No nie wiem, czy dotyczy to tylko debiana. W ostatnim changelog'u jest coś na ten temat:
PP/04 CVE-2011-0017 - check return value of setuid/setgid. This is a
privilege escalation vulnerability whereby the Exim run-time user
can cause root to append content of the attacker's choosing to
arbitrary files.
DW/22 Bugzilla 1044: CVE-2010-4345 - partial fix: restrict default behaviour
of CONFIGURE_OWNER and CONFIGURE_GROUP options to no longer allow a
configuration file which is writeable by the Exim user or group.
DW/23 Bugzilla 1044: CVE-2010-4345 - part two: extend checks for writeability
of configuration files to cover files specified with the -C option if
they are going to be used with root privileges, not just the default
configuration file.
DW/24 Bugzilla 1044: CVE-2010-4345 - part three: remove ALT_CONFIG_ROOT_ONLY
option (effectively making it always true).
DW/25 Add TRUSTED_CONFIG_PREFIX_FILE option to allow alternative configuration
files to be used while preserving root privileges.
PP/27 Bugzilla 1047: change the default for system_filter_user to be the Exim
run-time user, instead of root.
PP/28 Add WHITELIST_D_MACROS option to let some macros be overriden by the
Exim run-time user without dropping privileges.
DW/30 Allow TRUSTED_CONFIG_PREFIX_FILE only for Exim or CONFIGURE_OWNER, not
for other users. Others should always drop root privileges if they use
-C on the command line, even for a whitelisted configure file.
DW/31 Turn TRUSTED_CONFIG_PREFIX_FILE into TRUSTED_CONFIG_FILE. No prefixes.
Możliwe, że powyższe zabezpieczenia można wprowadzić we wcześniejszych wersjach exima odpowiednio go konfigurując/kompilując, ale tego pewien nie jestem.
Źródło:
ftp://ftp.exim.org/pub/exim/ChangeLogs/ChangeLog-4.74
Zgłoszenie problemu i dyskusja na ten temat:
http://www.exim.org/lurker/message/20101207.215955.bb32d4f2.en.html