The Postfix MTA contains a local privilege escalation vulnerability.
Postfix is an mail transport agent (MTA) that is used by several Unix-like operating systems. Symbolic links and hard links are types of files that reference other files. Unlike hard links, symbolic links can point to directories and use relative pathnames.
On some non-POSIX.1-2001 and X/Open XPG4v2 compliant systems, users can hardlink symlinks which are owned by the root user. Postfix allows root-owned symlinks to be used as a mail destination folder. A hard link to a Postfix root-owned symlink could point to a file that can be overwritten by Postfix, regardless of the permissions of the destination file.
A local, authenticated attacker may be able to overwrite arbitrary files, possibly gaining elevated privileges.
Gentoo Linux Affected
Mandriva, Inc. Affected
SUSE Linux Affected
DragonFly BSD Project Not Affected
Sun Microsystems, Inc. Not Affected
Apple Computer, Inc. Unknown
Conectiva Inc. Unknown
Cray Inc. Unknown
Debian GNU/Linux Unknown
EMC Corporation Unknown
Engarde Secure Linux Unknown
F5 Networks, Inc. Unknown
Fedora Project Unknown
FreeBSD, Inc. Unknown
Hewlett-Packard Company Unknown
IBM Corporation Unknown
IBM Corporation (zseries) Unknown
IBM eServer Unknown
Ingrian Networks, Inc. Unknown
Juniper Networks, Inc. Unknown
Microsoft Corporation Unknown
MontaVista Software, Inc. Unknown
NEC Corporation Unknown
Novell, Inc. Unknown
Openwall GNU/*/Linux Unknown
QNX, Software Systems, Inc. Unknown
Red Hat, Inc. Unknown
Silicon Graphics, Inc. Unknown
Slackware Linux Inc. Unknown
Sony Corporation Unknown
The SCO Group Unknown
Wind River Systems, Inc. Unknown
Thanks to Wietse Venema for information that was used in this report. Sebastian Krahmer of SuSE is credited for discovering and reporting this issue.
This document was written by Ryan Giobbi.
|Date First Published:||2008-08-18|
|Date Last Updated:||2008-08-19 14:52 UTC|