CVE-2008-3889: Input Validation
Postfix 2.4 before 2.4.9, 2.5 before 2.5.5, and 2.6 before 2.6-20080902, when used with the Linux 2.6 kernel, leaks epoll file descriptors during execution of "non-Postfix" commands, which allows local users to cause a denial of service (application slowdown or exit) via a crafted command, as demonstrated by a command in a .forward file.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2008-3889?
CVE-2008-3889 is rated as a medium severity vulnerability due to its potential to cause denial of service.
How do I fix CVE-2008-3889?
To mitigate CVE-2008-3889, upgrade Postfix to version 2.4.9, 2.5.5, or 2.6-20080902 or later.
Which versions of Postfix are affected by CVE-2008-3889?
CVE-2008-3889 affects Postfix versions 2.4 prior to 2.4.9, 2.5 prior to 2.5.5, and 2.6 prior to 2.6-20080902.
What systems are vulnerable to CVE-2008-3889?
CVE-2008-3889 is vulnerable on systems running affected versions of Postfix with the Linux 2.6 kernel.
Can CVE-2008-3889 lead to remote exploits?
CVE-2008-3889 does not directly allow remote exploits but can lead to local denial of service if exploited.