Re: [exim] Security release for CVE-2016-1531: 4.84.2, 4.85.…

Startseite
Nachricht löschen
Nachricht beantworten
Autor: Jeremy Harris
Datum:  
To: exim-users
Betreff: Re: [exim] Security release for CVE-2016-1531: 4.84.2, 4.85.2, 4.86.2, 4.87 RC5
On 09/03/16 17:07, Cyborg wrote:
> The question is, who stops the attacker from loading a config he likes
> directly into exim WITH the new vars set ?


The config filename is compiled-in, or the filename carrying permitted
config file names is compiled-in. Also the config file must be owned
by root or a user that is compiled-in, and not world-writable.

See Chapter 6, first few paragraphs.
--
Cheers,
Jeremy