CVE-2008-2936 Postfix before 2.3.15, 2.4 before 2.4.8, 2.5 before 2.5.4, and 2.6 before 2.6-20080814, when the operating system supports hard links to symlinks, allows local users to append e-mail messages to a fil...
MediumCVSS 6.2
EPSS 1.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Postfix before 2.3.15, 2.4 before 2.4.8, 2.5 before 2.5.4, and 2.6 before 2.6-20080814, when the operating system supports hard links to symlinks, allows local users to append e-mail messages to a file to which a root-owned symlink points, by creating a hard link to this symlink and then sending a message. NOTE: this can be leveraged to gain privileges if there is a symlink to an init script.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| postfix | = 2.3.0 | No fix listed |
| postfix | = 2.3.1 | No fix listed |
| postfix | = 2.3.2 | No fix listed |
| postfix | = 2.3.3 | No fix listed |
| postfix | = 2.3.4 | No fix listed |
| postfix | = 2.3.5 | No fix listed |
| postfix | = 2.3.6 | No fix listed |
| postfix | = 2.3.7 | No fix listed |
| postfix | = 2.3.8 | No fix listed |
| postfix | = 2.3.9 | No fix listed |
| postfix | = 2.3.10 | No fix listed |
| postfix | = 2.3.11 | No fix listed |
| postfix | = 2.3.12 | No fix listed |
| postfix | = 2.3.13 | No fix listed |
| postfix | = 2.3.14 | No fix listed |
| postfix | = 2.4.0 | No fix listed |
| postfix | = 2.4.1 | No fix listed |
| postfix | = 2.4.2 | No fix listed |
| postfix | = 2.4.3 | No fix listed |
| postfix | = 2.4.4 | No fix listed |
| postfix | = 2.4.5 | No fix listed |
| postfix | = 2.4.6 | No fix listed |
| postfix | = 2.4.7 | No fix listed |
| postfix | = 2.5.0 | No fix listed |
| postfix | = 2.5.1 | No fix listed |
Show 6 more
| Product | Affected versions | Fixed in |
|---|---|---|
| postfix | = 2.5.2 | No fix listed |
| postfix | = 2.5.3 | No fix listed |
| postfix | = 2.6.0 | No fix listed |
| debian/postfix(Debian:12) | < 2.5.4-1 | 2.5.4-1 |
| debian/postfix(Debian:13) | < 2.5.4-1 | 2.5.4-1 |
| debian/postfix(Debian:14) | < 2.5.4-1 | 2.5.4-1 |
References
- Debian Security Tracker CVE-2008-2936 vendor-advisory
- [postfix-announce] 20080814 Postfix local privilege escalation via hardlinked symlinks mailing-list
- SUSE-SA:2008:040 vendor-advisory
- 31469 third-party-advisory
- 31474 third-party-advisory
- 31477 third-party-advisory
- 31485 third-party-advisory vendor-advisory
- 31500 third-party-advisory vendor-advisory
- 31530 third-party-advisory
- 32231 third-party-advisory
- GLSA-200808-12 vendor-advisory
- 4160 third-party-advisory
- wiki.rpath.com
- DSA-1629 vendor-advisory
- VU#938323 third-party-advisory us-government-resource
- MDVSA-2008:171 vendor-advisory
- RHSA-2008:0839 vendor-advisory
- 20080814 Postfix local privilege escalation via hardlinked symlinks mailing-list
- 20080821 rPSA-2008-0259-1 postfix mailing-list
- 20080831 PoCfix (PoC for Postfix local root vuln - CVE-2008-2936) mailing-list
- 30691 patch vdb-entry
- 1020700 vdb-entry
- ADV-2008-2385 vdb-entry
- postfix-symlink-code-execution(44460) vdb-entry
- issues.rpath.com
- oval:org.mitre.oval:def:10033 signature vdb-entry
- USN-636-1 vendor-advisory
- 6337 exploit
- FEDORA-2008-8595 vendor-advisory
- FEDORA-2008-8593 vendor-advisory