PT-2008-4374 · Postfix+1 · Postfix+1

Publicado 2008-08-18 · Atualizado 2018-10-11 · CVE-2008-2937

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Baixa

Vetor base

AV:L/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Postfix versions 2.5 through 2.5.3 Postfix versions 2.6 through 2.6-20080813

Description The issue allows local users to read e-mail messages by creating a mailbox file corresponding to another user's account name, because Postfix delivers to a mailbox file even when this file is not owned by the recipient.

Recommendations For Postfix versions 2.5 through 2.5.3, update to version 2.5.4 or later. For Postfix versions 2.6 through 2.6-20080813, update to version 2.6-20080814 or later.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2008-2937

RHSA-2011:0422

RHSA-2011_0422

Produtos afetados

Postfix

Red Hat

Referências · 27

• http://redhat.com/support/errata/RHSA-2011-0422.html · Aviso do Fabricante
• http://vupen.com/english/advisories/2008/2385 · Nota
• http://security.gentoo.org/glsa/glsa-200808-12.xml · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2008-2937 · Aviso do Fabricante
• https://redhat.com/archives/fedora-package-announce/2008-October/msg00271.html · Aviso do Fabricante
• http://mandriva.com/security/advisories?name=MDVSA-2009:224 · Aviso do Fabricante
• http://secunia.com/advisories/31485 · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00002.html · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2008-2937 · Nota
• http://wiki.rpath.com/Advisories:rPSA-2008-0259 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-2937 · Aviso do Fabricante
• https://issues.rpath.com/browse/RPL-2689 · Nota
• http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 · Nota
• ftp://ftp.porcupine.org/mirrors/postfix-release/experimental/postfix-2.6-20080814.HISTORY · Nota
• http://securityfocus.com/bid/30691 · Correção