Vulnerability Note VU#938323

Postfix local privilege escalation

Overview

The Postfix MTA contains a local privilege escalation vulnerability.

I. Description

Postfix is an mail transport agent (MTA) that is used by several Unix-like operating systems. Symbolic links and hard links are types of files that reference other files. Unlike hard links, symbolic links can point to directories and use relative pathnames.

On some non-POSIX.1-2001 and X/Open XPG4v2 compliant systems, users can hardlink symlinks which are owned by the root user. Postfix allows root-owned symlinks to be used as a mail destination folder. A hard link to a Postfix root-owned symlink could point to a file that can be overwritten by Postfix, regardless of the permissions of the destination file.

II. Impact

A local, authenticated attacker may be able to overwrite arbitrary files, possibly gaining elevated privileges.

III. Solution

Upgrade

See http://article.gmane.org/gmane.mail.postfix.announce/110 for information about obtaining updated software. Users who do not compile Postfix from source should see the systems affected section below for a partial list of affected vendors.

Set mailbox permissions

Making the system mail spool directory root-owned may mitigate this vulnerability. See http://article.gmane.org/gmane.mail.postfix.announce/110 for specific information about this and other workarounds.

Systems Affected

Vendor	Status	Date Notified
Apple Computer, Inc.	Unknown	19-Aug-2008
Conectiva Inc.	Unknown	1-Aug-2008
Cray Inc.	Unknown	1-Aug-2008
Debian GNU/Linux	Unknown	1-Aug-2008
DragonFly BSD Project	Not Vulnerable	2-Aug-2008
EMC Corporation	Unknown	1-Aug-2008
Engarde Secure Linux	Unknown	1-Aug-2008
F5 Networks, Inc.	Unknown	1-Aug-2008
Fedora Project	Unknown	1-Aug-2008
FreeBSD, Inc.	Unknown	1-Aug-2008
Fujitsu	Unknown	1-Aug-2008
Gentoo Linux	Vulnerable	18-Aug-2008
Hewlett-Packard Company	Unknown	1-Aug-2008
Hitachi	Unknown	1-Aug-2008
IBM Corporation	Unknown	1-Aug-2008
IBM Corporation (zseries)	Unknown	1-Aug-2008
IBM eServer	Unknown	1-Aug-2008
Ingrian Networks, Inc.	Unknown	1-Aug-2008
Juniper Networks, Inc.	Unknown	1-Aug-2008
Mandriva, Inc.	Vulnerable	18-Aug-2008
Microsoft Corporation	Unknown	1-Aug-2008
MontaVista Software, Inc.	Unknown	1-Aug-2008
NEC Corporation	Unknown	1-Aug-2008
NetBSD	Unknown	1-Aug-2008
Nokia	Unknown	1-Aug-2008
Novell, Inc.	Unknown	1-Aug-2008
Openwall GNU/*/Linux	Unknown	1-Aug-2008
QNX, Software Systems, Inc.	Unknown	1-Aug-2008
Red Hat, Inc.	Unknown	1-Aug-2008
Silicon Graphics, Inc.	Unknown	1-Aug-2008
Slackware Linux Inc.	Unknown	1-Aug-2008
Sony Corporation	Unknown	1-Aug-2008
Sun Microsystems, Inc.	Not Vulnerable	19-Aug-2008
SUSE Linux	Vulnerable	18-Aug-2008
The SCO Group	Unknown	1-Aug-2008
Turbolinux	Unknown	1-Aug-2008
Ubuntu	Vulnerable	19-Aug-2008
Unisys	Unknown	1-Aug-2008
Wind River Systems, Inc.	Unknown	1-Aug-2008

References

ftp://ftp.porcupine.org/mirrors/postfix-release/index/html
http://article.gmane.org/gmane.mail.postfix.announce/110
http://linuxgazette.net/105/pitcher.html
http://en.wikipedia.org/wiki/Hard_links
http://en.wikipedia.org/wiki/Symbolic_link

Credit

Thanks to Wietse Venema for information that was used in this report. Sebastian Krahmer of SuSE is credited for discovering and reporting this issue.

This document was written by Ryan Giobbi.

Other Information

Date Public:	2008-08-18
Date First Published:	2008-08-18
Date Last Updated:	2008-08-19
CERT Advisory:
CVE-ID(s):	CVE-2008-2936
NVD-ID(s):	CVE-2008-2936
US-CERT Technical Alerts:
Metric:	4.20
Document Revision:	20

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Produced 2008 by US-CERT, a government organization
Disclaimers and copyright information

Get Adobe Reader