PT-2017-11133 · Oracle+3 · Berkeley Db+3

Published 2017-08-14 · Updated 2020-12-19 · CVE-2017-10140

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Postfix versions prior to 2.11.10 Postfix versions 3.0.x prior to 3.0.10 Postfix versions 3.1.x prior to 3.1.6 Postfix versions 3.2.x prior to 3.2.2

Description The issue allows local users to gain privileges by leveraging undocumented functionality in Berkeley DB 2.x and later, related to reading settings from DB CONFIG in the current directory.

Recommendations For Postfix versions prior to 2.11.10, update to version 2.11.10 or later. For Postfix versions 3.0.x prior to 3.0.10, update to version 3.0.10 or later. For Postfix versions 3.1.x prior to 3.1.6, update to version 3.1.6 or later. For Postfix versions 3.2.x prior to 3.2.2, update to version 3.2.2 or later.

Exploit

Fix

Related Identifiers

ALT-PU-2018-1346

ALT-PU-2020-3538

CVE-2017-10140

DLA-1135-1

DLA-1136-1

DLA-1137-1

MGASA-2017-0380

USN-3489-1

USN-3489-2

Affected Products

Alt Linux

Berkeley Db

Postfix

Ubuntu

References · 19

• 🔥 http://seclists.org/oss-sec/2017/q3/285 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2017-10140 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-10140 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/4JKFB2V7HP5V4KCYKSXMTWUDWUWQOV3S · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3489-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2017-0380 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-10140 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-10140 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:0366 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-10140 · Security Note
• http://postfix.org/announcements/postfix-3.2.2.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-10140 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3489-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-10140 · Security Note
• https://ubuntu.com/security/notices/USN-3489-2 · Vendor Advisory