National Cyber Awareness System

Vulnerability Summary for CVE-2008-2936

Overview

Postfix before 2.3.15, 2.4 before 2.4.8, 2.5 before 2.5.4, and 2.6 before 2.6-20080814, when the operating system supports hard links to symlinks, allows local users to append e-mail messages to a file to which a root-owned symlink points, by creating a hard link to this symlink and then sending a message. NOTE: this can be leveraged to gain privileges if there is a symlink to an init script.

Description

Please refer to the following links for additional version information (vendor release notes): Postfix 2.3 - ftp://mirrors.loonybin.net/pub/postfix/official/postfix-2.3.15.RELEASE_NOTES Postfix 2.4 - ftp://mirrors.loonybin.net/pub/postfix/official/postfix-2.4.8.RELEASE_NOTES Postfix 2.5 - ftp://mirrors.loonybin.net/pub/postfix/official/postfix-2.5.4.RELEASE_NOTES Postfix 2.6 - ftp://mirrors.loonybin.net/pub/postfix/experimental/postfix-2.6-20080814.RELEASE_NOTES

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

US-CERT Vulnerability Note: VU#938323

Name: VU#938323

Hyperlink:http://www.kb.cert.org/vuls/id/938323

External Source: BID

Name: 30691

Type: Patch Information

Hyperlink:http://www.securityfocus.com/bid/30691

External Source: FEDORA

Name: FEDORA-2008-8593

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00287.html

External Source: FEDORA

Name: FEDORA-2008-8595

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00271.html

External Source: CONFIRM

Name: https://issues.rpath.com/browse/RPL-2689

Hyperlink:https://issues.rpath.com/browse/RPL-2689

External Source: XF

Name: postfix-symlink-code-execution(44460)

Hyperlink:http://xforce.iss.net/xforce/xfdb/44460

External Source: VUPEN

Name: ADV-2008-2385

Hyperlink:http://www.vupen.com/english/advisories/2008/2385

External Source: UBUNTU

Name: USN-636-1

Hyperlink:http://www.ubuntulinux.org/support/documentation/usn/usn-636-1

External Source: SECTRACK

Name: 1020700

Hyperlink:http://www.securitytracker.com/id?1020700

External Source: BUGTRAQ

Name: 20080831 PoCfix (PoC for Postfix local root vuln - CVE-2008-2936)

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/495882/100/0/threaded

External Source: BUGTRAQ

Name: 20080821 rPSA-2008-0259-1 postfix

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/495632/100/0/threaded

External Source: BUGTRAQ

Name: 20080814 Postfix local privilege escalation via hardlinked symlinks

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/495474/100/0/threaded

External Source: REDHAT

Name: RHSA-2008:0839

Hyperlink:http://www.redhat.com/support/errata/RHSA-2008-0839.html

External Source: MILW0RM

Name: 6337

Hyperlink:http://www.milw0rm.com/exploits/6337

External Source: MANDRIVA

Name: MDVSA-2008:171

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2008:171

External Source: DEBIAN

Name: DSA-1629

Hyperlink:http://www.debian.org/security/2008/dsa-1629

External Source: CONFIRM

Name: http://wiki.rpath.com/Advisories:rPSA-2008-0259

Hyperlink:http://wiki.rpath.com/Advisories:rPSA-2008-0259

External Source: SREASON

Name: 4160

Hyperlink:http://securityreason.com/securityalert/4160

External Source: GENTOO

Name: GLSA-200808-12

Hyperlink:http://security.gentoo.org/glsa/glsa-200808-12.xml

External Source: SECUNIA

Name: 32231

Hyperlink:http://secunia.com/advisories/32231

External Source: SECUNIA

Name: 31530

Hyperlink:http://secunia.com/advisories/31530

External Source: SECUNIA

Name: 31500

Type: Advisory

Hyperlink:http://secunia.com/advisories/31500

External Source: SECUNIA

Name: 31485

Type: Advisory

Hyperlink:http://secunia.com/advisories/31485

External Source: SECUNIA

Name: 31477

Hyperlink:http://secunia.com/advisories/31477

External Source: SECUNIA

Name: 31474

Hyperlink:http://secunia.com/advisories/31474

External Source: SECUNIA

Name: 31469

Hyperlink:http://secunia.com/advisories/31469

External Source: OVAL

Name: oval:org.mitre.oval:def:10033

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10033

External Source: SUSE

Name: SUSE-SA:2008:040

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00002.html

External Source: MLIST

Name: [postfix-announce] 20080814 Postfix local privilege escalation via hardlinked symlinks

Hyperlink:http://article.gmane.org/gmane.mail.postfix.announce/110

External Source: CONFIRM

Name: ftp://ftp.porcupine.org/mirrors/postfix-release/official/postfix-2.5.4.HISTORY

Hyperlink:ftp://ftp.porcupine.org/mirrors/postfix-release/official/postfix-2.5.4.HISTORY

External Source: CONFIRM

Name: ftp://ftp.porcupine.org/mirrors/postfix-release/official/postfix-2.4.8.HISTORY

Hyperlink:ftp://ftp.porcupine.org/mirrors/postfix-release/official/postfix-2.4.8.HISTORY

External Source: CONFIRM

Name: ftp://ftp.porcupine.org/mirrors/postfix-release/official/postfix-2.3.15.HISTORY

Hyperlink:ftp://ftp.porcupine.org/mirrors/postfix-release/official/postfix-2.3.15.HISTORY

External Source: CONFIRM

Name: ftp://ftp.porcupine.org/mirrors/postfix-release/experimental/postfix-2.6-20080814.HISTORY

Hyperlink:ftp://ftp.porcupine.org/mirrors/postfix-release/experimental/postfix-2.6-20080814.HISTORY

References to Check Content

Identifier:oval:org.mitre.oval:def:10033

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:10033