CVE-2010-4345

Exim mail server versions 4.72 and earlier allow local users to become the 'exim' system user and gain higher privileges by creating a custom configuration file that executes arbitrary commands. This is dangerous because attackers with local access can run malicious code with elevated permissions.

Local privilege escalation in Exim 4.72 and earlier via configuration file injection; the exim process permits unprivileged users to specify alternate configuration files (e.g., via spool_directory directive) that execute arbitrary shell commands with exim user privileges. Requires local system access and ability to create/modify configuration files.