CVE-2020-8015: 
Exim vulnerability analysis and mitigation

CVE-2020-8015 is a UNIX Symbolic Link (Symlink) Following vulnerability discovered in the packaging of exim in openSUSE Factory. The vulnerability was identified in the post-installation script of the exim package, which allows local attackers to escalate privileges from user mail to root (NVD).

The vulnerability exists in the %post installation script of the exim package, specifically in the log file creation process. The script contains a race condition in lines 402-405 where it creates logfiles if missing. The vulnerability can be exploited using inotify to watch the log directory and change the file after the touch command to a symlink. This makes the exploitation reliable and relatively easy to accomplish (SUSE Bugzilla).

The successful exploitation of this vulnerability allows local attackers to escalate privileges from the mail user to root, potentially gaining complete system access. This could lead to unauthorized access to sensitive system files, including the shadow password file (SUSE Bugzilla).

The issue has been fixed by removing the problematic log file creation loop in the post-installation script, as exim can create these files automatically with the correct permissions. The fix was released in openSUSE Security Update openSUSE-SU-2020:0491-1 (OpenSUSE Security).