534496013229a0a2345a5a94
          Size/MD5:   448450 d26fada29158ec6eb95ebd891d40c5c4
          Size/MD5:   397858 d5716ebf2fb73d798e15f2254c778cdc
          Size/MD5:    84486 a1e6915b178b2ea066867c8517decac7

Updated packages for Ubuntu 8.04 LTS:

  Source archives:

          Size/MD5:   562294 80eecb16d61858027221fee8cb6f7d9d
          Size/MD5:     1946 bf0a76e7b4929762c4d284f3d29159a1
          Size/MD5:  1659309 f0176239d54546526f519e266182c019

  Architecture independent packages:

          Size/MD5:   308800 11ef40bae2357372fdebbf9e17514cdb
          Size/MD5:     6354 fdb09a8184d33db55fc70e781a53f839

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

          Size/MD5:   987266 b297b0b15689b73d9d82faeaaa8d8213
          Size/MD5:   790374 c6994c2ad74712796baef75493cda18c
          Size/MD5:   499624 37cba3a0c61d376e186f4990f3ca9c5a
          Size/MD5:   704148 6700290f3ed138f4153402ce178c03f8
          Size/MD5:   445732 d7ac9cd90876686a5828daf36acc9da0
          Size/MD5:   268364 2d207a7566e8ebbb2ac07153fd8f0e48
          Size/MD5:    69020 2e1589724292d9a5946b0cdf60f36d86
          Size/MD5:   101162 82d78bcc85502da1c75796075a3db5c7

  i386 architecture (x86 compatible Intel/AMD):

          Size/MD5:   989044 089d98da1422c9f1830983acf2219489
          Size/MD5:   751732 067389696538ef70f9550121b17659a5
          Size/MD5:   471080 bf752d60c05a4d4fa7a30343d448d0c0
          Size/MD5:   670140 980cf6b09d02d965b9e41938e649ece7
          Size/MD5:   420148 7dabb6c309d2d4d85cd4f74bd88cccab
          Size/MD5:   261684 52f570638ab49eea22ec074f23d75b88
          Size/MD5:    69080 bab9a09c2cf4d3b5b6a412bd69210716
          Size/MD5:    97052 21853bcb769364c4a9fd6ed314bdf3f6

  lpia architecture (Low Power Intel Architecture):

          Size/MD5:   983724 faea01b1959a09cbd536c03c36ba3c6e
          Size/MD5:   764332 83d689254f89257ea4183bf23fac2457
          Size/MD5:   468276 1649ba43314b7b3f08a2c5b4b845a1eb
          Size/MD5:   680278 0100ce7047b983458803c000e31e5a23
          Size/MD5:   417884 3bc64f4296a2c37476f01e19db9be8b1
          Size/MD5:   263298 1e920e9ad88e87d6d71717fd4e4452de
          Size/MD5:    69024 e9975269921d66eac25d664d357afe89
          Size/MD5:    96658 24fd9d215a355bdd32933601ff37fa95

  powerpc architecture (Apple Macintosh G3/G4/G5):

          Size/MD5:   986596 4f01f7e78599bf8727ccf13099458922
          Size/MD5:   789560 cb99e2572af5da1644d771ca363847b0
          Size/MD5:   516880 70c07827cd47ae85dc3f68211fc4134b
          Size/MD5:   706424 f547b3f81cf5cab8fd0c28ec1cd83e1d
          Size/MD5:   458894 6e98435b1a0d64c5de84d4850b9abb62
          Size/MD5:   275682 7af24baa7cf15625c2f18e00126047e7
          Size/MD5:    69030 57732fbd830eb868a68915013fc46f65
          Size/MD5:   105350 b332a714b543e28b7d240e754ea5ee3c

  sparc architecture (Sun SPARC/UltraSPARC):

          Size/MD5:   983986 6b3a89c528d7ebbb09369f111a95eeab
          Size/MD5:   744646 afa37abdd4fa5f036cae23ade353492e
          Size/MD5:   483614 0363edfe66a04c1bae4c65b3f1849bfc
          Size/MD5:   664726 3b23476d57afef359d423cdec6427d2b
          Size/MD5:   430466 3117bea7636c733c0aa803cc93e03b15
          Size/MD5:   260824 a27b2e284ac96cdb8ebe371cdc8f3259
          Size/MD5:    69024 bd911e56eebf5ee5267e0b64327901ad
          Size/MD5:    98392 a1a35810067cff3daad5107504767c2e

Updated packages for Ubuntu 9.10:

  Source archives:

          Size/MD5:   572790 1fe2d1dc769e4badc58a9dc9b3ead1f0
          Size/MD5:     2366 7d012949582b49955786c60d80a925b3
          Size/MD5:  1659309 f0176239d54546526f519e266182c019

  Architecture independent packages:

          Size/MD5:   368782 655e03404e30a02fb3583eec0a536bba
          Size/MD5:     7938 1796d5a0dfcf45642074bd1c87037e3c

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

          Size/MD5:  1000728 129ae7aceddbfd6bc4c22613e43eafa0
          Size/MD5:   840316 53f2ed8ee5bc6f660a578c133aa27c93
          Size/MD5:   548068 017219cf1a93c5d3ab56780af8dcda74
          Size/MD5:   743874 5072bc3261bf95b1e0055b159dc08657
          Size/MD5:   491802 98cde3756ae8e07210d807d9d6046ec1
          Size/MD5:   280894 347484a9430a0dbe543cbb40e4ed2651
          Size/MD5:    72678 37382c8bf7fb3cc13d2beff5cc765776
          Size/MD5:   109140 db9cf7fe5f78e6d7258a7894bfe14a29

  i386 architecture (x86 compatible Intel/AMD):

          Size/MD5:  1004244 b3650b86e6c16febaac57b1254003fda
          Size/MD5:   800440 dab25fe37bbe4d7aa12f3187da6e2763
          Size/MD5:   518710 d41be70361628f7e4651cb784f9d3f80
          Size/MD5:   709912 0d264199b94ceb07fa2febe7e17f8a32
          Size/MD5:   466186 c46e91d254129106bb6bfc0e2cd1d695
          Size/MD5:   275572 2ebb57c704a9cc4045ba377025137b93
          Size/MD5:    72702 7a26791a4f1938ae654501189eb35203
          Size/MD5:   104848 5bd468c88b522baa13f8b9d2b8201659

  armel architecture (ARM Architecture):

          Size/MD5:   997616 0552017c893f30676eb85cdd528b3ab8
          Size/MD5:   803762 b1436f458ff0f6c23991afef6af29ef1
          Size/MD5:   495608 5c36ab1ff544414820d8ffbcdce0a54b
          Size/MD5:   711980 4d6adf0b234ce97ffa3f7400df756ad1
          Size/MD5:   445138 aca2ac30b003afb54b909580ec7c0490
          Size/MD5:   277694 e0e8604cd8b3d6806cae2249171d8541
          Size/MD5:    72638 f68bd721fc9a6c96394827109770af27
          Size/MD5:   101958 d1993a75c6f3b0c56331f87b0528d525

  lpia architecture (Low Power Intel Architecture):

          Size/MD5:   996132 fac12bc41784dd8b49308350bffa8446
          Size/MD5:   812398 2a24e3ecd4c1e83316fe58b72cc7fac2
          Size/MD5:   516820 c26455befb6f350a947ad6336a6e1144
          Size/MD5:   721200 81740482c98a71febcfc80eef17e8ce2
          Size/MD5:   463162 b605c810de5184147a898308280fa6a2
          Size/MD5:   276306 16446c877525be51a2edcc71e20712e5
          Size/MD5:    72686 9f994dbce8f8de03ada5957c7e736eed
          Size/MD5:   104082 1d779d40253a6bb20f512dc69ebff89c

  powerpc architecture (Apple Macintosh G3/G4/G5):

          Size/MD5:  1000630 c845caa1136d3392e7e50f7b1e55f7f9
          Size/MD5:   863982 6647ef85c6ede54b7d99ef3f62ec4de6
          Size/MD5:   563566 5644acfc491532a06d3c2442ad571db4
          Size/MD5:   767294 bc00b58c3681c18590009547f18336cd
          Size/MD5:   503276 a14eff2f06bb27794d833dbaf75d8b44
          Size/MD5:   287110 413802867fa40d58ce2516a15ee5eddb
          Size/MD5:    72692 3a7da95ceccf630f848a5d21a5668b87
          Size/MD5:   109612 145c7eb109bd6db6a4ab72e9404573da

  sparc architecture (Sun SPARC/UltraSPARC):

          Size/MD5:   997930 e66e47da37626d152551badccb7ac1f4
          Size/MD5:   805380 c8bb5f3b3f4b361e834c05164d511a8d
          Size/MD5:   545252 c693ceffe09ea224f4ee001185e98b91
          Size/MD5:   716952 50205e6d1b27cfa67e83a6f6f8701d0a
          Size/MD5:   489150 86200f8c28fd6283f0c5f4154dfb0328
          Size/MD5:   275216 bff2f3a9baec994dd6e019c16c37c209
          Size/MD5:    72680 666ce88f660ecba73382da8a3d37dc7a
          Size/MD5:   106206 c47cb31db761a9a86195c0f837b767cc

Updated packages for Ubuntu 10.04 LTS:

  Source archives:

          Size/MD5:   591770 df7f428f6af7d7ebfc11ac23c38b0024
          Size/MD5:     2366 acba988d337edf4318ba650e15017c1c
          Size/MD5:  2002790 25553818dca33df06f068cafb1e0e8e8

  Architecture independent packages:

          Size/MD5:   375862 8291a72cfbeb6d14c065e2eb2d67a750
          Size/MD5:     7954 5115aea53c21ba49b73734c0e3a2608d

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

          Size/MD5:  1011790 07938d1bfedd6e6f11ee458b61de27f7
          Size/MD5:   898474 19c125b885474e2a7d2ea165de579507
          Size/MD5:   598722 59e156f1e86d979734b27377e2e020e8
          Size/MD5:   802040 e28ff344a7d0247c54a4e9ceb8bb6291
          Size/MD5:   541326 4cceabf504235a1c9cdb6b6a00254f1a
          Size/MD5:   285934 29bbb7c743da27762c5972bae0c4c5af
          Size/MD5:    74474 dc8f965ec894ff5092215e7d754ae9dd
          Size/MD5:   111196 a1c2fab427ea0bd25241093f1a15ebf0

  i386 architecture (x86 compatible Intel/AMD):

          Size/MD5:  1008890 2e72d21bb6e0b9fb079df1f1822a9ee8
          Size/MD5:   854072 4184641c3d06d5ba85ee172ecad2aa51
          Size/MD5:   559582 009322a2a94f2ca287d024084ced51b1
          Size/MD5:   764342 7dea5246c20937e87d2da831d68fee88
          Size/MD5:   505134 4bc0b7b8852b8ec635194aaab4d5bf60
          Size/MD5:   280064 c3df0731987106ba8a2012e11d5454c2
          Size/MD5:    74480 5f11b48826c00dd5566b08a1505490b6
          Size/MD5:   106672 7d22ce1d8aa4b0179d098a6285a9a8e2

  armel architecture (ARM Architecture):

          Size/MD5:  1013732 be030b34d8119b01c42d49c3840e651a
          Size/MD5:   894666 86081015a1cd81beb9a0e2d39ac155bf
          Size/MD5:   557388 0a62aec590d6d7a3b15a6d5dbd29fc8c
          Size/MD5:   797534 92fba491963e17612dae8b58ff6ade9f
          Size/MD5:   502386 a333caa5bbbe5c11882990fa7ad4b4bc
          Size/MD5:   288450 24c973b4682d188cf9b714c803e464af
          Size/MD5:    74480 79113fed507af57fafa04c3833e1d53d
          Size/MD5:   107402 55d517599edcce2f06c6c5b710820398

  powerpc architecture (Apple Macintosh G3/G4/G5):

          Size/MD5:  1012826 1fecfafefd3244586a63d36fd5a2a604
          Size/MD5:   922240 93518619c1ee0171d6cba825a7d59532
          Size/MD5:   612284 4a8b9aba3a198a02a206bd5b125e25b2
          Size/MD5:   825180 f208f2af6be41c9c00f3fb10b2fc5f8e
          Size/MD5:   551274 7670b9b1c401c30b6cd0b3631daca3ab
          Size/MD5:   292842 24d8ae785065a2500ff9f22f7054980e
          Size/MD5:    74488 619ba8ce8968f984e460cc4492a5747d
          Size/MD5:   111766 efa2a55cb21e9a596cc7080f668375c8

  sparc architecture (Sun SPARC/UltraSPARC):

          Size/MD5:  1012658 ef23233e659e19246d3412bf5c412fb5
          Size/MD5:   865380 3f2a36d746feba8caed4380460941354
          Size/MD5:   615792 98bf1800bc99bd92d86951b77f1e4206
          Size/MD5:   773322 957ee588a5d48067b43670caa0594261
          Size/MD5:   556488 2dc718f0e74c2e10459764f220586bbb
          Size/MD5:   282140 963a76d65a8eb3624c6f91ac0a926f05
          Size/MD5:    74478 53a79e2a851c7dc638f8232cc6b3510e
          Size/MD5:   110404 7c3fd70cd645dcffcdc00a7ed67cf2e1

Updated packages for Ubuntu 10.10:

  Source archives:

          Size/MD5:   594242 cb239290ddc4eff90e9415591db41c45
          Size/MD5:     2366 4bca33740d17b8f37a94adc6599abbdc
          Size/MD5:  2009776 ef5f78399eb75b84ea453e8f8722e2d2

  Architecture independent packages:

          Size/MD5:   373366 23df39b93a2c98603e9b8d41c2b4cba3
          Size/MD5:     7792 76e4a9f1178867a3bfdbef37f2084586

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

          Size/MD5:  1013460 f256ba438e19c6978925d5ed4e18530e
          Size/MD5:   899634 408c366e52989bc00e0da64430f2f608
          Size/MD5:   598702 49fd46f6061a872ea8d6c608c28bd44b
          Size/MD5:   802790 32a135753bc9c071cbead4fddfa9dcad
          Size/MD5:   541842 7d3fb973e5d0054cb6e20a91a69727e9
          Size/MD5:   286552 c00170ab9236e554e4cc61b58c4e087b
          Size/MD5:    74814 7c083b54a7c180e92909c039076abace
          Size/MD5:   111134 ed8943b6536e57f14b65a3e87f56e16e

  i386 architecture (x86 compatible Intel/AMD):

          Size/MD5:  1014678 301c9a58ae2829f65a05b575683ed5db
          Size/MD5:   853306 1f01eee56031e82fac4c8eeae9c5c203
          Size/MD5:   558586 e3a896a724fa7e0a419b5291a2ec53da
          Size/MD5:   763116 049813e2ff746c9bf1ab98c992e96e36
          Size/MD5:   504372 ae9c5143fe1c6840669a52e8ac41e812
          Size/MD5:   281748 308aac2d4ddec502cb4b335130c1677c
          Size/MD5:    74818 9e09a390957b7cd80bd684fa864c1cc1
          Size/MD5:   106958 7f6a6f136de92eef27c9302b1335e948

  armel architecture (ARM Architecture):

          Size/MD5:  1014356 ea9dfa607810560c0f310ea3e5f5fea0
          Size/MD5:   904528 02638eae7ca3716ba0dc39fc4759b5c2
          Size/MD5:   595888 2e25aa8f18290400103a7df8fd4a8c9e
          Size/MD5:   806236 e48fff1b065fad30ccfee0e68504ace4
          Size/MD5:   536816 134137c290269eb3a399a483aaf86aae
          Size/MD5:   289224 20f69badce92deb001f6db075e2927a5
          Size/MD5:    74852 2755702f1cbdc7fea04443b835afdb0f
          Size/MD5:   109560 e9006584ac299250c0da9999b5a9d4e8

  powerpc architecture (Apple Macintosh G3/G4/G5):

          Size/MD5:  1014304 d753e2884e481df645bc533a48991fe3
          Size/MD5:   921472 b0a4daa151b80d1d998be18a237d403b
          Size/MD5:   610772 aded5ac3d9d1188c6656d2c237c48dc6
          Size/MD5:   825358 4bb3c12fbbb5c42ae206fc181818ef9f
          Size/MD5:   550514 1f421af95397981840f0c5a5d19d4db9
          Size/MD5:   293256 056ad7cf574e298a335437739863a7ff
          Size/MD5:    74816 a12873870098131de64ecd3d822ed776
          Size/MD5:   111772 982d5b986315c1ae1e0e949fe165dd8f