corrupt your memory

Register | Login

FilesNewsUsersAuthors

Home Files News About Contact Add New

Showing 1 - 1 of 1

Files

Gentoo Linux Security Advisory 200808-12

Posted Aug 15, 2008

Authored by Gentoo | Site security.gentoo.org

Gentoo Linux Security Advisory GLSA 200808-12 - Sebastian Krahmer of SuSE has found that Postfix allows to deliver mail to root-owned symlinks in an insecure manner under certain conditions. Normally, Postfix does not deliver mail to symlinks, except to root-owned symlinks, for compatibility with the systems using symlinks in /dev like Solaris. Furthermore, some systems like Linux allow to hardlink a symlink, while the POSIX.1-2001 standard requires that the symlink is followed. Depending on the write permissions and the delivery agent being used, this can lead to an arbitrary local file overwriting vulnerability (CVE-2008-2936). Furthermore, the Postfix delivery agent does not properly verify the ownership of a mailbox before delivering mail (CVE-2008-2937). Versions less than 2.5.3-r1 are affected.

tags | advisory, arbitrary, local, root

systems | linux, solaris, suse, osx, gentoo

advisories | CVE-2008-2936, CVE-2008-2937

MD5 | 3d10d7b22f9734485a3dd000961d1cf5

Download | Favorite | Comments (0)