Executive Summary
| Informations | |||
|---|---|---|---|
| Name | CVE-2008-2936 | First vendor Publication | 2008-08-18 |
| Vendor | Cve | Last vendor Modification | 2024-11-21 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:L/AC:H/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 6.2 | Attack Range | Local |
| Cvss Impact Score | 10 | Attack Complexity | High |
| Cvss Expoit Score | 1.9 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Postfix before 2.3.15, 2.4 before 2.4.8, 2.5 before 2.5.4, and 2.6 before 2.6-20080814, when the operating system supports hard links to symlinks, allows local users to append e-mail messages to a file to which a root-owned symlink points, by creating a hard link to this symlink and then sending a message. NOTE: this can be leveraged to gain privileges if there is a symlink to an init script. |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2936 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-264 | Permissions, Privileges, and Access Controls |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:10033 | |||
| Oval ID: | oval:org.mitre.oval:def:10033 | ||
| Title: | Postfix before 2.3.15, 2.4 before 2.4.8, 2.5 before 2.5.4, and 2.6 before 2.6-20080814, when the operating system supports hard links to symlinks, allows local users to append e-mail messages to a file to which a root-owned symlink points, by creating a hard link to this symlink and then sending a message. NOTE: this can be leveraged to gain privileges if there is a symlink to an init script. | ||
| Description: | Postfix before 2.3.15, 2.4 before 2.4.8, 2.5 before 2.5.4, and 2.6 before 2.6-20080814, when the operating system supports hard links to symlinks, allows local users to append e-mail messages to a file to which a root-owned symlink points, by creating a hard link to this symlink and then sending a message. NOTE: this can be leveraged to gain privileges if there is a symlink to an init script. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2008-2936 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:17428 | |||
| Oval ID: | oval:org.mitre.oval:def:17428 | ||
| Title: | USN-636-1 -- postfix vulnerability | ||
| Description: | Sebastian Krahmer discovered that Postfix was not correctly handling mailbox ownership when dealing with Linux's implementation of hardlinking to symlinks. | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-636-1 CVE-2008-2936 | Version: | 7 |
| Platform(s): | Ubuntu 6.06 Ubuntu 7.04 Ubuntu 7.10 Ubuntu 8.04 | Product(s): | postfix |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:18596 | |||
| Oval ID: | oval:org.mitre.oval:def:18596 | ||
| Title: | DSA-1629-1 postfix - privilege escalation | ||
| Description: | Sebastian Krahmer discovered that Postfix, a mail transfer agent, incorrectly checks the ownership of a mailbox. In some configurations, this allows for appending data to arbitrary files as root. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1629-1 CVE-2008-2936 | Version: | 7 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | postfix |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:20269 | |||
| Oval ID: | oval:org.mitre.oval:def:20269 | ||
| Title: | DSA-1629-2 postfix - privilege escalation | ||
| Description: | Sebastian Krahmer discovered that Postfix, a mail transfer agent, incorrectly checks the ownership of a mailbox. In some configurations, this allows for appending data to arbitrary files as root. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1629-2 CVE-2008-2936 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | postfix |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:22549 | |||
| Oval ID: | oval:org.mitre.oval:def:22549 | ||
| Title: | ELSA-2008:0839: postfix security update (Moderate) | ||
| Description: | Postfix before 2.3.15, 2.4 before 2.4.8, 2.5 before 2.5.4, and 2.6 before 2.6-20080814, when the operating system supports hard links to symlinks, allows local users to append e-mail messages to a file to which a root-owned symlink points, by creating a hard link to this symlink and then sending a message. NOTE: this can be leveraged to gain privileges if there is a symlink to an init script. | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2008:0839-01 CVE-2008-2936 | Version: | 6 |
| Platform(s): | Oracle Linux 5 | Product(s): | postfix |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:28256 | |||
| Oval ID: | oval:org.mitre.oval:def:28256 | ||
| Title: | RHSA-2008:0839 -- postfix security update (Moderate) | ||
| Description: | Updated postfix packages that fix a security issue are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Postfix is a Mail Transport Agent (MTA), supporting LDAP, SMTP AUTH (SASL), and TLS. A flaw was found in the way Postfix dereferences symbolic links. If a local user has write access to a mail spool directory with no root mailbox, it may be possible for them to append arbitrary data to files that root has write permission to. (CVE-2008-2936) Red Hat would like to thank Sebastian Krahmer for responsibly disclosing this issue. All users of postfix should upgrade to these updated packages, which contain a backported patch that resolves this issue. | ||
| Family: | unix | Class: | patch |
| Reference(s): | RHSA-2008:0839 CESA-2008:0839-CentOS 3 CESA-2008:0839-CentOS 5 CVE-2008-2936 | Version: | 3 |
| Platform(s): | Red Hat Enterprise Linux 3 Red Hat Enterprise Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 3 CentOS Linux 5 | Product(s): | postfix |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:7819 | |||
| Oval ID: | oval:org.mitre.oval:def:7819 | ||
| Title: | DSA-1629 postfix -- programming error | ||
| Description: | Sebastian Krahmer discovered that Postfix, a mail transfer agent, incorrectly checks the ownership of a mailbox. In some configurations, this allows for appending data to arbitrary files as root. Note that only specific configurations are vulnerable; the default Debian installation is not affected. Only a configuration meeting the following requirements is vulnerable: For a detailed treating of the issue, please refer to the upstream author's announcement. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1629 CVE-2008-2936 | Version: | 3 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | postfix |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
ExploitDB Exploits
| id | Description |
|---|---|
| 2008-08-31 | Postfix <= 2.6-20080814 - (symlink) Local Privilege Escalation Exploit |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-10-13 | Name : SLES10: Security update for Postfix File : nvt/sles10_postfix.nasl |
| 2009-10-10 | Name : SLES9: Security update for Postfix File : nvt/sles9p5032740.nasl |
| 2009-04-09 | Name : Mandriva Update for postfix MDVSA-2008:171 (postfix) File : nvt/gb_mandriva_MDVSA_2008_171.nasl |
| 2009-03-23 | Name : Ubuntu Update for postfix vulnerability USN-636-1 File : nvt/gb_ubuntu_USN_636_1.nasl |
| 2009-03-06 | Name : RedHat Update for postfix RHSA-2008:0839-01 File : nvt/gb_RHSA-2008_0839-01_postfix.nasl |
| 2009-02-27 | Name : CentOS Update for postfix CESA-2008:0839 centos3 i386 File : nvt/gb_CESA-2008_0839_postfix_centos3_i386.nasl |
| 2009-02-27 | Name : CentOS Update for postfix CESA-2008:0839 centos3 x86_64 File : nvt/gb_CESA-2008_0839_postfix_centos3_x86_64.nasl |
| 2009-02-17 | Name : Fedora Update for postfix FEDORA-2008-8593 File : nvt/gb_fedora_2008_8593_postfix_fc9.nasl |
| 2009-02-17 | Name : Fedora Update for postfix FEDORA-2008-8595 File : nvt/gb_fedora_2008_8595_postfix_fc8.nasl |
| 2009-01-23 | Name : SuSE Update for postfix SUSE-SA:2008:040 File : nvt/gb_suse_2008_040.nasl |
| 2008-09-24 | Name : Gentoo Security Advisory GLSA 200808-12 (postfix) File : nvt/glsa_200808_12.nasl |
| 2008-09-04 | Name : Debian Security Advisory DSA 1629-1 (postfix) File : nvt/deb_1629_1.nasl |
| 2008-09-04 | Name : Debian Security Advisory DSA 1629-2 (postfix) File : nvt/deb_1629_2.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 47658 | Postfix Hardlink to Symlink Mailspool Arbitrary Content Append |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2008-0839.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20080814_postfix_on_SL3_x.nasl - Type : ACT_GATHER_INFO |
| 2009-09-24 | Name : The remote SuSE 9 host is missing a security-related patch. File : suse9_12219.nasl - Type : ACT_GATHER_INFO |
| 2009-07-21 | Name : The remote openSUSE host is missing a security update. File : suse_11_0_postfix-080804.nasl - Type : ACT_GATHER_INFO |
| 2009-04-23 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2008-171.nasl - Type : ACT_GATHER_INFO |
| 2008-10-10 | Name : The remote Fedora host is missing a security update. File : fedora_2008-8593.nasl - Type : ACT_GATHER_INFO |
| 2008-10-10 | Name : The remote Fedora host is missing a security update. File : fedora_2008-8595.nasl - Type : ACT_GATHER_INFO |
| 2008-08-20 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-636-1.nasl - Type : ACT_GATHER_INFO |
| 2008-08-19 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1629.nasl - Type : ACT_GATHER_INFO |
| 2008-08-15 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2008-0839.nasl - Type : ACT_GATHER_INFO |
| 2008-08-15 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200808-12.nasl - Type : ACT_GATHER_INFO |
| 2008-08-15 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2008-0839.nasl - Type : ACT_GATHER_INFO |
| 2008-08-15 | Name : The remote openSUSE host is missing a security update. File : suse_postfix-5501.nasl - Type : ACT_GATHER_INFO |
| 2008-08-14 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_postfix-5500.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2024-11-28 23:13:40 |
|
| 2024-11-28 12:15:55 |
|
| 2023-11-07 21:47:49 |
|
| 2023-02-13 09:29:23 |
|
| 2021-05-04 12:07:40 |
|
| 2021-04-22 01:08:03 |
|
| 2020-05-23 00:21:53 |
|
| 2018-10-12 00:20:23 |
|
| 2018-10-04 00:19:32 |
|
| 2017-09-29 09:23:36 |
|
| 2017-08-08 09:24:12 |
|
| 2016-04-26 17:35:11 |
|
| 2014-02-17 10:45:32 |
|
| 2013-05-11 00:20:26 |
|
