6.2 - VU#938323

Executive Summary

Summary
Title	Postfix local privilege escalation

Informations
Name	VU#938323	First vendor Publication	2008-08-18
Vendor	VU-CERT	Last vendor Modification	2008-08-19
Severity (Vendor)	N/A	Revision	M

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:L/AC:H/Au:N/C:C/I:C/A:C)
Cvss Base Score	6.2	Attack Range	Local
Cvss Impact Score	10	Attack Complexity	High
Cvss Expoit Score	1.9	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Vulnerability Note VU#938323

Postfix local privilege escalation

Overview

The Postfix MTA contains a local privilege escalation vulnerability.

I. Description

Postfix is an mail transport agent (MTA) that is used by several Unix-like operating systems. Symbolic links and hard links are types of files that reference other files. Unlike hard links, symbolic links can point to directories and use relative pathnames.

On some non-POSIX.1-2001 and X/Open XPG4v2 compliant systems, users can hardlink symlinks which are owned by the root user. Postfix allows root-owned symlinks to be used as a mail destination folder. A hard link to a Postfix root-owned symlink could point to a file that can be overwritten by Postfix, regardless of the permissions of the destination file.

II. Impact

A local, authenticated attacker may be able to overwrite arbitrary files, possibly gaining elevated privileges.

III. Solution

Upgrade

See http://article.gmane.org/gmane.mail.postfix.announce/110 for information about obtaining updated software. Users who do not compile Postfix from source should see the systems affected section below for a partial list of affected vendors.

Set mailbox permissions

Making the system mail spool directory root-owned may mitigate this vulnerability. See http://article.gmane.org/gmane.mail.postfix.announce/110 for specific information about this and other workarounds.

Systems Affected

Vendor	Status	Date Updated
Apple Computer, Inc.	Unknown	19-Aug-2008
Conectiva Inc.	Unknown	1-Aug-2008
Cray Inc.	Unknown	1-Aug-2008
Debian GNU/Linux	Unknown	1-Aug-2008
DragonFly BSD Project	Not Vulnerable	2-Aug-2008
EMC Corporation	Unknown	1-Aug-2008
Engarde Secure Linux	Unknown	1-Aug-2008
F5 Networks, Inc.	Unknown	1-Aug-2008
Fedora Project	Unknown	1-Aug-2008
FreeBSD, Inc.	Unknown	1-Aug-2008
Fujitsu	Unknown	1-Aug-2008
Gentoo Linux	Vulnerable	18-Aug-2008
Hewlett-Packard Company	Unknown	1-Aug-2008
Hitachi	Unknown	1-Aug-2008
IBM Corporation	Unknown	1-Aug-2008
IBM Corporation (zseries)	Unknown	1-Aug-2008
IBM eServer	Unknown	1-Aug-2008
Ingrian Networks, Inc.	Unknown	1-Aug-2008
Juniper Networks, Inc.	Unknown	1-Aug-2008
Mandriva, Inc.	Vulnerable	18-Aug-2008
Microsoft Corporation	Unknown	1-Aug-2008
MontaVista Software, Inc.	Unknown	1-Aug-2008
NEC Corporation	Unknown	1-Aug-2008
NetBSD	Unknown	1-Aug-2008
Nokia	Unknown	1-Aug-2008
Novell, Inc.	Unknown	1-Aug-2008
Openwall GNU/*/Linux	Unknown	1-Aug-2008
QNX, Software Systems, Inc.	Unknown	1-Aug-2008
Red Hat, Inc.	Unknown	1-Aug-2008
Silicon Graphics, Inc.	Unknown	1-Aug-2008
Slackware Linux Inc.	Unknown	1-Aug-2008
Sony Corporation	Unknown	1-Aug-2008
Sun Microsystems, Inc.	Not Vulnerable	19-Aug-2008
SUSE Linux	Vulnerable	18-Aug-2008
The SCO Group	Unknown	1-Aug-2008
Turbolinux	Unknown	1-Aug-2008
Ubuntu	Vulnerable	19-Aug-2008
Unisys	Unknown	1-Aug-2008
Wind River Systems, Inc.	Unknown	1-Aug-2008

References

ftp://ftp.porcupine.org/mirrors/postfix-release/index/html
http://article.gmane.org/gmane.mail.postfix.announce/110
http://linuxgazette.net/105/pitcher.html
http://en.wikipedia.org/wiki/Hard_links
http://en.wikipedia.org/wiki/Symbolic_link

Credit

Thanks to Wietse Venema for information that was used in this report. Sebastian Krahmer of SuSE is credited for discovering and reporting this issue.

This document was written by Ryan Giobbi.

Other Information

Date Public	08/18/2008
Date First Published	08/18/2008 03:52:50 PM
Date Last Updated	08/19/2008
CERT Advisory
CVE-ID(s)	CVE-2008-2936
NVD-ID(s)	CVE-2008-2936
US-CERT Technical Alerts
Metric	4.20
Document Revision	20

Original Source

Url : http://www.kb.cert.org/vuls/id/938323

CWE : Common Weakness Enumeration

%	Id	Name
100 %	CWE-264	Permissions, Privileges, and Access Controls

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:10033

Oval ID:	oval:org.mitre.oval:def:10033
Title:	Postfix before 2.3.15, 2.4 before 2.4.8, 2.5 before 2.5.4, and 2.6 before 2.6-20080814, when the operating system supports hard links to symlinks, allows local users to append e-mail messages to a file to which a root-owned symlink points, by creating a hard link to this symlink and then sending a message. NOTE: this can be leveraged to gain privileges if there is a symlink to an init script.
Description:	Postfix before 2.3.15, 2.4 before 2.4.8, 2.5 before 2.5.4, and 2.6 before 2.6-20080814, when the operating system supports hard links to symlinks, allows local users to append e-mail messages to a file to which a root-owned symlink points, by creating a hard link to this symlink and then sending a message. NOTE: this can be leveraged to gain privileges if there is a symlink to an init script.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2008-2936	Version:	5
Platform(s):	Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
OS Section: RHEL3, CentOS3 RHEL3 or CentOS3 The operating system installed on the system is Red Hat Enterprise Linux 3 AND CentOS Linux 3.x AND postfix is earlier than 2:2.0.16-14.1.RHEL3 OR OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section postfix-pflogsumm is earlier than 2:2.2.10-1.2.1.el4_7 AND postfix is earlier than 2:2.2.10-1.2.1.el4_7 OR OS Section: RHEL5, CentOS5, Oracle Linux 5 RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section postfix-pflogsumm is earlier than 2:2.3.3-2.1.el5_2 AND postfix is earlier than 2:2.3.3-2.1.el5_2

Definition Id: oval:org.mitre.oval:def:17428

Oval ID:	oval:org.mitre.oval:def:17428
Title:	USN-636-1 -- postfix vulnerability
Description:	Sebastian Krahmer discovered that Postfix was not correctly handling mailbox ownership when dealing with Linux's implementation of hardlinking to symlinks.
Family:	unix	Class:	patch
Reference(s):	USN-636-1 CVE-2008-2936	Version:	7
Platform(s):	Ubuntu 6.06 Ubuntu 7.04 Ubuntu 7.10 Ubuntu 8.04	Product(s):	postfix
Definition Synopsis:
Release section Ubuntu 6.06 is installed AND postfix DPKG is earlier than 2.2.10-1ubuntu0.2 AND Release section Ubuntu 7.04 is installed AND postfix DPKG is earlier than 2.3.8-2ubuntu0.2 AND Release section Ubuntu 7.10 is installed AND postfix DPKG is earlier than 2.4.5-3ubuntu1.2 AND Release section Ubuntu 8.04 is installed AND postfix DPKG is earlier than 2.5.1-2ubuntu1.1

Definition Id: oval:org.mitre.oval:def:18596

Oval ID:	oval:org.mitre.oval:def:18596
Title:	DSA-1629-1 postfix - privilege escalation
Description:	Sebastian Krahmer discovered that Postfix, a mail transfer agent, incorrectly checks the ownership of a mailbox. In some configurations, this allows for appending data to arbitrary files as root.
Family:	unix	Class:	patch
Reference(s):	DSA-1629-1 CVE-2008-2936	Version:	7
Platform(s):	Debian GNU/Linux 4.0	Product(s):	postfix
Definition Synopsis:
Debian GNU/Linux 4.0 is installed. AND postfix DPKG is earlier than 2.3.8-2etch1

Definition Id: oval:org.mitre.oval:def:20269

Oval ID:	oval:org.mitre.oval:def:20269
Title:	DSA-1629-2 postfix - privilege escalation
Description:	Sebastian Krahmer discovered that Postfix, a mail transfer agent, incorrectly checks the ownership of a mailbox. In some configurations, this allows for appending data to arbitrary files as root.
Family:	unix	Class:	patch
Reference(s):	DSA-1629-2 CVE-2008-2936	Version:	5
Platform(s):	Debian GNU/Linux 4.0	Product(s):	postfix
Definition Synopsis:
Debian GNU/Linux 4.0 is installed. AND postfix DPKG is earlier than 0:2.3.8-2+etch1

Definition Id: oval:org.mitre.oval:def:22549

Oval ID:	oval:org.mitre.oval:def:22549
Title:	ELSA-2008:0839: postfix security update (Moderate)
Description:	Postfix before 2.3.15, 2.4 before 2.4.8, 2.5 before 2.5.4, and 2.6 before 2.6-20080814, when the operating system supports hard links to symlinks, allows local users to append e-mail messages to a file to which a root-owned symlink points, by creating a hard link to this symlink and then sending a message. NOTE: this can be leveraged to gain privileges if there is a symlink to an init script.
Family:	unix	Class:	patch
Reference(s):	ELSA-2008:0839-01 CVE-2008-2936	Version:	6
Platform(s):	Oracle Linux 5	Product(s):	postfix
Definition Synopsis:
Oracle Linux 5.x rpm test postfix-pflogsumm is earlier than 2:2.3.3-2.1.el5_2 AND postfix is earlier than 2:2.3.3-2.1.el5_2

Definition Id: oval:org.mitre.oval:def:28256

Oval ID:	oval:org.mitre.oval:def:28256
Title:	RHSA-2008:0839 -- postfix security update (Moderate)
Description:	Updated postfix packages that fix a security issue are now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Postfix is a Mail Transport Agent (MTA), supporting LDAP, SMTP AUTH (SASL), and TLS. A flaw was found in the way Postfix dereferences symbolic links. If a local user has write access to a mail spool directory with no root mailbox, it may be possible for them to append arbitrary data to files that root has write permission to. (CVE-2008-2936) Red Hat would like to thank Sebastian Krahmer for responsibly disclosing this issue. All users of postfix should upgrade to these updated packages, which contain a backported patch that resolves this issue.
Family:	unix	Class:	patch
Reference(s):	RHSA-2008:0839 CESA-2008:0839-CentOS 3 CESA-2008:0839-CentOS 5 CVE-2008-2936	Version:	3
Platform(s):	Red Hat Enterprise Linux 3 Red Hat Enterprise Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 3 CentOS Linux 5	Product(s):	postfix
Definition Synopsis:
Red Hat Enterprise Linux 3 release section The operating system installed on the system is Red Hat Enterprise Linux 3 AND postfix is earlier than 2:2.0.16-14.1.RHEL3 AND Red Hat Enterprise Linux 4 release section The operating system installed on the system is Red Hat Enterprise Linux 4 Packages match section postfix is earlier than 2:2.2.10-1.2.1.el4_7 AND postfix-pflogsumm is earlier than 2:2.2.10-1.2.1.el4_7 AND Red Hat Enterprise Linux 5 and CentOS Linux 5 release section Operation system section The operating system installed on the system is Red Hat Enterprise Linux 5 AND The operating system installed on the system is CentOS Linux 5.x Packages match section postfix is earlier than 2:2.3.3-2.1.el5_2 AND postfix-pflogsumm is earlier than 2:2.3.3-2.1.el5_2

Definition Id: oval:org.mitre.oval:def:7819

Oval ID:	oval:org.mitre.oval:def:7819
Title:	DSA-1629 postfix -- programming error
Description:	Sebastian Krahmer discovered that Postfix, a mail transfer agent, incorrectly checks the ownership of a mailbox. In some configurations, this allows for appending data to arbitrary files as root. Note that only specific configurations are vulnerable; the default Debian installation is not affected. Only a configuration meeting the following requirements is vulnerable: For a detailed treating of the issue, please refer to the upstream author's announcement.
Family:	unix	Class:	patch
Reference(s):	DSA-1629 CVE-2008-2936	Version:	3
Platform(s):	Debian GNU/Linux 4.0	Product(s):	postfix
Definition Synopsis:
Debian GNU/Linux 4.0 is installed. Architecture section Architecture independent section Installed architecture is all AND Packages section postfix-doc is earlier than 2.3.8-2+etch1 AND postfix-dev is earlier than 2.3.8-2+etch1 OR Architecture dependent section Supported architectures section Installed architecture is s390 AND Installed architecture is amd64 AND Installed architecture is sparc AND Installed architecture is arm AND Installed architecture is i386 AND Installed architecture is mips AND Installed architecture is ia64 AND Installed architecture is alpha AND Installed architecture is powerpc AND Installed architecture is hppa AND Packages section postfix is earlier than 2.3.8-2+etch1 AND postfix-cdb is earlier than 2.3.8-2+etch1 AND postfix-pcre is earlier than 2.3.8-2+etch1 AND postfix-pgsql is earlier than 2.3.8-2+etch1 AND postfix-mysql is earlier than 2.3.8-2+etch1 AND postfix-ldap is earlier than 2.3.8-2+etch1

CPE : Common Platform Enumeration

Type	Description	Count
Application	Postfix cpe:2.3:a:postfix:postfix:2.6.0:::::::* cpe:2.3:a:postfix:postfix:2.5.3:::::::* cpe:2.3:a:postfix:postfix:2.5.2:::::::* cpe:2.3:a:postfix:postfix:2.5.1:::::::* cpe:2.3:a:postfix:postfix:2.5.0:::::::* cpe:2.3:a:postfix:postfix:2.4.7:::::::* cpe:2.3:a:postfix:postfix:2.4.6:::::::* cpe:2.3:a:postfix:postfix:2.4.5:::::::* cpe:2.3:a:postfix:postfix:2.4.4:::::::* cpe:2.3:a:postfix:postfix:2.4.3:::::::* cpe:2.3:a:postfix:postfix:2.4.2:::::::* cpe:2.3:a:postfix:postfix:2.4.1:::::::* cpe:2.3:a:postfix:postfix:2.4.0:::::::* cpe:2.3:a:postfix:postfix:2.3.9:::::::* cpe:2.3:a:postfix:postfix:2.3.8:::::::* cpe:2.3:a:postfix:postfix:2.3.7:::::::* cpe:2.3:a:postfix:postfix:2.3.6:::::::* cpe:2.3:a:postfix:postfix:2.3.5:::::::* cpe:2.3:a:postfix:postfix:2.3.4:::::::* cpe:2.3:a:postfix:postfix:2.3.3:::::::* cpe:2.3:a:postfix:postfix:2.3.2:::::::* cpe:2.3:a:postfix:postfix:2.3.14:::::::* cpe:2.3:a:postfix:postfix:2.3.13:::::::* cpe:2.3:a:postfix:postfix:2.3.12:::::::* cpe:2.3:a:postfix:postfix:2.3.11:::::::* cpe:2.3:a:postfix:postfix:2.3.10:::::::* cpe:2.3:a:postfix:postfix:2.3.1:::::::* cpe:2.3:a:postfix:postfix:2.3.0:::::::*	28

ExploitDB Exploits

id	Description
2008-08-31	Postfix <= 2.6-20080814 - (symlink) Local Privilege Escalation Exploit

OpenVAS Exploits

Date	Description
2009-10-13	Name : SLES10: Security update for Postfix File : nvt/sles10_postfix.nasl
2009-10-10	Name : SLES9: Security update for Postfix File : nvt/sles9p5032740.nasl
2009-04-09	Name : Mandriva Update for postfix MDVSA-2008:171 (postfix) File : nvt/gb_mandriva_MDVSA_2008_171.nasl
2009-03-23	Name : Ubuntu Update for postfix vulnerability USN-636-1 File : nvt/gb_ubuntu_USN_636_1.nasl
2009-03-06	Name : RedHat Update for postfix RHSA-2008:0839-01 File : nvt/gb_RHSA-2008_0839-01_postfix.nasl
2009-02-27	Name : CentOS Update for postfix CESA-2008:0839 centos3 i386 File : nvt/gb_CESA-2008_0839_postfix_centos3_i386.nasl
2009-02-27	Name : CentOS Update for postfix CESA-2008:0839 centos3 x86_64 File : nvt/gb_CESA-2008_0839_postfix_centos3_x86_64.nasl
2009-02-17	Name : Fedora Update for postfix FEDORA-2008-8593 File : nvt/gb_fedora_2008_8593_postfix_fc9.nasl
2009-02-17	Name : Fedora Update for postfix FEDORA-2008-8595 File : nvt/gb_fedora_2008_8595_postfix_fc8.nasl
2009-01-23	Name : SuSE Update for postfix SUSE-SA:2008:040 File : nvt/gb_suse_2008_040.nasl
2008-09-24	Name : Gentoo Security Advisory GLSA 200808-12 (postfix) File : nvt/glsa_200808_12.nasl
2008-09-04	Name : Debian Security Advisory DSA 1629-1 (postfix) File : nvt/deb_1629_1.nasl
2008-09-04	Name : Debian Security Advisory DSA 1629-2 (postfix) File : nvt/deb_1629_2.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
47658	Postfix Hardlink to Symlink Mailspool Arbitrary Content Append

Nessus® Vulnerability Scanner

Date	Description
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2008-0839.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20080814_postfix_on_SL3_x.nasl - Type : ACT_GATHER_INFO
2009-09-24	Name : The remote SuSE 9 host is missing a security-related patch. File : suse9_12219.nasl - Type : ACT_GATHER_INFO
2009-07-21	Name : The remote openSUSE host is missing a security update. File : suse_11_0_postfix-080804.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2008-171.nasl - Type : ACT_GATHER_INFO
2008-10-10	Name : The remote Fedora host is missing a security update. File : fedora_2008-8593.nasl - Type : ACT_GATHER_INFO
2008-10-10	Name : The remote Fedora host is missing a security update. File : fedora_2008-8595.nasl - Type : ACT_GATHER_INFO
2008-08-20	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-636-1.nasl - Type : ACT_GATHER_INFO
2008-08-19	Name : The remote Debian host is missing a security-related update. File : debian_DSA-1629.nasl - Type : ACT_GATHER_INFO
2008-08-15	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2008-0839.nasl - Type : ACT_GATHER_INFO
2008-08-15	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200808-12.nasl - Type : ACT_GATHER_INFO
2008-08-15	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2008-0839.nasl - Type : ACT_GATHER_INFO
2008-08-15	Name : The remote openSUSE host is missing a security update. File : suse_postfix-5501.nasl - Type : ACT_GATHER_INFO
2008-08-14	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_postfix-5500.nasl - Type : ACT_GATHER_INFO

Global Informations

Type	Count
CWE ID(s)	1
Oval ID(s)	7
CPE ID(s)	28
osvdb(s)	1
ExploitDB Exploit(s)	1
Openvas Exploit(s)	13
Nessus® Exploit(s)	14

	Related
6.2	CVE-2008-2936
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 1 more Alert(s)