CVE-2008-2937 Postfix 2.5 before 2.5.4 and 2.6 before 2.6-20080814 delivers to a mailbox file even when this file is not owned by the recipient, which allows local users to read e-mail messages by creating a mailbo...
LowCVSS 1.9
EPSS 0.36%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Postfix 2.5 before 2.5.4 and 2.6 before 2.6-20080814 delivers to a mailbox file even when this file is not owned by the recipient, which allows local users to read e-mail messages by creating a mailbox file corresponding to another user's account name.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| postfix | = 2.5.0 | No fix listed |
| postfix | = 2.5.1 | No fix listed |
| postfix | = 2.5.2 | No fix listed |
| postfix | = 2.5.3 | No fix listed |
| postfix | = 2.6.0 | No fix listed |
| debian/postfix(Debian:12) | < 2.5.4-1 | 2.5.4-1 |
| debian/postfix(Debian:13) | < 2.5.4-1 | 2.5.4-1 |
| debian/postfix(Debian:14) | < 2.5.4-1 | 2.5.4-1 |
References
- kb.juniper.net
- SUSE-SA:2008:040 vendor-advisory
- 31477 third-party-advisory
- 31485 third-party-advisory vendor-advisory
- 31500 patch third-party-advisory vendor-advisory
- 32231 third-party-advisory
- GLSA-200808-12 vendor-advisory
- wiki.rpath.com
- MDVSA-2009:224 vendor-advisory
- RHSA-2011:0422 vendor-advisory
- 20080821 rPSA-2008-0259-1 postfix mailing-list
- 30691 patch vdb-entry
- ADV-2008-2385 vdb-entry
- postfix-email-information-disclosure(44461) vdb-entry
- issues.rpath.com
- FEDORA-2008-8595 vendor-advisory
- FEDORA-2008-8593 vendor-advisory
- Debian Security Tracker CVE-2008-2937 vendor-advisory