# Debian exim4 security patch

**URL:** <https://community.unix.com/t/debian-exim4-security-patch/279404>\
**Category:** Debian\
**Created:** [December 17, 2010, 11:18am UTC](https://community.unix.com/t/debian-exim4-security-patch/279404 "2010-12-17T11:18:38Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![KevinGB](https://community.unix.com/letter_avatar/kevingb/32/6_449c533f586939b6e5f246632a46421f.png) [@KevinGB](https://community.unix.com/u/KevinGB)\
**Post date:** [December 17, 2010, 11:18am UTC](https://community.unix.com/t/debian-exim4-security-patch/279404/1 "2010-12-17T11:18:38Z")

</div>

I have just had to fix a debian5 system which suddenly started rejecting correctly addressed emails as '550 relay not permitted.' It turned out that rogue exim4 config files had been injected into the system at /etc/exim4/exim4.conf and /etc/exim4/exim.conf and these were messing up mail routing.

The system had been compromised similar to this description: [Details of the root kit that got installed on my Debian Lenny boxes due to the exim remote root exploit : netsec](http://www.reddit.com/r/netsec/comments/en650/details_of_the_root_kit_that_got_installed_on_my/)

I also found a few strange processes running which were started around the same time as the problem started. Note that you must restore a valid version of ps (see the link) before you use it to look for rogue processes.

The security patch is described here: [[SECURITY] [DSA-2131-1] New exim4 packages fix remote code execution](http://lists.debian.org/debian-security-announce/2010/msg00181.html)

I strongly recommed that you apply this patch if it applies to you.