Postfix 2.6-20080814 - 'symlink' Local Privilege Escalation

!/bin/sh "rspocfix.sh" PoC for Postfix local root vulnerability: CVE-2008-2936 by Roman Medina-Heigl Hernandez a.k.a. RoMaNSoFt Tested: Ubuntu / Debian Madrid, 30.Aug.2008 Config writabledir=/tmp spooldir=/var/mail Use "postconf mailspooldirectory" to obtain this user=root target=/etc/passwd...

Ubuntu 6.06 LTS / 7.04 / 7.10 / 8.04 LTS : postfix vulnerability (USN-636-1)

Sebastian Krahmer discovered that Postfix was not correctly handling mailbox ownership when dealing with Linux's implementation of hardlinking to symlinks. In certain mail spool configurations, a local attacker could exploit this to append data to arbitrary files as the root user. The default...

[SECURITY] [DSA 1629-2] New postfix packages fix installability problem on i386

------------------------------------------------------------------------ Debian Security Advisory DSA-1629-2 [email protected] http://www.debian.org/security/ Thijs Kinkhorst August 19, 2008 http://www.debian.org/security/faq -...

Debian DSA-1629-2 : postfix - programming error

Sebastian Krahmer discovered that Postfix, a mail transfer agent, incorrectly checks the ownership of a mailbox. In some configurations, this allows for appending data to arbitrary files as root. Note that only specific configurations are vulnerable; the default Debian installation is not affecte...

[SECURITY] [DSA 1629-1] New postfix packages fix privilege escalation

------------------------------------------------------------------------ Debian Security Advisory DSA-1629-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst August 18, 2008 http://www.debian.org/security/faq -...

Design/Logic Flaw

Postfix 2.5 before 2.5.4 and 2.6 before 2.6-20080814 delivers to a mailbox file even when this file is not owned by the recipient, which allows local users to read e-mail messages by creating a mailbox file corresponding to another user's account name...

DEBIAN-CVE-2008-2937

Postfix 2.5 before 2.5.4 and 2.6 before 2.6-20080814 delivers to a mailbox file even when this file is not owned by the recipient, which allows local users to read e-mail messages by creating a mailbox file corresponding to another user's account name...

CVE-2008-2937

Postfix 2.5 before 2.5.4 and 2.6 before 2.6-20080814 delivers to a mailbox file even when this file is not owned by the recipient, which allows local users to read e-mail messages by creating a mailbox file corresponding to another user's account name...

CVE-2008-2937

Postfix 2.5 before 2.5.4 and 2.6 before 2.6-20080814 delivers to a mailbox file even when this file is not owned by the recipient, which allows local users to read e-mail messages by creating a mailbox file corresponding to another user's account name...

CVE-2008-2937

Postfix 2.5 before 2.5.4 and 2.6 before 2.6-20080814 delivers to a mailbox file even when this file is not owned by the recipient, which allows local users to read e-mail messages by creating a mailbox file corresponding to another user's account name...

CVE-2008-2937

Postfix 2.5 before 2.5.4 and 2.6 before 2.6-20080814 delivers to a mailbox file even when this file is not owned by the recipient, which allows local users to read e-mail messages by creating a mailbox file corresponding to another user's account name...

DSA-1629-1 postfix - privilege escalation

Bulletin has no description...

GLSA-200808-12 : Postfix: Local privilege escalation vulnerability

The remote host is affected by the vulnerability described in GLSA-200808-12 Postfix: Local privilege escalation vulnerability Sebastian Krahmer of SuSE has found that Postfix allows to deliver mail to root-owned symlinks in an insecure manner under certain conditions. Normally, Postfix does not...

openSUSE 10 Security Update : postfix (postfix-5501)

A local privilege escalation vulnerability as well as a mailbox ownership problem has been fixed in postfix. CVE-2008-2936 and CVE-2008-2937 have been assigned to this problem. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extract...

SuSE 10 Security Update : Postfix (ZYPP Patch Number 5500)

A local privilege escalation vulnerability as well as a mailbox ownership problem has been fixed in postfix. CVE-2008-2936 / CVE-2008-2937 have been assigned to this problem. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc...

Use sohu site URL jump loopholes to deceive the mailbox password-vulnerability warning-the black bar safety net

Author: emptiness prodigal heartXGC url jump vulnerability all over the major web site, simple look, THE9, sohu, etc. actually there are This loophole is! We take sohu, for example, talk about the vulnerability. Come to sohu, the user registration page, you can see that in the IE address bar, the...

Directory traversal in dovecot with zlib plugin

Directory traversal vulnerability in index/mbox/mbox-storage.c in Dovecot before 1.0.rc29, when using the zlib plugin, allows remote attackers to read arbitrary gzipped .gz mailboxes mbox files via a .. dot dot sequence in the mailbox name...

Dovecot mail_extra_groups setting is often used insecurely

mailextragroups=mail setting is often used insecurely to give Dovecot access to create dotlocks to /var/mail directory. If you don't use mboxes in /var/mail, make sure this setting is cleared. If you do use /var/mail mboxes and Dovecot gives permission errors without it, do one of the following i...

Debian: Security Advisory (DSA-1359-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

1 6 3 mailbox expression of vulnerability-vulnerability warning-the black bar safety net

- source: http://www. leapar. com/web/Article/ShowArticle. asp? ArticleID=4 7 5 html style body width: expressionevalString. fromCharCode0x69,0x66,0x28,0x21,0x77,0x69,0x6e, 0x64,0x6f,0x77,0x2e,0x78,0x78,0x78,0x29,0x7b,0x77, 0x69,0x6e,0x64,0x6f,0x77,0x2e,0x78,0x78,0x78,0x3d,0x31,0x3b,...