No further details available just yet. openSUSE only.

bugbot adjusting priority

https://lists.exim.org/lurker/message/20160302.191005.a72d8433.en.html

Security fix for CVE-2016-1531
==============================

All installations having Exim set-uid root and using 'perl_startup' are
vulnerable to a local privilege escalation. Any user who can start an
instance of Exim (and this is normally *any* user) can gain root
privileges.

New options
-----------

We had to introduce two new configuration options:

    keep_environment =
    add_environment =

Both options are empty per default. That is, Exim cleans the complete
environment on startup. This affects Exim itself and any subprocesses,
as transports, that may call other programs via some alias mechanisms,
as routers (queryprogram), lookups, and so on.

** THIS MAY BREAK your existing installation **

If both options are not used in the configuration, Exim issues a warning
on startup. This warning disappears if at least one of these options is
used (even if set to an empty value).

keep_environment should contain a list of trusted environment variables.
(Do you trust PATH?). This may be a list of names and REs.

    keep_environment = ^LDAP_ : FOO_PATH

To add (or override) variables, you can use add_environment:

    add_environment = <; PATH=/sbin:/usr/sbin


New behaviour
-------------

Now Exim changes it's working directory to / right after startup,
even before reading it's configuration. (Later Exim changes it's working
directory to $spool_directory, as usual.)

Exim only accepts an absolute configuration file path now, when using
the -C option.




Fixed in:

    Version             Git tag
    ---------------------------------
    Exim 4.84.2         exim-4_84_2
    Exim 4.85.2         exim-4_85_2
    Exim 4.86.2         exim-4_86_2
    Exim 4.87 RC 5      exim-4_87_RC5



https://github.com/Exim/exim/commit/bc3c7bb7d4aba3e563434e5627fe1f2176aa18c0

CVSSv2 6.8 (AV:L/AC:L/Au:S/C:C/I:C/A:C)

openSUSE is affected:
> %verify(not mode) %attr(4755,root,root) /usr/sbin/exim

Fixes are ready and come in the next hour.

https://build.opensuse.org/request/show/364994  openSUSE Leap 42.1 + 13.2
https://build.opensuse.org/request/show/364997  openSUSE Tumbleweed

Given the behavioral changes, do you think that standard setups will experience breakage upon update?

Which instructions should we give them, and is there anything in the configuration and scripts that we ship that needs to be adjusted?

https://build.opensuse.org/request/show/365214  openSUSE Leap 42.1 + 13.2
https://build.opensuse.org/request/show/365211  openSUSE Tumbleweed

(In reply to Andreas Stieger from comment #7)
> Given the behavioral changes, do you think that standard setups will
> experience breakage upon update?

It might still work without further interaction.

> Which instructions should we give them, and is there anything in the
> configuration and scripts that we ship that needs to be adjusted?

Heiko Schlittermann <hs () schlittermann de> wrote:

### partial quote start

New options
-----------

We had to introduce two new configuration options:

    keep_environment =
    add_environment =

Both options are empty per default. That is, Exim cleans the complete
environment on startup. This affects Exim itself and any subprocesses,
as transports, that may call other programs via some alias mechanisms,
as routers (queryprogram), lookups, and so on. This may affect used
libraries (e.g. LDAP).

** THIS MAY BREAK your existing installation **

If both options are not used in the configuration, Exim issues a warning
on startup. This warning disappears if at least one of these options is
used (even if set to an empty value).

keep_environment should contain a list of trusted environment variables.
(Do you trust PATH?). This may be a list of names and REs.

    keep_environment = ^LDAP_ : FOO_PATH

To add (or override) variables, you can use add_environment:

    add_environment = <; PATH=/sbin:/usr/sbin

### partial quote end

See also for example http://seclists.org/oss-sec/2016/q1/501

openSUSE-SU-2016:0721-1: An update that fixes one vulnerability is now available.

Category: security (important)
Bug References: 968844
CVE References: CVE-2016-1531
Sources used:
openSUSE Leap 42.1 (src):    exim-4.86.2-8.1
openSUSE 13.2 (src):    exim-4.86.2-3.10.1

closing