Overview
The Postfix MTA contains a local privilege escalation vulnerability.
Description
Postfix is an mail transport agent (MTA) that is used by several Unix-like operating systems. Symbolic links and hard links are types of files that reference other files. Unlike hard links, symbolic links can point to directories and use relative pathnames. On some non-POSIX.1-2001 and X/Open XPG4v2 compliant systems, users can hardlink symlinks which are owned by the root user. Postfix allows root-owned symlinks to be used as a mail destination folder. A hard link to a Postfix root-owned symlink could point to a file that can be overwritten by Postfix, regardless of the permissions of the destination file. |
Impact
A local, authenticated attacker may be able to overwrite arbitrary files, possibly gaining elevated privileges. |
Solution
Upgrade |
|
Vendor Information
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | N/A | N/A |
| Temporal | N/A | N/A |
| Environmental | N/A |
References
Acknowledgements
Thanks to Wietse Venema for information that was used in this report. Sebastian Krahmer of SuSE is credited for discovering and reporting this issue.
This document was written by Ryan Giobbi.
Other Information
| CVE IDs: | CVE-2008-2936 |
| Severity Metric: | 4.20 |
| Date Public: | 2008-08-18 |
| Date First Published: | 2008-08-18 |
| Date Last Updated: | 2008-08-19 14:52 UTC |
| Document Revision: | 20 |