Published: 18/08/2008 Updated: 07/11/2023

CVSS v2 Base Score: 6.2 | Impact Score: 10 | Exploitability Score: 1.9

VMScore: 625

Vector: AV:L/AC:H/Au:N/C:C/I:C/A:C

Postfix prior to 2.3.15, 2.4 prior to 2.4.8, 2.5 prior to 2.5.4, and 2.6 prior to 2.6-20080814, when the operating system supports hard links to symlinks, allows local users to append e-mail messages to a file to which a root-owned symlink points, by creating a hard link to this symlink and then sending a message. NOTE: this can be leveraged to gain privileges if there is a symlink to an init script.

Vulnerable Product	Search on Vulmon	Subscribe to Product
postfix postfix 2.5.0
postfix postfix 2.3.11
postfix postfix 2.3.6
postfix postfix 2.3.0
postfix postfix 2.5.2
postfix postfix 2.4.0
postfix postfix 2.3.12
postfix postfix 2.3.10
postfix postfix 2.4.5
postfix postfix 2.3.9
postfix postfix 2.3.2
postfix postfix 2.3.7
postfix postfix 2.3.14
postfix postfix 2.4.3
postfix postfix 2.5.3
postfix postfix 2.6.0
postfix postfix 2.4.7
postfix postfix 2.4.2
postfix postfix 2.3.4
postfix postfix 2.3.3
postfix postfix 2.3.1
postfix postfix 2.5.1
postfix postfix 2.3.8
postfix postfix 2.3.5
postfix postfix 2.4.1
postfix postfix 2.4.6
postfix postfix 2.4.4
postfix postfix 2.3.13

Sebastian Krahmer discovered that Postfix was not correctly handling mailbox ownership when dealing with Linux’s implementation of hardlinking to symlinks In certain mail spool configurations, a local attacker could exploit this to append data to arbitrary files as the root user The default Ubuntu configuration was not vulnerable ...

Sebastian Krahmer discovered that Postfix, a mail transfer agent, incorrectly checks the ownership of a mailbox In some configurations, this allows for appending data to arbitrary files as root Note that only specific configurations are vulnerable; the default Debian installation is not affected Only a configuration meeting the following require ...

#!/bin/sh # # "rs_pocfixsh" (PoC for Postfix local root vulnerability: CVE-2008-2936) # by Roman Medina-Heigl Hernandez aka RoMaNSoFt <roman@rs-labscom> # # Tested: Ubuntu / Debian # # [ Madrid, 30Aug2008 ] # # Config writable_dir=/tmp spool_dir=/var/mail # Use "postconf mail_spool_directory" to obtain this user=root target=/etc/pas ...

Proof of concept exploit for the local root vulnerability in Postfix Original discovery by Sebastian Krahmer ...

CWE-264 ftp://ftp.porcupine.org/mirrors/postfix-release/experimental/postfix-2.6-20080814.HISTORY ftp://ftp.porcupine.org/mirrors/postfix-release/official/postfix-2.3.15.HISTORY ftp://ftp.porcupine.org/mirrors/postfix-release/official/postfix-2.4.8.HISTORY ftp://ftp.porcupine.org/mirrors/postfix-release/official/postfix-2.5.4.HISTORY http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00002.html http://www.securityfocus.com/bid/30691 http://secunia.com/advisories/31485 http://secunia.com/advisories/31500 http://www.kb.cert.org/vuls/id/938323 http://www.securitytracker.com/id?1020700 http://security.gentoo.org/glsa/glsa-200808-12.xml http://secunia.com/advisories/31469 http://www.redhat.com/support/errata/RHSA-2008-0839.html http://article.gmane.org/gmane.mail.postfix.announce/110 http://secunia.com/advisories/31477 http://www.mandriva.com/security/advisories?name=MDVSA-2008:171 http://www.debian.org/security/2008/dsa-1629 http://secunia.com/advisories/31530 http://secunia.com/advisories/31474 https://issues.rpath.com/browse/RPL-2689 http://wiki.rpath.com/Advisories:rPSA-2008-0259 http://securityreason.com/securityalert/4160 http://secunia.com/advisories/32231 https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00287.html https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00271.html http://www.vupen.com/english/advisories/2008/2385 https://exchange.xforce.ibmcloud.com/vulnerabilities/44460 https://www.exploit-db.com/exploits/6337 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10033 https://usn.ubuntu.com/636-1/http://www.securityfocus.com/archive/1/495882/100/0/threaded http://www.securityfocus.com/archive/1/495632/100/0/threaded http://www.securityfocus.com/archive/1/495474/100/0/threaded https://usn.ubuntu.com/636-1/https://nvd.nist.gov https://www.exploit-db.com/exploits/6337/https://www.kb.cert.org/vuls/id/938323

CVE-2008-2936

Vulnerability Summary

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect