CVE Vulnerability

CVE-2008-4977

** DISPUTED ** postfix_groups.pl in Postfix 2.5.2 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/postfix_groups.stdout, (2) /tmp/postfix_groups.stderr, and (3) /tmp/postfix_groups.message temporary files. NOTE: the vendor disputes this vulnerability, stating "This is not a real issue ... users would have to edit a script under /usr/lib to enable it."

6.9 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 3.4 / Impact : 10

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

Scope

References
Link Resource
https://bugs.gentoo.org/show_bug.cgi?id=235770
https://bugs.gentoo.org/show_bug.cgi?id=235811
http://www.openwall.com/lists/oss-security/2008/10/30/2
http://bugs.debian.org/496401
http://dev.gentoo.org/~rbu/security/debiantemp/postfix Exploit
Configurations

Configuration 1

cpe:2.3:a:postfix:postfix:2.5.2:*:*:*:*:*:*:*
Information

Published : 2008-11-06 03:55

Updated : 2008-11-06 03:55

NVD link : CVE-2008-4977

Mitre link : CVE-2008-4977

Products Affected
No products.
CWE
CWE-59