Lucene search
UbuntuUSN-636-1HistoryAug 19, 2008 - 12:00 a.m.
Postfix vulnerability
2008-08-1900:00:00
ubuntu.com
28
Releases
- Ubuntu 8.04
- Ubuntu 7.10
- Ubuntu 7.04
- Ubuntu 6.06
Packages
- postfix -
Details
Sebastian Krahmer discovered that Postfix was not correctly handling
mailbox ownership when dealing with Linux’s implementation of hardlinking
to symlinks. In certain mail spool configurations, a local attacker
could exploit this to append data to arbitrary files as the root user.
The default Ubuntu configuration was not vulnerable.
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Ubuntu | 8.04 | noarch | postfix | <Â 2.5.1-2ubuntu1.1 | UNKNOWN |
| Ubuntu | 8.04 | noarch | postfix-cdb | <Â 2.5.1-2ubuntu1.1 | UNKNOWN |
| Ubuntu | 8.04 | noarch | postfix-ldap | <Â 2.5.1-2ubuntu1.1 | UNKNOWN |
| Ubuntu | 8.04 | noarch | postfix-mysql | <Â 2.5.1-2ubuntu1.1 | UNKNOWN |
| Ubuntu | 8.04 | noarch | postfix-pcre | <Â 2.5.1-2ubuntu1.1 | UNKNOWN |
| Ubuntu | 8.04 | noarch | postfix-pgsql | <Â 2.5.1-2ubuntu1.1 | UNKNOWN |
| Ubuntu | 7.10 | noarch | postfix | <Â 2.4.5-3ubuntu1.2 | UNKNOWN |
| Ubuntu | 7.10 | noarch | postfix-cdb | <Â 2.4.5-3ubuntu1.2 | UNKNOWN |
| Ubuntu | 7.10 | noarch | postfix-ldap | <Â 2.4.5-3ubuntu1.2 | UNKNOWN |
| Ubuntu | 7.10 | noarch | postfix-mysql | <Â 2.4.5-3ubuntu1.2 | UNKNOWN |
References
Related
openvas
openvas
Debian Security Advisory DSA 1629-2 (postfix)
2008-09-04 00:00:00
Mandriva Update for postfix MDVSA-2008:171 (postfix)
2009-04-09 00:00:00
RedHat Update for postfix RHSA-2008:0839-01
2009-03-06 00:00:00
nessus
nessus
RHEL 3 / 4 / 5 : postfix (RHSA-2008:0839)
2008-08-15 00:00:00
Debian DSA-1629-2 : postfix - programming error
2008-08-19 00:00:00
Mandriva Linux Security Advisory : postfix (MDVSA-2008:171)
2009-04-23 00:00:00
veracode
veracode
Privilege Escalation
2020-04-10 00:26:37
debian
debian
[SECURITY] [DSA 1629-1] New postfix packages fix privilege escalation
2008-08-18 20:51:36
exploitpack
exploitpack
Postfix 2.6-20080814 - symlink Local Privilege Escalation
2008-08-31 00:00:00
prion
prion
Hardcoded credentials
2008-08-18 19:41:00
centos
centos
postfix security update
2008-08-15 09:43:49
seebug
seebug
Postfix <= 2.6-20080814 - (symlink) Local Privilege Escalation Exploit
2014-07-01 00:00:00
Postfix <= 2.6-20080814 (symlink) Local Privilege Escalation Exploit
2008-08-31 00:00:00
cert
cert
Postfix local privilege escalation
2008-08-18 00:00:00
debiancve
debiancve
CVE-2008-2936
2008-08-18 19:41:00
cve
cve
CVE-2008-2936
2008-08-18 19:41:00
oraclelinux
oraclelinux
postfix security update
2008-08-14 00:00:00
securityvulns
securityvulns
PoCfix (PoC for Postfix local root vuln - CVE-2008-2936)
2008-09-02 00:00:00
Postfix mail server hardlinks privilege escalation
2008-09-02 00:00:00
packetstorm
packetstorm
rs_pocfix.txt
2008-08-31 00:00:00
redhat
redhat
(RHSA-2008:0839) Moderate: postfix security update
2008-08-14 00:00:00
altlinux
altlinux
Security fix for the ALT Linux 5 package postfix version 1:2.4.8-alt1
2008-08-05 00:00:00
cvelist
cvelist
CVE-2008-2936
2008-08-18 19:00:00
ubuntucve
ubuntucve
CVE-2008-2936
2008-08-18 00:00:00
exploitdb
exploitdb
Postfix 2.6-20080814 - 'symlink' Local Privilege Escalation
2008-08-31 00:00:00
suse
suse
local privilege escalation in postfix
2008-08-14 14:39:29
gentoo
gentoo
Postfix: Local privilege escalation vulnerability
2008-08-14 00:00:00
fedora
fedora
[SECURITY] Fedora 8 Update: postfix-2.5.5-1.fc8
2008-10-09 21:31:27
[SECURITY] Fedora 9 Update: postfix-2.5.5-1.fc9
2008-10-09 21:33:24