CVE-2008-2936: Medium severity postfix vulnerability
Postfix before 2.3.15, 2.4 before 2.4.8, 2.5 before 2.5.4, and 2.6 before 2.6-20080814, when the operating system supports hard links to symlinks, allows local users to append e-mail messages to a file to which a root-owned symlink points, by creating a hard link to this symlink and then sending a message. NOTE: this can be leveraged to gain privileges if there is a symlink to an init script.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2008-2936?
CVE-2008-2936 is considered a medium severity vulnerability that allows local users to append emails to files owned by root.
How do I fix CVE-2008-2936?
To fix CVE-2008-2936, upgrade Postfix to version 2.3.15, 2.4.8, 2.5.4, 2.6-20080814 or later.
Which versions of Postfix are affected by CVE-2008-2936?
CVE-2008-2936 affects Postfix versions before 2.3.15, 2.4 before 2.4.8, 2.5 before 2.5.4, and 2.6 before 2.6-20080814.
Can CVE-2008-2936 be exploited remotely?
CVE-2008-2936 can only be exploited locally, as it requires local user access.
What types of operating systems are at risk from CVE-2008-2936?
CVE-2008-2936 impacts systems where the operating system supports hard links to symlinks.