CVE-2008-2936: postfix

Vulnerability summary

CVE-2008-2936 is a medium (CVSS 6.2) vulnerability in postfix. EPSS estimates a 0.99% chance of exploitation in the next 30 days, higher than 61.9% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 18-08-2008
   PublishedVulnerability first disclosed.
2. 07-08-2024
   Last modifiedVulnerability information updated.

Description

Postfix before 2.3.15, 2.4 before 2.4.8, 2.5 before 2.5.4, and 2.6 before 2.6-20080814, when the operating system supports hard links to symlinks, allows local users to append e-mail messages to a file to which a root-owned symlink points, by creating a hard link to this symlink and then sending a message. NOTE: this can be leveraged to gain privileges if there is a symlink to an init script.

• CWE-264Permissions, Privileges, and Access ControlsWeaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.